Operator: Atlantic IT Services (ABN 29 892 371 842) — a sole trader based in Victoria, Australia, and the provider of the Chabeel Finder app (“the App”). Chabeel Finder is the App's name, not a separate registered business.
Contact: support@atlanticit.com.au
Chabeel Finder is a free, community-driven app that helps people find active Chabeel stations — places where free drinks and food are being distributed as an act of Seva (selfless service) rooted in the Sikh tradition, open to anyone regardless of background or faith. This policy explains how we handle personal information in connection with the App, in line with the Australian Privacy Principles (APPs) in Schedule 1 of the Privacy Act 1988 (Cth).
Public by design. Chabeel Finder has no accounts, no profiles, and no login. It works entirely on an anonymous device identifier. There is nothing to sign up for, and we never ask for your name, email address, or phone number. The trade-off is that any pin you add — its location, the items you select, and any note you type — is visible to every person using the App, because that is the whole point of the App: helping others find a Chabeel. Please don't put personal information in a pin's free-text note.
1. What information we collect
| Information | Why we collect it |
|---|---|
| Anonymous device ID (Firebase Anonymous Authentication) | Lets you manage a pin you've added (extend it or mark it ended), enforces a fair one-pin-per-hour submission limit, and prevents duplicate reports on the same pin. It is not a name, email, or phone number. On Android it resets if you uninstall the App or clear its data. On iOS it is kept in the device's secure keychain, which iOS preserves across reinstalls, so it can persist until the device is erased. |
| Device location | To centre the map on you and show nearby Chabeel stations. Requested only while the App is in use — we do not track location in the background or outside the App. |
| Content you submit (a pin) | The location you choose, the items being served, and an optional free-text note (up to 100 characters), stored against your anonymous ID and shown publicly — see the callout above. |
| Content you submit (a report) | If you report a pin as ended, wrongly placed, never real, or offensive, we store the reason you select against your anonymous ID, to stop the same pin being reported twice by the same person. To stop throwaway installs from removing genuine pins, a report only counts towards automatically ending a pin if the reporting device's anonymous ID is at least an hour old — we check this using the ID's creation time held by Firebase Authentication. |
| Advertising & consent data | The App shows a banner ad. Before any ad is requested we ask for your consent through Google's User Messaging Platform (UMP), and on iOS we separately ask for App Tracking Transparency permission. If you consent, an advertising identifier (Android's Advertising ID or, on iOS, the IDFA) may be used to show more relevant ads. If you don't consent, ads are still shown but are not personalised. You can change your choice at any time in Settings → Ad Privacy Options. |
| Crash & diagnostic data | If the App crashes, device model, OS version, and a stack trace are sent to Firebase Crashlytics so we can fix the bug. This does not include your pins, reports, or location. |
| Device integrity signal | Firebase App Check exchanges a short-lived attestation token (Play Integrity on Android, DeviceCheck on iOS) with Google to confirm requests are coming from a genuine copy of the App, not a script. It does not identify you personally. |
| Local, on-device preferences | Your language choice, whether onboarding is complete, and the list of contributors you have blocked are stored only in local app storage on your device. They are never sent to us. |
The App is not designed to collect government identifiers, health information, payment details, or any of the "sensitive information" categories defined in s 6 of the Privacy Act 1988. We do not currently support photo uploads. Please don't enter that kind of information into a pin's free-text note.
2. Why we collect, hold and use it
We use this information solely to operate the App: to show active Chabeel stations on the map, let you add and manage your own pins, keep the map accurate through community reporting, keep the service secure and free of abuse, fix crashes, and — where you consent — show relevant advertising to help keep the App free. We do not use personal information for marketing, we do not profile individuals or make automated decisions about them, and we do not sell or rent personal information to anyone.
3. Who we share it with
| Recipient | What | Why |
|---|---|---|
| Google LLC (Firebase & Cloud Firestore) | Pin and report content, your anonymous device ID, crash reports, and App Check attestation. | Hosting, database, anonymous authentication, crash reporting, and app-integrity checks. Stored overseas — see section 4. |
| Google LLC (AdMob & User Messaging Platform) | Ad requests and, where you consent, an advertising identifier. | To display the App's banner advertising and manage your consent choices. |
| Mapbox Inc. (USA) | Approximate location implied by the map tiles your device requests. | To render the map itself. |
| The Operator (Atlantic IT Services) | The contents of any support request you send us. | To diagnose and resolve the issue. |
| A regulator, court, or law-enforcement body | Only the specific records lawfully required. | Where we are compelled by law, for example a warrant or a lawful request from a regulator. |
We do not sell or rent personal information, and we do not disclose it to data brokers or social-media platforms.
