Operator: Taled Pty Ltd (ACN 703 628 442, ABN 67 703 628 442) Privacy and support: support@taled.com.au We don't publish a street address. Please contact us by email.

Taled is run by Taled Pty Ltd (ACN 703 628 442, ABN 67 703 628 442), an Australian company. In this policy "we", "us" and "Taled" mean Taled Pty Ltd.

This policy explains how we collect, use, share and look after personal information when you use the Taled apps for iOS and Android and the Taled web app at taled.com.au. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Taled is an intermediary. Buyers and sellers deal with each other, and Stripe processes the payments. When another member receives your details to complete a sale (say, your address on a parcel), how they use them is up to them, though our Terms and Community Guidelines limit what they can do.

If you joined our waitlist before creating an account, the waitlist privacy policy on taled.com.au covers that signup. Once you have an account, this policy applies.

Account. Your email address and password. We don't store your password in readable form. Our database provider keeps a one-way hash of it.

If you sign in with Google, Google shares your name, email address and profile picture with us. We use them to create your account and sign you in. We never see your Google password. Our sign-in provider, Supabase, handles this for us. You can stop using Google sign-in any time in your Google account settings, but your Taled account and listings stay until you delete them.

Profile. Your display name, and if you add them, a profile photo, a short bio and your location (we suggest your suburb). Sellers also save postage rates, and can switch on Holiday Mode (with an optional return date). You don't have to use your real name as your display name, and you can browse listings without an account.

Listings. Book details (title, author, ISBN, format, condition, genre), price, description, photos, and the suburb, state and postcode the book ships or can be picked up from, plus whether you offer postage or local pickup.

Purchases. When you buy, you enter your name, your payment details and, if you're having the book posted, your delivery address on Stripe's secure checkout page. Stripe keeps your card details. We receive your name and any delivery address from Stripe, so the seller can post your book or hand it over. We also record when the seller marks an order posted, when the buyer taps Confirm it arrived, and when we release the seller's payout.

Local pickup. For a pickup order, we create a 4-digit handover code and show it only to you, the buyer. The seller never sees it, and we don't write it to our logs. We keep a timestamped record of each step in the handover: every time the seller enters a code and whether it was right or wrong, when the seller taps I've handed it over, when you tap I've got my book or Report a problem, when we reset code entry, and when an order is released or cancelled automatically. We also store the pickup date you and the seller agree. We use these records to hold, release or refund the payment and to handle disputes, and we keep them with the order record.

Messages. What you send other members in chat, and anything you send us through Contact us or Appeal a decision in the app.

Chat photos. Photos you attach in chat, plus when and who sent them. We remove location data from photos when you upload them.

Sellers you follow. The sellers you choose to follow, so we can tell you when they list something new.

Reviews, reports and blocks. Reviews you leave for sellers, reports you make about listings or members (including the reason and any note), and people you block.

Terms of Use. A record that you accepted our Terms of Use, which version, and when. Our Terms say you must be 16 or older, so this is also how we record that you confirmed your age.

Community Guidelines. A record that you accepted our Community Guidelines, which version, and when. New accounts accept when they sign up. Older accounts accept the next time they list, message or review.

Waitlist. If you joined the waitlist, we hold your email, whether you want to buy or sell or both, roughly how many books you plan to sell, your state, and whether we sent you a welcome email.

If you send feedback during testing, we collect what you type, any screenshot you attach, your app version, device model, operating system and user ID. We use it only to fix bugs and improve Taled, and we delete it within 90 days of launch.

If you buy, Stripe tells us whether your payment went through, and gives us payment references, the fees Stripe charged, and details of any refund or card dispute on your order.

If you sell, we create a Stripe account for your payouts using your email, display name and Taled user ID. Stripe then collects your legal name, date of birth, address, ID and bank details directly and verifies who you are. Stripe tells us your Stripe account ID, whether you can receive payments and payouts, and whether Stripe needs more information from you. We don't receive your bank account number or ID documents.

