Privacy

What we keep

• Your account: your email address, your display name and handle, when you confirmed that you were 16 or older, and anything you add to your profile. Your password is stored only as a one-way hash, so no one can read it. We also keep when you last opened the guestbook, so the bell can count new entries; only you can see it.
• Your posts: what you did, the date, your description, any photos, whether each post is public or private, the check’s result and your points.
• Ideas you add to the community list, and whether a moderator has approved them.
• Guestbook entries: your words and the name you sign with, or Anonymous. Written without an account, a writer key too (see Guestbook below).
• Reports you make and people you block.
• When you like a post, we keep that you liked it, so you can take it back. Others see how many likes a post has, never who liked it.
• If you send feedback, we keep what you wrote, the page or screen you sent it from, and your screen size and browser, as an issue on GitHub, where the site is built, and a message to the team on Discord. Your name and email are never sent with it.
• Cookies only to keep you signed in. No advertising.
• We count page visits ourselves, with no cookies, no IP addresses and nothing that identifies you: just the page, the site or shared link (such as our QR code) that led to it, and whether it was opened on an iPhone, an Android phone or a computer.
• The services we run on keep short-lived server logs, such as IP addresses, to keep the site working.

Before you have an account

You can log an act before you make an account. In the app it is kept on your phone, and on the website it is kept in this browser, with any photos. It is not sent to us, and no one else can see it, until you sign in and choose to add it. Deleting the app, or clearing this browser’s data for the site, removes it.

Age and accounts

Accounts are for people who confirm they are 16 or older. If you’re under 16, you can take part with a parent or guardian using their account, or take part without an account. We keep the time of the confirmation; we do not ask for or store your date of birth.

Photos

Before a photo leaves your phone or computer, the website or app re-encodes it as a smaller JPEG. That removes location data and the other hidden details cameras store in a file.

Places

A post or walk can carry a place you choose, like a suburb or town.

If you tap Use my location, your phone or browser sends a rough position (about 1 km) once, so we can find the suburb. We keep only the place’s name, never the position.

Places add up on public boards, so people can see how much was picked up in each suburb, town, state and country.

To turn a rough position, or a place you search for, into a suburb or town, we ask OpenStreetMap’s Nominatim service, run by the OpenStreetMap Foundation in the UK. It never gets your name or account.

Share cards

The app can save a share card to your Photos when you ask it to.

A share card shows what your public post or walk shows. Once you post it somewhere else, that copy is outside our control.

How posts are checked

When you post, Z.ai (GLM) reads your post’s text and photos to record what they show, such as how many cans or bottles, and whether anything looks unsafe. We send it the post only, never your email address. It does not decide your points: our own code works those out from published figures (see How points work).

If the check holds a post for safety, a moderator can inspect it before deciding what happens next.

When photo checks are on, the check looks for people, children and personal details, like number plates or house numbers, before a photo post is public.

To spot the same photo posted twice, we keep a fingerprint of each photo: a short code made from the picture, not the picture itself.

Emails we send

We email you only about your account, such as a link to reset your password. Resend sends account emails for us, from no-reply@pickitupforvic.com. It receives your email address and the message, nothing else, and keeps a log of what it sent. No newsletters and no marketing.

Who can see what

Private posts aren’t visible to other community members or the community board. If the automated check holds a private post for safety, a moderator can inspect it. Public posts are visible to everyone, with your display name and handle, and a public post with a checked photo can appear on the community board. If you make a post private again, it stops being visible to other community members.

Follows

You can follow people to see their public posts under Following and in your notifications.

Nobody sees who you follow or who follows you. You see only how many people follow you.

Ideas

Ideas you add to the community list are read by a person before anyone else can see them. Approved ideas are shown without your name. You can see your own ideas while they wait.

Guestbook

Anyone can write in the guestbook, with or without an account. An entry shows your words and the name you sign with, or Anonymous, to everyone. Moderators can see which account wrote an entry; they never show it.

Without an account, we keep a writer key with your entry. A writer key is a scrambled code made from your IP address and the date. It cannot be turned back into your IP address, and it changes every day at midnight, Perth time, so one day’s key can’t be matched with another’s. We use it only to limit how many entries one connection can add in a day (three), and the same for “I picked some up today” (once a day). We never store your IP address. Without an account you can’t delete your entry yourself: email us and we’ll take it down.

Where it is kept

Your account, posts and photos are stored with Supabase in Sydney, Australia. The website runs on Vercel.

Deleting your account

Go to Settings and choose Delete my account. It removes your account, your posts, your photos and your ideas, and the guestbook entries you wrote while signed in. You can also delete a single post, or one of those guestbook entries, at any time. If you cannot sign in, use the public account deletion page to request deletion.

Contact

Questions or requests: hbruinsma@atlas-ai.au

Updated 12 October 2026.