4. Overseas disclosure (APP 8)
The App runs on Google Firebase and uses Google AdMob and Mapbox. Personal information — pins, reports, your anonymous ID, crash reports, and advertising data — is stored and processed on infrastructure located in the United States, and may transit other countries in which these providers operate. As APP 8.1 permits, we take reasonable steps to ensure this is handled consistently with the Australian Privacy Principles: Google and Mapbox process this data as our service providers under their standard data-processing terms, which restrict them from using it for their own unrelated purposes. We remain accountable for that information under APP 8.1. Because it is held overseas, it is subject to the laws of the country in which it is held, which may differ from the Australian Privacy Act.
5. How we secure it (APP 11)
- Data in transit is encrypted (TLS); data at rest is encrypted on Google's infrastructure.
- Firestore security rules enforce, at the database layer, that only you can extend or end a pin you created, only you can report a pin once, and pin data can never be altered outside these rules.
- Server-side functions independently re-validate submitted content, remove notes containing profanity, links, email addresses or phone numbers, and enforce the one-pin-per-hour limit, so these checks cannot be bypassed by a modified client.
- Firebase App Check adds a device-attestation signal on top of the above.
No method of electronic storage or transmission is completely secure. While we take the steps above and keep them under review, we cannot guarantee absolute security. If a data breach we are responsible for is likely to result in serious harm, we will notify affected users as soon as practicable and, where the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 applies, the Office of the Australian Information Commissioner (OAIC).
6. How long we keep it (retention)
| Record | Retention |
|---|---|
| Active pins | Live for up to 4 hours from creation, extendable by the creator to a maximum of 24 hours, after which they're automatically marked ended. |
| Ended pins & their reports | Kept for up to 30 days after the pin's scheduled expiry (for abuse investigation and map-quality review), then permanently deleted. |
| Flagged notes (moderation records) | If a pin's note is removed by our automatic filter or reported as offensive, we keep a copy of the note and the anonymous ID that posted it so we can review it. Deleted together with the pin, up to 30 days after the pin's scheduled expiry. |
| Blocked device IDs | If a device breaches the Terms we may add its anonymous ID to a block list. Kept for as long as the block is needed; it contains nothing but the ID. |
| Crash reports | Retained in line with Google Crashlytics' standard retention period (currently around 90 days). |
| Anonymous device ID | On Android, persists for the life of the App install and resets on uninstall or app-data clear. On iOS, persists in the device keychain across reinstalls until the device is erased. |
7. Your rights (APP 12 and APP 13)
Because the App has no accounts, we generally cannot look up "your" data from a name or email — we only know an anonymous device ID, and only your own device can prove which one is yours. In practice:
- You can see and remove your own content directly in the App at any time: open a pin you created and tap "Mark as Ended", or simply let it expire.
- On Android, uninstalling the App (or clearing its storage) discards your anonymous ID. On iOS it can survive a reinstall, as explained in section 1. Once the ID is gone, any pins already submitted under it remain until the retention period in section 6 ends, since we cannot identify which pins were yours once that link is gone.
- You can ask us to look into or delete a specific pin or report by emailing us the pin's location, approximate time, and content — enough for us to find the record — using the contact details above.
- You can make a complaint about how your information has been handled. Email us with the details; we'll acknowledge it promptly and respond within a reasonable time (and, where the Privacy Act applies, within 30 days). If you're not satisfied with our response, you can complain to the OAIC at oaic.gov.au or 1300 363 992.
8. Children
Chabeel Finder is a general-audience community app and is not directed at children. Because it collects no name, email, or other identifying account information, we have no practical way to know a user's age. We do not knowingly target or profile children.
9. Changes to this policy
We may update this policy as the App or the law changes. The "Last updated" date above shows the latest revision. Where a change is material, we will notify you in the App and, where appropriate, ask you to re-acknowledge it before continuing.
10. Contact
Email: support@atlanticit.com.au
Privacy Officer: The owner, Atlantic IT Services
Chabeel Finder is provided by Atlantic IT Services (ABN 29 892 371 842), a sole trader based in Victoria, Australia.