Privacy Policy

Parm Rater is operated by Lucas Howlett ("we", "us", or "our"). This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the choices you have.

It covers the Parm Rater mobile app (the "App"), the website at parmrater.com.au (the "Site"), and the venue partner dashboard.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are in the European Economic Area or the United Kingdom, the GDPR section below applies to you. If you are a California resident, the CCPA section applies to you.

• Account information. Your email address, display name and username. If you sign up with an email and password we store a hashed password, never the password itself. If you sign in with Apple, Google or Facebook we store the identifier that service gives us instead.
• Content you create. Ratings, review text, photos, comments, likes, saved venues, follows, and any feedback or reports you send us.
• Approximate location. Only if you grant location permission. See the Location section below for exactly what we store.
• Device information. Device brand, model, type, operating system and version, and the app version you are running.
• Push notification token. An anonymous device token issued by Apple or Google, so we can send you notifications.
• Usage information. Screens you open, venues and profiles you view, map pins you tap, ratings you start, finish or abandon, and ratings you share. This is tied to your account so we can build your feed and recommendations, and so we can see which parts of the app are worth improving.
• Search terms. What you search for, stored against a one way daily hash rather than your account or IP address, so we can show trending searches without building a search history about you.
• Website information. A session cookie when you sign in, and for venue partner and admin logins the IP address and browser user agent of the session, kept as a security record so a session can be revoked if something looks wrong.
• Crash and performance data. Diagnostic reports when the app crashes or runs slowly, including device state at the time.

We do not collect your contacts, your calendar, your microphone or your health data, and we do not read the advertising identifier on your device. We show no ads in Parm Rater.

Location is optional. Nothing about your location leaves your device unless you grant permission, and you can withdraw that permission at any time in your device settings.

• It is coarse. Before any location leaves your device we round it to roughly a one kilometre grid square. We store the rounded value, not your exact coordinates. It is enough to tell which suburb you are near, not where you are standing.
• Foreground only. We never request background or always-on location. Location is only read while you have the App open.
• At most once an hour. When you open the App we save at most one coarse location point per hour.
• What it is for. Venue and rating recommendations. It powers the venues and ratings we suggest to you, distances shown on venue cards, the map view centred near you, and notifications about deals or specials at venues in your area.
• We never share it. Your location data is not sold, not shared with advertisers, and not sent to any third party. It stays in our own database and is used only to run the features above.

Turning location off does not lock you out of anything. You can still search by suburb, browse the map, and rate venues.

We ask for camera and photo access only at the moment you choose to add a photo to a rating or your profile. We receive the single image you pick or take. We do not browse, scan, or index your photo library, and we strip the image of embedded metadata such as GPS coordinates before it is stored.

• To create your account and sign you in.
• To publish your ratings, photos and comments, and to build your feed, leaderboards, stats and achievements.
• To recommend venues and ratings near you, and to sort venues by distance.
• To send push notifications you have opted into, such as likes, comments, follows, and deals at venues in your area.
• To send our email newsletter, which you can leave at any time.
• To promote Parm Rater, using public content such as ratings, rating photos, usernames and profile photos in our newsletter and in posts on our own social media accounts.
• To understand which features get used, fix crashes, and improve performance.
• To moderate content, respond to reports, prevent abuse, and enforce our Terms of Use.
• To meet our legal obligations.

Parm Rater is a public review platform. Please treat anything you post as public and permanent.

• Your username, display name, profile photo, ratings, review text, rating photos, comments and stats are visible to everyone, including people who do not have the App.
• They are published on parmrater.com.au, listed in our sitemap, and can be indexed by search engines and appear in search results.
• We also feature public content in posts on our own social media accounts, for example a rating photo, the score, the venue and the username of the rater. Those posts live on platforms we do not control, such as Instagram and Facebook.
• Your email address, password, push token, device information and location are never public.

If you would rather not be identifiable, choose a username that is not your real name.

We do not sell your personal information and we do not share it with advertisers. We use the following providers to run the service, and they may process personal information on our behalf:

• Amazon Web Services for hosting, our database, photo storage and outbound email.
• PostHog for product analytics. It receives your user ID, username, email address, and the in-app events listed above.
• Google Firebase (Crashlytics and Performance Monitoring) for crash reports and performance diagnostics.
• Sentry for error reporting.
• Expo for push notification delivery and over the air app updates.
• Apple and Google for sign in and push notification delivery, where you use those options.
• Meta (Facebook) if you choose to sign in with Facebook. The Facebook SDK is included in the App so that button works. When you use it, Facebook tells us your Facebook ID, name and email address, and Facebook learns that you signed in to Parm Rater. We have turned off the SDK’s automatic event logging and its collection of the advertising identifier, so it does not report your activity in the App back to Facebook. We never send Facebook your ratings, your photos or your location.
• Mapbox and Google Maps and Places for maps and venue search. When you type in venue search, your search text is sent to Google to return suggestions.
• Stripe for venue partner subscription payments only. Stripe handles card details directly and we never see or store them. This does not apply if you only use the App.