Server logs. When your app talks to our servers, our hosting and database providers record technical details such as your IP address, browser or device type, the time, the page or request, and any error. Some of our own logs include your Taled user ID, for example when an order is paid or an account is deleted. We use logs to keep Taled running and secure.

Crash and error reports. When the Taled app or web app hits an error or crashes, it sends a report to Sentry, our crash reporting service. A report shows what went wrong in the code, the app version, your device and operating system type, and the screen or page you were on. For about 1 in 10 sessions we also record how long screens and requests take to load. We don't record your screen, and we've set it up not to send your name, email or IP address. We use these reports only to find and fix bugs.

On your device. The app stores some things on your phone or in your browser's local storage: your sign-in session, cart, saved books, listing drafts, and the area you set for Near me. That information stays on your device and we don't collect it.

Phone notifications. If you allow notifications in the Taled app on iPhone or Android, we save a push token for that device with your account. It's a code that lets us send notifications to that phone, plus whether it's iOS or Android. We also save which kinds of notifications you've turned on or off.

What we don't collect. The app has no analytics or advertising tools, and we don't collect advertising IDs. The only device identifier we keep is the push token above, and only if you turn notifications on. We don't read your device's location (GPS or otherwise). For Near me and listings we use the suburb or postcode you type, and for a listing we save an approximate map point for that suburb, not your street address.

The app asks for camera access so you can photograph a book, take a profile photo, or scan a book's ISBN barcode. It asks for photo library access so you can pick a listing or profile photo. We only use these when you tap to add a photo or scan. Barcode scanning happens on your device, and we only keep the ISBN. We only upload the photos you choose.

We don't ask for sensitive information, such as health details, religion or political views. Please don't put it in listings, reviews or chat.

We use personal information to:

We only use your information for another purpose if it's related to one of these and you'd reasonably expect it, if you agree, or if the law requires or allows it.

We don't make decisions about you based only on automated processing. A person reviews reports before we hide a listing or suspend an account.

Anyone, signed in or not, can see a seller's display name, profile photo, bio, location, founding seller badge, postage rates, join date, whether they're on holiday and their return date, if they set one, plus their active listings (photos, description, price, suburb, state and postcode).

Signed-in members can also see a buyer's display name, profile photo, bio and location.

Reviews show your display name. Chat messages are seen by the person you're talking to. When you buy, the seller sees your name, and your delivery address if you're having the book posted. The seller never sees your pickup handover code. We don't show your email address to other members, and we don't tell a member who reported them.

Listing and profile photos are stored at web addresses that anyone with the link can open, so treat them as public.

Photos you send in chat are kept in private storage. Only you, the member you're chatting with, and Taled staff (for support, safety and moderation, like checking a report or dispute) can open them. They aren't public like listing photos, and links to them expire after a short time.

Listings are public, so search engines like Google, and apps that show link previews, may show them. That includes the title, photos, price, suburb and your seller display name. We don't share your full address, email or phone. When you remove a listing or close your account, we take the page down, but search engines may keep a cached copy for a while. You can ask Google to refresh it through its "Remove outdated content" tool, or contact us and we'll help.

These companies help us run Taled. They handle your information for us under their own privacy and data protection terms, which include security and confidentiality commitments.

Stripe also handles your information under its own privacy policy (stripe.com/au/privacy), because it has its own legal duties, such as identity checks and fraud prevention.

To send phone notifications, we pass your push token and the notification text to Expo's push service, which hands it to Apple (on iPhone) or Google (on Android) to deliver.

A few other services see limited technical data. On the web, the app loads fonts from Google Fonts, so Google receives your IP address and browser details. When you look up a book by ISBN, your device asks Open Library and Google Books for the book's details, and some book covers load from Open Library. These services receive the ISBN or cover request and your IP address, but nothing from your account.

We may disclose personal information to police, courts, regulators or government agencies when the law requires or allows it, for example to respond to a warrant, or when we reasonably believe it's needed to prevent serious harm or investigate fraud or unlawful activity.

If we move Taled into a company or sell it, your information may pass to the new operator, who'll need to handle it in line with this policy. We'll tell you if that happens.

