Privacy Policy

This Privacy Policy explains how RIFY PTY LTD ("Rify®", "we", "us", or "our") collects, uses, stores, and protects your information when you use the Rify® mobile application ("App").

By using the App, you confirm that you meet the minimum age requirement applicable to your jurisdiction (see Section 12) and you consent to the practices described in this Privacy Policy. When we make material changes to this Policy, we will notify you within the App and may require your re-acceptance before you can continue using the App.

1. Information We Collect

We collect the following categories of information when you use the App:

1.1 Account and Identity Data

1.2 Device and Session Data

Each time you open the App, we automatically record the following to your account:

1.3 Location Data

Precise GPS coordinates are collected during your active use of the App via iOS CoreLocation, subject to your permission. Location data is used to:

• Display nearby user requests, PSAs, and daily tasks;
• Compute your geohash (an approximate grid reference) for push notification topic subscriptions (stored on your device only, not in our database);
• Attach location metadata to content you submit (stored as a geohash on the content document, not as raw GPS coordinates);
• Compute your local timezone at the time of sign-up.

Your precise GPS coordinates are not persistently stored in your user profile beyond the timezone computation at sign-up. We do not sell or rent your location data.

For the map search feature, your search query and approximate location are transmitted to Apple's servers via MKLocalSearchCompleter and CLGeocoder (Apple's mapping and geocoding services). This transmission is governed by Apple's Privacy Policy.

1.4 Content Data

When you submit content to the App, we collect and store:

• Camera-captured photos (compressed and stored in Firebase Storage);
• Text content, including PSA descriptions (maximum 36 characters) and user request text;
• Location metadata (stored as a geohash, not as raw GPS coordinates);
• Timestamps associated with your submissions and resolutions.

The App does not access your device's photo library. All photo submissions must be captured in real time using your device camera.

1.5 Activity and Gamification Data

We store in-app activity and engagement data, including:

• Points balance and a full transaction ledger (recording every point gain or deduction, with reason and timestamp);
• User tier (status level) and tier change history;
• Streak data (current streak, longest streak, last daily task resolution date);
• Count of submitted content flagged by other users (for moderation purposes).

This data has no monetary value and is used solely to operate the gamification features of the App. See Section 8 of our Terms and Conditions.

1.6 Analytics and Diagnostic Data

We collect the following for app performance and stability purposes:

• Firebase Analytics: We record anonymised in-app events — specifically app_open, sign_up, login, task_resolved, and psa_uploaded. No personally identifiable information is included in event parameters.
• Firebase Crashlytics: If the App crashes, we collect a crash report including your Firebase user ID (a randomly generated identifier, not your email or name), device model, OS version, app version, and technical breadcrumb logs indicating where in the App the crash occurred. This data is used solely to diagnose and fix stability issues.

2. Camera and Photos

Rify only permits photo uploads captured directly via your device camera in real time. The App does not access, scan, or upload images from your personal photo library.

Photos you submit are compressed, stored in Firebase Storage (operated by Google LLC), and associated with your content submissions. Photos submitted in response to a user request are visible to the user who posted that request.

3. Location Data

Precise GPS location is required for the core features of the App, including displaying nearby content, computing your push notification zones, and attaching location metadata to content you submit.

You can choose to use the App without granting location permission, but core location-based features will not be available.

We do not collect background location (location while the App is not in use). Location is only accessed when you are actively using the App.

We do not sell or rent your location data to any third party.

4. Push Notifications

The App uses Firebase Cloud Messaging (FCM) (a service provided by Google LLC) to send push notifications to your device. To enable this, your device's FCM token is stored in your account record in our database.

Your device subscribes to location-based notification topics derived from your approximate geohash location (a grid reference, not your exact coordinates). These subscriptions are stored on your device only and are used solely to determine which nearby-activity notifications are relevant to you.

You will be asked to grant notification permission when you first open the App. You can withdraw this permission at any time in two ways:

• In-app: Go to Settings → App Settings within Rify and toggle off "Push Notifications". This immediately unsubscribes your device and removes your FCM token from our database.
• Device Settings: Adjust the notification permission for Rify in your device's Settings app under Notifications.

