Privacy / 隐私说明

Updated 30 October 2026 · Community pilot

What the service uses

You can browse public parks and approved activities without signing in. Google sign-in provides your account identifier, verified email and basic profile to Supabase Auth. This site does not request Gmail, Drive or contacts access. Google profile photos are not published by the community app.

The community service stores your chosen display name, optional occupation and suburb, field-visibility choices, host applications, activities, bookings, cancellations, attendance/correction records, saved activities, notices and necessary review/audit history. Your email is not included in public activity responses. Do not submit home addresses, children's identifying details or sensitive information in public descriptions.

Who can see it

Approved activities, discoveries and host introductions are public. The organiser can see bookings for their own activity. Occupation and suburb are private by default and only returned to organisers of your active bookings if you explicitly allow it. Community administrators can review applications, activities and relevant participation records, but administrator or membership status does not override your optional-field choices. Service operators with Supabase project access can access backend data for administration and support.

Location, photos and notifications

My location and Follow me keep GPS in browser memory by default. If you explicitly start or join a live location group, the service receives your latest GPS point, accuracy, display name and group membership. Signed-in users can see the group title and an approximate host area (rounded to two decimal places); current group members can see each other’s exact current points. Joining a location group is separate from event registration. An approved host or administrator can start a group. Samples overwrite the current point; no route history is added to the community snapshot or audit. Points become unreadable after 120 seconds without updates. Stopping removes the current membership; the host stopping closes the group. Expired rows are purged on the next location request. Hiding the page or losing GPS stops sharing on the device and attempts to stop it on the server; offline points expire within 120 seconds. Previously viewed information cannot be recalled. Share only at public meeting places and never include children’s identifying information. Map tiles are fetched from OpenStreetMap, which receives normal network information such as IP address and requested map area. A location you deliberately submit as a discovery is stored and becomes public only after approval. Photo uploads, AI review, scheduled collection, email/push reminders and payment are not enabled. Important updates appear inside the website; this is not proof that a participant received them. The separate Halloween map has its own location-sharing controls.

Optional private family details and Host applications

Family details are optional and never required to join or apply to host. If you explicitly save them as a parent/guardian, a separate private table stores up to ten child nicknames/names and birth years for this account. Nicknames are preferred; real names, full birthdays, schools and photos are not required. Only your own explicit family requests return these records; public profiles, event data, normal administrator review, live-location endpoints and community audit do not include them. Privileged project/database operators can access backend storage for support. Birth years produce a Sydney-year reference such as “turns 6 this year”, not an exact age. We do not store a calculated age.

You can edit or delete family details in Me. Deleting removes current child rows; metadata-only revision/request markers remain to prevent stale requests restoring deleted data. Provider backups may retain older copies for their retention period; deletion does not promise immediate erasure from backups. The family editor keeps fields only in the active form, not browser local/session storage or the general community state.

First organisers confirm they are 18 or older, supply a public host introduction and intended activities, and submit a private first-event draft for administrator review. This is self-declaration and content review, not identity/age verification. Optional languages are private to you and application reviewers; existing occupation/suburb field choices remain separate. Event draft text and a deliberately selected public meeting point may be kept in this tab's session storage for up to 24 hours to resume across sign-in; family records are never included. Drafts saved to the account persist until removed or processed. Family-event booking counts and age bands are entered separately for each event and returned only to that participant and organiser, not automatically copied from the family profile.

Storage and requests

Cloudflare hosts the website and Supabase hosts authentication and community data; the database is in Sydney. These providers may process operational logs. The browser stores your login session and language preference. No advertising tracker is added by this community release. Records remain stored during the pilot unless removed through an administrative process; no automatic retention deadline is implemented. You can edit optional fields and revoke their visibility in Me, cancel bookings in My plans, and request a record correction. For account/data removal or privacy questions, contact [email protected]. Requests are handled manually after identity verification; a self-service account-deletion tool is not yet available. Information another person has already seen cannot be recalled.