Privacy Policy

DRAFT — not legal advice, not reviewed by a lawyer, requires sign-off before use.

This document was drafted by an AI compliance agent on 28 September 2026. It has not been reviewed by a licensed Australian legal practitioner and has not been approved by the product owner. It is not published, not binding, and must not be shown to real users in this state. Every square-bracketed placeholder must be filled and the whole document reviewed and signed off — ideally by an Australian lawyer, not only by the product owner — before it goes anywhere near production.

Specific warning for this document: it describes security and retention practices that are design intentions from the build brief, not verified implementations. This repo's securityModel.md is still an empty template. Nothing in sections 11 and 12 may be published until each claim has been checked against what the code and infrastructure actually do. Publishing an unearned security claim is both a consumer-law and a privacy problem.

Effective date: [TO BE SET ON SIGN-OFF] Last updated: 28 September 2026 (draft)

The short version

Auspensify is a record-keeping and calculation tool for your own tax records. To do that job it needs some information about you. Three things it will never ask you for:

• Your Tax File Number (TFN). Not yours, not anyone else's, not ever, not anywhere.
• Your bank BSB or account number.
• Your place of birth.

Those fields do not exist in Auspensify. They are not hidden, not optional, not "collected later" — they are absent from every form, every screen and every part of the underlying data model. If any screen or email ever asks you for one of them, it is not us: treat it as a phishing attempt and report it to [PRIVACY CONTACT EMAIL].

Your financial and account information is treated as Australian-resident data. You choose where your receipts and documents are stored, and if you choose somewhere other than our Australian vault, we tell you plainly what you are giving up.

The rest of this policy is the detail.

1. Who we are, and what this policy covers

This policy is issued by [LEGAL ENTITY NAME] (ABN [ABN]) trading as Auspensify ("Auspensify", "we", "us", "our"), of [REGISTERED ADDRESS].

It explains how we handle personal information — information or an opinion about an identified individual, or an individual who is reasonably identifiable, as defined in s 6(1) of the Privacy Act 1988 (Cth). It covers the Auspensify web dashboard, the Auspensify mobile app, and our supporting systems.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs) in Schedule 1 to that Act. This policy is our APP privacy policy for the purposes of APP 1.3, and it is structured to follow the APPs so you can see how each one is addressed.

[Drafting note — see the internal notes at the end. Whether Auspensify is currently an "APP entity" or falls within the small business operator exemption in s 6D of the Privacy Act needs a legal call. Our position is to comply with the APPs in full regardless, and this policy is written on that basis.]

2. APP 1 — Open and transparent management of your personal information

APP 1 requires us to manage personal information openly and transparently, to take reasonable steps to implement practices and systems that ensure we comply with the APPs, and to have a clearly expressed, up-to-date privacy policy that we make available free of charge.

This policy is available without charge from within the Auspensify app (Settings → About and legal) and at [PUBLIC POLICY URL]. You do not need an account to read it.

Practices we have built in, rather than promised:

• Privacy by omission. The three prohibited fields in "The short version" above are enforced by their absence from our data model and API contract, not by a policy someone has to remember. An internal audit of our API contract on 28 September 2026 confirmed zero occurrences of TFN, BSB, bank account number or place-of-birth fields across every schema, parameter and example.
• Minimum collection. We ask for the smallest set of facts that lets us produce a tax estimate. Date of birth, occupation and home address are deliberately not collected.
• Server-side calculation. Your tax estimate is calculated on our servers, not in your browser, so your figures are not exposed to client-side code or extensions more than necessary.

Automated decision-making

Auspensify performs an automated calculation — it applies published ATO rates to figures you have entered and shows you the result as an estimate. It does not make automated decisions about you: it does not assess you, score you, profile you, approve or refuse you anything, or determine any right, entitlement or obligation. Only the ATO can assess your tax.