Withdrawing permission does not affect your ability to use the App.

Push notifications sent to your device may include the address and subject of nearby user requests or PSAs. Your precise location is never disclosed in notifications sent to other users.

5. How We Use Your Information

5.1 Operating the App

We use your information to:

• Create and manage your account;
• Provide location-based content, features, and functionality;
• Display user-generated content and facilitate information exchanges between users;
• Operate the points, tiers, and gamification system;
• Deliver push notifications about nearby activity and responses to your requests;
• Ensure safety and prevent misuse, fraud, and abuse;
• Moderate content and enforce our Terms and Conditions.

5.2 Age Verification

Your date of birth is collected at sign-up for the sole purpose of confirming you meet the minimum age requirement for your jurisdiction. It is stored securely and is not used for advertising, profiling, or any other purpose. It is not shared with third parties except where required by law.

5.3 Advertising

The App displays advertisements via Google Mobile Ads (AdMob) (Google LLC). All ads are non-personalised and are not targeted using your personal data or browsing behaviour. Contextual information such as device type and general app context may be used by AdMob to serve relevant non-personalised ads.

Rify does not enable cross-app or cross-website tracking for advertising purposes. No advertising identifiers are shared with advertisers in connection with your identity or behaviour.

Apple's App Tracking Transparency (ATT) consent is not requested because we do not track you across apps or websites owned by other companies.

5.4 Analytics and Crash Reporting

We use Firebase Analytics to understand how users engage with the App at an aggregate level, in order to improve features and performance. We use Firebase Crashlytics to identify and fix technical issues. Neither service is used for advertising or to profile you as an individual.

5.5 Communications

We do not send marketing emails. We may send transactional communications relating to your account (such as email verification or password reset) via Firebase Authentication.

5.6 Legal and Safety

We may use and disclose your information to comply with applicable law, respond to lawful requests from authorities, protect the safety of our users, enforce our Terms and Conditions, and protect the rights and property of Rify.

6. Legal Basis for Processing (GDPR and UK GDPR)

If you are located in the European Economic Area or the United Kingdom, the following legal bases apply to our processing of your personal data under the General Data Protection Regulation (GDPR) and UK GDPR:

7. Third-Party Service Providers

We engage third-party service providers to operate the App. These providers process your data on our behalf or as independent data controllers in accordance with their own privacy policies.

We do not sell your personal information to any third party.

8. Anonymised and Aggregated Data Sharing

Rify may share anonymised, aggregated data derived from user location and interaction activity with commercial partners, including government bodies, tourism organisations, destination marketing organisations, research institutions, and other businesses. This sharing is for purposes including research, service improvement, and community intelligence.

Such data is aggregated and de-identified before sharing. No personally identifiable information — including your name, email address, account identifier, or precise location — is included in any data shared under these arrangements. You cannot be identified from such shared data.

9. International Data Transfers

Rify's backend Cloud Functions operate in the australia-southeast1 region (Sydney, Australia). However, other Firebase services — including Firestore, Storage, Analytics, Crashlytics, and Cloud Messaging — and Google AdMob may store or process your data on servers located in the United States and other countries, in accordance with Google's data processing terms.

Searches made using the App's map search feature are transmitted to Apple's servers, which may be located outside Australia.

Where your data is transferred outside Australia, we rely on Google's and Apple's own data transfer safeguards, including standard contractual clauses where applicable. For more information, please refer to Google's Firebase data processing terms and Apple's Privacy Policy.

10. Data Storage and Security

Your data is stored using Firebase services operated by Google LLC. We implement reasonable technical and organisational measures to protect your information against unauthorised access, loss, destruction, or alteration. These measures include:

• Firebase App Check (Apple App Attest) to verify that requests originate from the genuine Rify app;
• Firebase Security Rules that restrict database and storage access to authenticated users of the correct account;
• HTTPS-encrypted data transmission between the App and our servers;
• Server-side validation of all user inputs and content submissions.

No method of transmission over the internet, and no method of electronic storage, is completely secure. We cannot guarantee absolute security of your data.