We don't sell or rent your personal information to anyone.

Some of our providers store or access personal information outside Australia:

Before we disclose personal information to an overseas provider, we take reasonable steps to make sure they handle it in a way that's consistent with the APPs, mainly by using providers with written data protection and security commitments. We stay responsible for how they handle it under the Privacy Act.

Information travels between your device and our servers over encrypted connections (HTTPS). Our database uses access rules so members can only change their own data, and the keys that can override those rules stay on our servers and never ship in the app. Only people we authorise (currently the two partners) can open the moderation tools. We use providers with strong security practices. Pickup handover codes are checked on our servers, and only the buyer can see them.

No system is perfectly secure. Use a password you don't use anywhere else, and tell us at support@taled.com.au straight away if you think someone has got into your account. If we have a data breach that's likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner (OAIC).

We may keep information longer if the law requires it, or if we need it for an open dispute, fraud investigation or legal claim. When we no longer need information, we delete it or remove anything that identifies you.

In the app, go to Account, then Settings & Help, then Delete account. You can also ask us to delete your account without the app at taled.com.au/delete-account. Sign in, or email support@taled.com.au from the address on your account.

When you confirm, we delete from our servers:

You can't delete your account while one of your sales is still waiting for its payout, or while we're still sorting out a card dispute (chargeback) or a reported pickup problem on one of your orders. Once that's sorted, you can go ahead. If you have an open dispute, you can delete your account once it's resolved.

The app also clears your cart, saved books and listing drafts from that device.

Some records stay, without your user ID attached:

Stripe keeps its own records of your payments and payouts, as the law requires it to. Emails you've sent to our support inbox and the emails we've sent you stay with our email providers for the periods in section 7.

Deletion is permanent. We can't restore an account once it's gone.

You can see and change most of your details in the app, including your display name, profile photo, bio, location and listings.

To ask for a copy of the personal information we hold about you, or to correct something you can't change yourself, email support@taled.com.au. We'll check it's you (usually by replying to your account email) and respond within 30 days. We don't charge for access requests. If we can't give you access or make a correction, we'll tell you why in writing and how you can complain.

We send emails you need to use Taled, such as password resets and messages about your account or orders. You can't opt out of these while your account is open.

If you add a book to your wishlist, we keep its title, author and ISBN with your account, and we'll email you when someone lists a copy. You can turn these emails off in Settings with Wishlist emails, and you'll still see the alert in the app.

We may also send news about Taled, such as launch updates and founding seller offers, if you've agreed to it or the Spam Act 2003 allows it. Every marketing email tells you how to unsubscribe, or you can email support@taled.com.au. We'll stop within 5 working days. We don't track whether you open our emails or click links in them, and we never give your details to other businesses for their marketing.

If you use the Taled app on iPhone or Android, we'll ask before sending notifications to your phone. You choose which ones you get in Settings, then Notifications: Messages, Orders and posting, Wishlist and saved book alerts, and Sellers you follow. You can also turn them off in your phone's settings. In app alerts still show in Notifications.

The Taled web app doesn't use advertising or analytics cookies. It keeps your sign-in session, cart, saved books and drafts in your browser's local storage so the app works. You can clear them in your browser settings, but you'll be signed out and lose your cart.

When you pay or set up payouts, you go to pages run by Stripe, which uses its own cookies to process payments and prevent fraud. Stripe's cookie policy covers those.

You must be 16 or older to create a Taled account. We don't knowingly collect personal information from children under 16. If you think someone under 16 has an account, email support@taled.com.au and we'll delete it.

If you're unhappy with how we've handled your personal information, email support@taled.com.au with "Privacy complaint" in the subject line and tell us what happened. We'll respond within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

We'll update this policy when our practices change, for example if we add a new service provider or a new way to sign in. For significant changes, we'll let you know in the app or by email before they take effect. The date at the top of this page shows when it last changed.

Taled Pty Ltd ACN 703 628 442 ABN 67 703 628 442 Email: support@taled.com.au

This policy is governed by the laws of Queensland, Australia.