From 10 December 2026, amendments made by the Privacy and Other Legislation Amendment Act 2024 (Cth) require an APP entity's privacy policy to include information about computer programs used to make decisions that could reasonably be expected to significantly affect an individual's rights or interests — specifically, the kinds of personal information used and the kinds of decisions made. Our position is that Auspensify's estimate is not such a decision. This position must be confirmed by a lawyer before that date, which is roughly ten weeks after this draft was written.

3. APP 2 — Anonymity and pseudonymity

APP 2 requires us to give you the option of not identifying yourself, or of using a pseudonym, where that is lawful and practicable.

It is not practicable for Auspensify. The service is a personal record-keeping account tied to your own tax circumstances: we need to be able to authenticate you and return your records, and only yours, which requires an identified account. You can, however:

• read this policy, our Terms and our Disclaimer without identifying yourself;
• contact us with a general privacy enquiry without giving your name, though we may not be able to answer an account-specific question if we cannot verify who you are;
• choose a display name for your account that is not your legal name, provided we can still reach you at a verified email address.

4. APP 3 and APP 5 — What we collect, and telling you about it

APP 3 permits us to collect personal information only where it is reasonably necessary for our functions or activities, and requires that we collect it by lawful and fair means and, where practicable, only from you. APP 5 requires us to notify you of certain matters at or before the time we collect it. We do that through the in-app microcopy on each form, plus this policy.

Everything below is collected directly from you, except where noted. We do not buy personal information, we do not scrape it, and in this version of the product we do not receive it from bank feeds or data aggregators.

4.1 Account and authentication information

Email verification is mandatory before you can use the app. That is a security control, not a marketing device.

4.2 Tax profile information (person-wide facts that drive your estimate)

These are the only person-wide facts we collect, and each one exists because a published ATO rate or threshold depends on it:

• Tax residency status — resident, foreign resident, or working holiday maker. We do not ask for your visa subclass, passport details, country of citizenship or immigration history.
• Medicare levy entitlement (yes/no).
• Private hospital cover (yes/no) — relevant to the Medicare levy surcharge.
• Single or family status, and if family, your spouse's taxable income as a single figure you type in. This is a static number. It is not a link to another person's account, we do not contact your spouse, and Auspensify has no shared or joint accounts of any kind.
• Number of dependent children — a count only. No names, no dates of birth, no other details about your children.
• Whether you have a HELP/HECS debt (yes/no) — not the balance, not your student identifier, not your institution.

Note on health-related fields. Medicare entitlement and private hospital cover are collected solely because the Medicare levy and Medicare levy surcharge depend on them. We do not ask about your health, any condition, any treatment, or any health service you have received, and we do not ask which insurer or policy you hold. [Drafting note: whether these two yes/no flags amount to "health information" and therefore "sensitive information" under ss 6FA and 6(1) of the Privacy Act — which would engage the higher consent standard in APP 3.3 — is a genuine legal question that needs a lawyer's answer. This draft treats them conservatively: collected with your express consent at the point of collection, used only for the estimate, and never disclosed for any other purpose.]

4.3 Bucket information

A bucket is a ledger for one income source. Per bucket we collect: the label you choose, the icon and colour you choose, the income character (employment, rental, sole trader, investment or other), whether PAYG was withheld and optionally how much, and — only for a business or sole-trader bucket — whether that bucket is registered for GST and optionally its ABN. An ABN is public information you choose to record; it is optional.

Optionally, and only if you choose to record them: franking credits, net capital gain, and for a rental bucket a property label, acquisition date, acquisition amount and depreciation. These are figures you enter and we store. We do not calculate, verify or adjust them — the app labels them "recorded, not calculated". Rental buckets in this version assume a single owner, so we collect no information about any co-owner.

4.4 Transaction and document information

• Transactions you enter through the year: amount, date, description, the bucket it belongs to, whether an expense is deductible, and a category from our preset list. We do not ask you to enter a single annual total — totals are derived from your entries.
• Receipts and documents you attach: the file itself (PDF, JPG or PNG) and its metadata. Whatever is in the file is in the file — a receipt may show a merchant, a location, a time. We store the document; in this version we do not read, parse or extract fields from it (there is no OCR), and we do not analyse its contents.

