Privacy Policy

1. Who we are

Spade is operated by Spade Suite Pty Ltd (ABN 76 689 584 816) an Australian company ("Spade", "we", "us", "our"). Spade is a women's safety and community app for Australia, combining social connection with safety-focused features, including user-submitted Awareness reports.

This Privacy Policy explains what personal information we collect, how we use it, and the choices and rights you have. It applies to the Spade mobile app and to our website at spadesuite.app. If you have any questions, contact us at privacy@spadesuite.app.

2. Information we collect

Account information

When you create an account, we collect your email address and your first and last name. You may also choose to provide a phone number.

Because Spade is a women's safety and community app, we may ask you to complete a one-off identity verification step to confirm that you are eligible to use it. Where we do this, the verification is carried out by a trusted third-party identity verification provider, and you may be asked to present an identity document to that provider so it can confirm your eligibility. We do not receive or store your identity document, or the personal details contained in it — we only receive confirmation of whether verification was successful. The only account information we collect and keep is the information you choose to give us: your email address, first and last name, and (optionally) your phone number. The verification provider handles any document you present under its own privacy terms; once we integrate a provider we will name it here and explain how long it retains that information.

Content you create

We collect the content you choose to share in the app, such as posts, photos, videos, comments, group memberships and event RSVPs. This content is stored so the app can show it to you and, where relevant, to other members.

Awareness reports

If you submit an Awareness report, we collect the text of your report and any photos you attach. To protect privacy, photos are blurred on your device before they are uploaded — the clear original never leaves your phone. Only the blurred image is sent to and stored by us. Awareness reports may contain information about other people; see section 3.

Because Awareness reports may describe alleged conduct, they can include sensitive information (for example, information about alleged criminal conduct or health information). We collect this only because you choose to include it, we apply human review before any report is shown to the community, and we handle it with additional care.

Usage and diagnostics

To keep the app reliable and understand how it is used, we collect some technical information:

• Crash and error data through our diagnostics provider, Sentry, so we can find and fix problems. This may include technical information such as device type and the events leading up to an error.
• Anonymous usage analytics through TelemetryDeck, a privacy-focused analytics provider, which tells us in aggregate how features are used (for example, how often posts or messages are sent) so we can improve the app. Your user identifier is anonymised (hashed) before it is sent, we do not use advertising identifiers, and this information is not used to track you across other apps or websites.

3. Information about people who are not users

Awareness reports may include personal information about people who do not use Spade — for example, a person a member has interacted with on a dating platform. We recognise this is the most sensitive information we handle, and we take specific steps to minimise harm:

• Human review before publication. Every report is reviewed by a real person before it is visible to anyone else, and reports that breach our guidelines are not published.
• Blurred images. Photos attached to reports are blurred on the reporter's device before upload.
• Limited identifying detail. Our guidelines restrict the personal information a report may contain (for example, we do not permit home addresses, workplaces, phone numbers or other contact details).
• Takedown process. If you believe a report about you is inaccurate, unfair or unlawful, you can contact us at privacy@spadesuite.app. We will review the report, and we will remove or correct content that breaches our guidelines or the law.

If you are a person mentioned in a report, you may also request access to the personal information we hold about you and ask us to correct it, subject to our need to protect the safety and confidentiality of the person who submitted the report and other legal limits.

4. How we use your information

• To provide, operate and improve the Spade app and its features.
• To support safety and moderation, including reviewing Awareness reports before they become visible to others and investigating breaches of our Terms of Service.
• To send you transactional messages, such as verification codes, password resets and service notifications.
• To diagnose, troubleshoot and fix errors so the app stays stable and secure.
• To comply with our legal obligations, and to respond to lawful requests from regulators and law enforcement.
• To understand, in aggregate, how the app is used so we can improve it.

Direct marketing. We will only send you marketing communications with your consent, and every marketing message will include a simple way to opt out. We do not use your information for third-party advertising and we do not build advertising profiles about you.

5. Legal basis and the Australian Privacy Principles

We handle personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). We collect only the information we reasonably need to provide the app and its safety features, we tell you why we collect it, and we use it only for the purposes described in this policy or as otherwise permitted by law.

6. How information is stored and shared

We use trusted third-party service providers to run Spade. These providers process data on our behalf and under contract:

• Amazon Web Services (AWS) — hosting and media storage (including Amazon S3) for app data and uploaded media. Our data and media are hosted in AWS's Sydney, Australia region (ap-southeast-2).
• AWS Simple Email Service (SES) — sending transactional emails such as verification codes and password resets.
• Sentry — error and crash monitoring to keep the app stable.
• Zoho — email services for our correspondence with you.
• Identity verification provider — where we offer identity verification, a trusted third-party provider confirms your eligibility to use Spade. This provider processes any identity document you present under its own privacy terms; we receive only confirmation of whether verification was successful, not the document or the details it contains. We will name the specific provider here once it is integrated.

We do not sell your personal information, and we do not share it with advertisers or data brokers. We share information with the providers above only to the extent needed to operate the service. We may also disclose information where required or authorised by law, or where we reasonably believe disclosure is necessary to prevent a serious threat to someone's life, health or safety.

7. Overseas disclosure

Our core app data and uploaded media are stored in Australia (Amazon Web Services, Sydney region). Some of our other service providers store or process limited data outside Australia: Sentry processes crash and diagnostic data in the United States, and TelemetryDeck processes anonymous usage analytics in the European Union. Zoho, which we use for email correspondence, processes that data in Australia. Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

8. Security

We take reasonable steps to protect your information. Passwords are stored using one-way hashing (bcrypt) and are never stored in plain text. Data is transmitted over encrypted connections (TLS), and access to the app uses token-based authentication. Access to personal information within our team is limited to people who need it for moderation, support or operations. No method of transmission or storage is ever completely secure, but we work to protect your information and to respond quickly if a problem arises.

9. Data breaches

We comply with the Notifiable Data Breaches (NDB) scheme under the Privacy Act. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by law, and tell you what happened and what steps we recommend you take.

10. Data retention and deletion

We keep your personal information only for as long as needed to provide the service and meet our legal obligations. You can delete your account from within the app at any time, or by contacting us. When you delete your account, we remove the personal data associated with it within 30 days, except where we are required or permitted by law to retain it (for example, records relating to a legal claim or a law-enforcement request).

As an exception, Awareness reports may be retained or anonymised rather than fully deleted where this is necessary for community safety or to meet a legal requirement. Where a report is retained after you delete your account, we take reasonable steps to remove information that identifies you as the reporter.

11. Your rights

You have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate, out of date, incomplete or misleading.
• Delete your account and associated data.
• Opt out of marketing communications at any time.
• Complain about how we have handled your personal information.

To make a request, contact us at privacy@spadesuite.app. We will respond within a reasonable period (usually within 30 days). We may need to verify your identity before acting on a request. These rights are also available to non-users whose information appears in the app, subject to the limits described in section 3.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

12. Children

Spade is intended for adults. The app is for people aged 18 and over, and we do not knowingly collect personal information from anyone under 18. If we become aware that we hold information about a person under 18, we will delete it.

13. Cookies and this website

Our marketing website uses minimal or no tracking cookies. We do not use it to build advertising profiles or to track you across other websites.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you in the app before the changes take effect.

15. Contact

Questions about this policy or your personal information? Contact us at privacy@spadesuite.app.