Privacy Policy

Effective date: 3 April 2026  ·  OZ Qubit Labs PTY LTD

Droppy ("we", "us", or "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights under the Australian Privacy Act 1988.

1. Data we collect

• Account data: Email address and hashed password when you register
• Delivery data: Recipient addresses and tracking numbers you enter or import
• Logbook data: Trip dates, odometer readings, distance, and trip purpose
• Fuel data: Fill-up dates, fuel amounts, costs, and odometer readings
• Location data: GPS coordinates used for route navigation and logbook tracking
• Device data: Device type and OS version for compatibility purposes

2. How we use your data

• Optimising your delivery routes using AI (address data sent to Anthropic Claude API)
• Displaying maps and navigation via Google Maps Platform
• Storing your logbook and fuel records securely
• Sending transactional emails (verification, password reset) via Supabase
• Sharing your live location with your courier company only when you actively start a route and have consented

3. Third-party services

• Supabase — authentication and database (data stored in Sydney, Australia)
• Google Maps Platform — map display, route directions, distance calculations
• Google ML Kit — on-device OCR for parcel scanning (no data leaves your device)
• Anthropic Claude API — AI route optimisation (delivery addresses sent, no personal names)
• RevenueCat — subscription management (no payment card details stored by Droppy)
• OpenStreetMap Overpass API — traffic light data (only GPS coordinates sent, no personal data)

4. Data storage and security

Your logbook and fuel records are stored locally on your device by default and never uploaded unless you enable cloud backup. Account and route data is stored on Supabase servers located in Sydney, Australia (AWS ap-southeast-2). All data is encrypted in transit using TLS 1.2 or higher. Courier API keys are stored in your device's secure keychain and never transmitted to our servers.

5. Location data

Droppy requests location permission to provide turn-by-turn navigation and to log trip distances in the vehicle logbook. Location is only shared with your courier company when you explicitly tap "Start Route" and have enabled location sharing in settings. Location sharing stops automatically when the route is completed. We do not store historical location data — only the current location is held temporarily in memory (maximum 2 hours) and deleted when the route ends.

6. Data retention

We retain your account data for as long as your account is active. Delivery route data is retained for 12 months. You can delete your account and all associated data at any time from Settings → Account → Delete Account within the app.

7. Your rights

Under the Australian Privacy Act 1988 you have the right to access, correct, and request deletion of your personal data. To exercise these rights, contact us at privacy@droppy.com.au.

8. Children

Droppy is not intended for users under 18 years of age. We do not knowingly collect data from minors.

9. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or an in-app notification. The effective date at the top of this page indicates when the policy was last updated.

---