11. Data Retention

We retain your information for as long as is necessary to provide the App and comply with our legal obligations. The following periods apply:

You may request deletion of your account and associated data by using the in-app data deletion feature in the Settings tab, or by contacting us at support@rify.com.au. Once a deletion request is processed, a scheduled automated process will permanently remove your account data from our systems within a reasonable period. Certain data may be retained beyond this period where required by law or for legitimate safety or moderation purposes.

Where data has previously been shared with commercial partners in anonymised, aggregated form under the arrangements described in Section 8, such shared data is de-identified and does not constitute personal information. Individual deletion requests do not affect data that has already been shared in this form.

12. Minimum Age Requirements and Children's Privacy

12.1 Australia (Current Market)

In accordance with the Online Safety Amendment (Social Media Minimum Age) Act 2024 (Cth), which came into force on 10 December 2025, users must be 16 years of age or older to create and hold an account on Rify in Australia.

We take reasonable steps to prevent users under 16 from creating or maintaining accounts, including:

• Collecting and verifying date of birth at the point of sign-up;
• Blocking account creation server-side where the submitted date of birth indicates the user is under 16;
• Providing a mechanism for parents, guardians, or third parties to report accounts believed to belong to under-age users.

We do not knowingly collect personal information from users under 16 in Australia. If you believe a person under 16 has created an account, please contact us at support@rify.com.au.

12.2 Future Jurisdictions — Minimum Age by Country

As Rify expands globally, we apply the minimum age requirement applicable in each country or region. The table below sets out the minimum age we apply in key jurisdictions.

12.3 No Targeted Advertising to Minors

Regardless of jurisdiction, users who have not yet reached the age of majority in their country are not targeted with personalised or behavioural advertising. All advertising served within the App is non-personalised.

13. Your Rights

Your privacy rights depend on your jurisdiction. We will respond to rights requests within a reasonable timeframe. To exercise any of the rights below, contact us at support@rify.com.au.

13.1 All Users

Regardless of your location, you have the right to:

• Access: Request a summary of the personal information we hold about you;
• Correction: Request that inaccurate information be corrected;
• Deletion: Request deletion of your account and associated personal data (subject to legal and operational retention requirements);
• Withdraw notification consent: Disable push notifications at any time via Settings → App Settings within Rify, or via your device's system Settings app.

13.2 Australian Users

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), you have the right to access and correct your personal information. To lodge a complaint:

• Contact us first at support@rify.com.au. We aim to respond within 30 days.
• If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

13.3 European Economic Area and UK Users (GDPR / UK GDPR)

If you are in the EEA or UK, you have the right to:

• Access: Obtain a copy of your personal data (Art. 15);
• Rectification: Have inaccurate data corrected (Art. 16);
• Erasure: Request deletion of your personal data in certain circumstances (Art. 17);
• Restriction: Request that we restrict processing in certain circumstances (Art. 18);
• Data portability: Receive your data in a machine-readable format where processing is based on consent or contract (Art. 20);
• Object: Object to processing based on legitimate interests (Art. 21);
• Withdraw consent: Where processing is based on your consent, withdraw it at any time without affecting the lawfulness of prior processing.

You also have the right to lodge a complaint with your national data protection authority.

13.4 California Users (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know: Request information about what personal data we collect, use, and disclose;
• Delete: Request deletion of your personal data, subject to certain exceptions;
• Correct: Request correction of inaccurate personal data;
• Opt-out of sale: Rify does not sell your personal information. No opt-out is required.
• Non-discrimination: You will not be discriminated against for exercising your CCPA rights.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the App, or applicable law.

For minor or non-material changes, we will update the "Last updated" date at the top of this Policy. For material changes — those that significantly affect how we handle your personal information — we will notify you within the App and may require your express re-acceptance before you can continue using the App.

We encourage you to review this Policy periodically.

15. Governing Law & Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of the Commonwealth of Australia. For disputes arising out of or relating to this Policy, you agree to submit to the jurisdiction of Australian courts, to the extent permitted by applicable local law in your jurisdiction.

16. Contact Us

If you have questions, concerns, or complaints regarding this Privacy Policy — including any matter relating to age verification, the handling of your date of birth, or the exercise of your privacy rights — contact us at:

Email: support@rify.com.au