Privacy policy
Version 1.0 · last updated 27 July 2026. What this product collects amounts to a record of where a person is vulnerable. Leaking it would do direct harm to exactly the people this project says it protects.
The short version: we hold what we need to run the app and to show whether it works, and nothing beyond that. No payment details, no precise or device location, and no advertising trackers. A self-declared state or territory and postcode are used only for aggregate ACT pilot reporting. Anything that leaves your account for reporting leaves aggregated and stripped of identity.
What we hold, why, and for how long
| Type of data | What it is used for | How long we keep it | Basis |
|---|---|---|---|
| Account email, display name, hashed password |
Signing in and resetting your password. Never used for promotional email. | Until you request deletion or the service closes. At pilot close you can choose to keep using the account; no response means deletion by 31 January 2027. Encrypted backups then expire automatically within 30 days. | Needed to sign in |
| Age check record method, time, result |
Showing a regulator or a funding body that the 18+ gate is working. | Seven years from the date of the check, including after account deletion. | Compliance record |
| Self-declared region state or territory and postcode |
Reporting how many pilot participants are ACT residents and selecting the right public support information. Raw postcodes are never supplied to a sponsor or funder. | The operational region is deleted with the account. A consented research copy is anonymised at pilot close and retained for five years. | Pilot eligibility reporting |
| Learning activity videos watched, quiz scores, tokens earned |
Paying out tokens correctly, blocking farming, measuring what people learn. | The operational record stays with the account until deletion. At pilot close, the separate consented research copy is anonymised and retained for five years. | Needed to run the app |
| Simulated bets tokens staked, selection, result, time |
Showing you your own running total lost, and comparing your results against the house edge. | The operational record stays with the account until deletion. At pilot close, the separate consented research copy is anonymised and retained for five years. | Needed to run the app |
| Your run assets sold, runs ended, cooldown weeks |
Running the simulation, and enforcing the seven-day cooldown on the server. | The operational record stays with the account until deletion. At pilot close, the separate consented research copy is anonymised and retained for five years. | Needed to run the app |
| Support taps counts only, no identity |
The public health measure: how many people actually reach a real support service. | Kept only as anonymised research counts for five years after pilot close. | Anonymised |
| Real-world betting survey (E-37) voluntary answers,
separated from identity when saved |
Measuring whether the app changes anything outside itself, for pilot reporting. What happens to it when the pilot closes. | Anonymous at save and retained in the anonymous research dataset for five years after pilot close. Because no account link is written, a saved response cannot later be identified, exported or withdrawn. | Voluntary · anonymous at save |
| Technical security and fault logs sign-in outcome,
truncated IP, device type and service error |
Protecting accounts, investigating faults and keeping the service available. These short-lived operational logs are not used to profile gambling behaviour. | 90 days, then automatically deleted. | Security and reliability |
| Privileged access audit trail which authorised staff
account opened a sensitive admin record, when and why |
Independent accountability for privileged access. This is an append-only audit dataset, not the technical security and fault log above. | 12 months, then removed by the scheduled retention job. | Access accountability |
Linked, consented baseline/endline research data can be withdrawn until pilot close; it is then anonymised and kept for five years. E-37 survey answers are different: they are anonymous as soon as they are saved. Your operational account can continue only if you actively choose that option; otherwise it is deleted by 31 January 2027 and encrypted backups expire within 30 days. The age-check compliance record remains for seven years. Read the pilot close-out plan.
What we do not collect
💳 Payment data
No card numbers, no bank accounts, no digital wallets, because there is no money transaction anywhere in the product.
📍 Location & contacts
No precise location, no address book, no calendar, and no scan of what else is installed on your device.
🎯 Advertising
No ad trackers, no data sold, no audience segments built for targeting. This one is not negotiable.
Who can see your data
Inside the project
- System administration — sees accounts and cooldown status, to keep the service running.
- Impact analysis — sees aggregated, anonymised figures only, with no way back to an individual.
- Content administration and the clinical reviewer — see no user data at all; they work with videos, questions and warning facts.
Outside the project
- Sponsors — see aggregated figures for their own campaign only. They never see one person's behaviour. That is built in, not configured.
- Funding bodies — receive aggregated reporting on a schedule.
- The odds data provider — data flows one way, into the app. No user data goes back out.
Sensitive behavioural data is encrypted or anonymised, and the real-world betting survey is always voluntary. Both are structural, not discretionary.
Your rights
📤 Export my data
Sign in and request a machine-readable export from your profile. We prepare your account, learning, token, simulated betting and run records, then notify you when the request is ready. We never put the export in an email attachment.
To download it, reauthenticate in tibbi. The secure download remains available in your profile for seven days, then expires; requesting an export changes nothing in your account.
Open profile to request an export🗑️ Delete my account
Sign in, open your profile and submit a deletion request. tibbi asks you to reauthenticate, shows exactly what will be deleted and asks for final confirmation before the request is accepted. Opening this policy never closes an account.
The active account is deleted only after identity checks, processing and approval by a second authorised account. Encrypted backup copies expire automatically within 30 days. A one-way token ledger and append-only safety-control evidence remain without identity; the seven-year age-check record and research already anonymised into group reporting also remain under their published schedules. None can be used to restore or identify the closed account.
Open profile to request account deletion✏️ Correct something that is wrong, or complain about how we handled it
If a record about you is wrong, ask us to fix it. If you think we have mishandled your data — collected something we should not have, kept it too long, or shown it to someone who should not have seen it — you can complain, and complaining has no effect on your account, your tokens or your cooldown.
Step 1 · Tell us
Write to privacy@tibbi.org.au or use the contact page. We answer a privacy request or complaint in writing within 30 days, and tell you what we did about it.
Step 2 · If that answer is not good enough
Take it to the Office of the Australian Information Commissioner — 1300 363 992, GPO Box 5218 Sydney NSW 2001, oaic.gov.au. You do not need our permission and you do not have to tell us you are doing it.
If you only need a phone number, do not create an account
The support centre is public. No sign-in or behavioural profile is required; only the short-lived security logs described above apply. You are not counted as a registered user. Someone who needs help should not have to trade account data for a phone number.