Privacy Policy

1. Introduction

This Privacy Policy describes how Boomerang ("we," "us," or "our"), an Australian mobile application developed in Queensland, collects, uses, and shares information when you use our mobile application ("App"). By using the App, you agree to the collection and use of information in accordance with this policy.

We are committed to protecting your personal information and being transparent about how we use it. This policy applies to all users of the Boomerang mobile application, regardless of how you access or use it.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, phone number, email address, and username when you create an account
• Contact Information: Names, phone numbers, and email addresses of your contacts (only when you grant permission)
• Loan and Borrow Data: Item details, descriptions, due dates, notes, photos, categories, ratings, and reviews
• Payment Information: When you subscribe to Premium, payment is processed securely by Stripe. We do not store your full credit card details on our servers
• User Content: Any content you create, upload, or share through the App, including item photos stored in our secure storage

2.2 Information Collected Automatically

We automatically collect certain information when you use the App:

• Device Information: Device type, operating system version, unique device identifiers, and push notification tokens
• Advertising Identifier: On iOS, the Identifier for Advertisers (IDFA), and on Android, the Advertising ID. These are used to serve ads and measure ad performance through Google AdMob, only if you grant permission via Apple's App Tracking Transparency prompt on iOS or do not opt out on Android.
• Usage Information: Features used, actions taken, time spent in the App, and interaction patterns
• Log Data: IP address, access times, and error logs for debugging and service improvement

2.3 Permissions

The App may request the following device permissions:

• Contacts: To let you select people to lend to or borrow from and to send reminders
• Camera: To take photos of items you are lending or borrowing
• Photo Library: To attach existing photos to item records
• Notifications: To send you reminders about due dates and overdue items

Each permission is optional. The App will function with reduced features if you decline any permission.

3. How We Use Your Information

3.1 Primary Uses

We use the information we collect to:

• Provide, maintain, and improve the App and its features
• Process and manage your account registration and authentication
• Enable loan and borrow tracking, including item records, due dates, and return status
• Send push notifications and reminders about upcoming and overdue items
• Process Premium subscription payments through Stripe
• Generate analytics and insights about your lending and borrowing patterns (Premium feature)
• Provide customer support and respond to enquiries
• Detect, prevent, and address technical issues and security concerns

3.2 Advertising

The free tier of the App displays advertisements provided by Google AdMob. To serve ads, AdMob may collect information including your device's advertising identifier (IDFA on iOS, Advertising ID on Android), IP address, general location, and ad interaction data. AdMob uses this data to serve and measure ads, including personalised ads where permitted.

App Tracking Transparency (iOS): The first time you use the App on iOS, you will be asked via Apple's App Tracking Transparency prompt whether to allow Boomerang to track your activity across other companies' apps and websites. If you decline, AdMob will only serve non-personalised (contextual) ads. You can change this preference at any time in your device Settings → Boomerang → Tracking.

Google AdMob's use of your data is governed by Google's privacy policy at policies.google.com/privacy. Boomerang itself does not sell or directly share your personal information with advertisers.

Premium subscribers enjoy a completely ad-free experience and no advertising identifiers are sent for premium users.

4. How We Share Your Information

4.1 Service Providers

We share information with trusted third-party service providers who assist in operating the App:

• Supabase: Database hosting, authentication, file storage, and edge functions
• Stripe: Secure payment processing for Premium subscriptions
• Expo / EAS: App distribution, push notifications, and build services
• Google AdMob: For serving advertisements to free-tier users. AdMob may receive your advertising identifier (IDFA / Advertising ID), IP address, and ad interaction data. See Google's privacy policy for details.

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal requests by public authorities, including to meet national security or law enforcement requirements.

4.3 What We Do Not Do

• We do not sell your personal information to third parties
• We do not share your item records, loan history, or contact data with other users unless you explicitly initiate a notification or reminder

5. Data Storage and Security

We implement appropriate technical and organisational measures to protect your information:

• Data is encrypted in transit (TLS/SSL) and at rest
• Authentication is handled via Supabase Auth with secure token management
• Row-level security (RLS) policies ensure users can only access their own data
• Item photos are stored in a secure Supabase Storage bucket with access controls
• We conduct regular security reviews and keep dependencies up to date

Your data is primarily stored on servers managed by Supabase. While we take every reasonable precaution, no method of electronic transmission or storage is 100% secure.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the App. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it by law.

Returned item records may be retained in an anonymised form for aggregate analytics purposes.

7. Your Rights and Choices

Under applicable Australian privacy law (including the Privacy Act 1988), you have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Update or correct inaccurate information via your account settings
• Deletion: Request deletion of your account and associated data
• Data Export: Export your data in CSV or PDF format (Premium feature)
• Withdraw Consent: Revoke device permissions at any time through your device settings
• Opt Out: Unsubscribe from marketing communications

To exercise any of these rights, contact us at boomerangborrowingapp@gmail.com.

8. Children's Privacy

The App is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly.

9. International Data Transfers

Your information may be transferred to and processed in countries other than Australia, including where our service providers operate. We ensure appropriate safeguards are in place for such transfers and comply with the Australian Privacy Principles regarding cross-border disclosure of personal information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the App, sending a push notification, or updating the "Last Updated" date at the top of this page. Your continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our privacy practices, please contact us:

• Email: boomerangborrowingapp@gmail.com
• Location: Queensland, Australia

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.