Your location is not on this list and never will be. We do not send your coordinates, coarse or otherwise, to any of these providers. Note that analytics and crash providers do see the IP address your device connects from, which gives them a rough city level idea of where a request came from, as it does for any website you visit.

We may also disclose information if the law requires it, in response to a valid legal process, or where it is necessary to protect our rights, our users, or the public. If Parm Rater is ever sold or transferred, personal information may transfer with it, and we will tell you before that happens.

Our database, photo storage and email sending are hosted in Australia, in the AWS Asia Pacific (Sydney) region. Some of the providers listed above are based overseas, mainly in the United States, so the information they process for us is stored there. We only use providers that commit to protecting personal information to a comparable standard, and we share the minimum needed for each provider to do its job.

• Push notifications. Sent only if you allow notifications on your device. You can turn categories on and off in the App’s notification settings, or turn them all off in your device settings.
• Newsletter. When you create an account you are subscribed to our monthly newsletter by default. Every newsletter has a one click unsubscribe link, and you can also unsubscribe by emailing us. Unsubscribing does not affect service emails such as password resets.

The Site uses a small number of strictly necessary cookies. The main one holds your sign in session so you stay logged in. We do not use advertising cookies or third party tracking cookies on the Site.

• Account information is kept while your account is open, and deleted when you delete your account.
• Coarse location points are only ever stored in rounded form, at roughly one kilometre precision. We keep them in that form for as long as we use them for the features described in the Location section.
• Usage and analytics events are kept for up to 24 months.
• Crash reports are kept for up to 90 days.
• Ratings, photos and comments stay published after you delete your account, because they are part of the public venue history that other people rely on. They are detached from your account when you delete it. If you want your content removed as well, email us and we will remove it from Parm Rater. Posts we have already published on other platforms may stay up or stay cached there, and we will delete ours where we can.
• Records we are legally required to keep, such as payment records for venue partners, are kept for as long as the law requires.

Passwords are hashed, traffic is encrypted in transit, session tokens are stored hashed and can be revoked, and access to production data is limited to people who need it. No system is perfectly secure, so we cannot promise absolute security. If a data breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.

• Access and correct. You can view and edit your profile in the App at any time, or ask us for a copy of the personal information we hold about you.
• Delete your account. Open the App, go to Settings, and choose Delete Account. You can also email us. Your ratings stay published unless you ask us to remove them too, and anything we have already posted to social media may stay up there.
• Location. Grant or revoke location permission in your device settings at any time.
• Notifications. Manage push categories in the App, or turn notifications off entirely in your device settings.
• Marketing. Unsubscribe from the newsletter using the link in any issue.
• Complaints. If you are unhappy with how we handled your information, contact us first at hello@parmrater.com.au. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

We rely on the following legal bases:

• Contract. Creating your account, publishing your ratings, and running the core features of the App.
• Consent. Location, camera and photo access, push notifications, and marketing email. You can withdraw consent at any time without affecting what we did before you withdrew it.
• Legitimate interests. Keeping the service secure, preventing abuse, understanding how the App is used so we can improve it, and promoting Parm Rater using public content.
• Legal obligation. Where we have to keep or disclose records.

You have the right to access, correct, delete, restrict and object to the processing of your personal information, and the right to receive it in a portable format. Contact hello@parmrater.com.au to exercise any of these. You also have the right to lodge a complaint with your local data protection authority.

We do not sell or share your personal information as those terms are defined by the CCPA, and we have not done so in the past 12 months. You have the right to know what we collect, to request deletion, to request correction, and not to be discriminated against for exercising those rights. Contact hello@parmrater.com.au to make a request.

Parm Rater is not intended for children under 13, and you must be at least 13 to create an account. We do not knowingly collect personal information from children under 13. If you believe a child has created an account, email us and we will delete it.

We may update this Privacy Policy from time to time. The date at the top of this page always shows when it last changed. If we make a significant change, we will let you know through the App or by email before it takes effect.

Questions, requests or complaints about privacy can go to hello@parmrater.com.au. We aim to respond within 30 days.