Where these records are stored depends on the storage destination you choose. See section 10.

4.5 Technical and usage information

When you use the app we collect information generated by that use: IP address, browser and device type, pages and features used, timestamps, and error and diagnostic data. See section 8 for how analytics and error monitoring work, and what we exclude from them.

4.6 Correspondence

If you contact support, we keep your message and our reply.

4.7 Unsolicited information (APP 4)

If we receive personal information we did not ask for and could not have collected under APP 3, we will destroy or de-identify it as soon as practicable, if it is lawful and reasonable to do so. In practice the likeliest example is extra detail in a document you upload or a support message; we do not go looking for it, and we do not use it.

5. APP 9 — Government related identifiers, and why there is no TFN anywhere

APP 9 restricts an organisation from adopting, using or disclosing a government related identifier of an individual. A Tax File Number is a government related identifier, and TFN handling is separately and more strictly regulated by the TFN provisions of the Privacy Act and the Privacy (Tax File Number) Rule 2015.

Auspensify's answer to all of that is the simplest one available: we do not collect TFNs at all. Not yours, and not any third party's. There is no field for one, no import path for one and no place to store one. The same applies to bank BSB and account numbers, and to place of birth.

We do not adopt any government related identifier as our own identifier for you. Your Auspensify account is identified by an internal identifier we generate and by your email address. An ABN, where you choose to record one, is publicly registered business information attached to a bucket, not an identifier we use to identify you as an individual.

6. APP 6 — How we use and disclose your information

We use your personal information to:

• create, authenticate and secure your account, including mandatory email verification;
• provide the service: store your buckets, transactions and documents, and produce your tax estimates from published ATO rates;
• respond to your support requests;
• send you service communications you cannot reasonably opt out of, such as email verification, password resets, security notices and material changes to these documents;
• keep the service working and safe — diagnose faults, investigate abuse, prevent fraud, and maintain backups;
• comply with our legal obligations.

We do not sell your personal information. We do not trade it, rent it, or make it available to data brokers. We do not use your financial figures, tax estimates, transactions or documents for advertising, and we do not use them to train machine-learning models.

We disclose personal information only:

• to service providers who help us run Auspensify, and only what each one needs — cloud hosting and storage, transactional email delivery, product analytics, and error monitoring. Each is bound to use the information only to provide its service to us. See sections 8 and 9;
• to the storage destination you choose for your documents, if you choose one other than our Australian vault — see section 10;
• to your identity provider, Google or Apple, if you choose single sign-on, to the extent needed to authenticate you;
• where you ask us to, or where you have otherwise consented;
• where required or authorised by law, including in response to a valid subpoena, court order, or statutory notice — for example from the ATO or a law enforcement agency. We will require any such demand to be lawful and properly issued, disclose only what it actually compels, and tell you about it unless we are prohibited from doing so;
• where a permitted general situation applies under s 16A of the Privacy Act, such as a serious threat to life, health or safety;
• to a purchaser, in a business sale or restructure, subject to that party being bound to handle your information consistently with this policy. We would notify you before any such transfer took effect.

APP 7 — Direct marketing

We may send you occasional emails about Auspensify features and updates. Every one will identify us and carry a working unsubscribe, consistent with APP 7 and the Spam Act 2003 (Cth). You can opt out at any time and we will action it promptly. Opting out will not stop service and security emails, which are not marketing.

We will never target marketing at you based on your financial figures, your tax estimate, your transactions, or the contents of your documents — and we do not disclose your information to anyone else for their own marketing.

7. What we do not do, stated plainly

Because a privacy policy that only lists permissions is not much use:

• We never ask for your TFN, bank BSB or account number, or place of birth.
• We do not connect to your bank. In this version there is no bank feed, no open-banking connection and no Consumer Data Right accreditation, because that functionality does not exist in the product yet.
• We do not read the contents of your receipts. No OCR, no content analysis.
• We do not sell or trade your information.
• We do not use your financial or tax data for advertising or model training.
• We do not have shared, joint, household or accountant-delegated accounts, so no other person can be given access to your records through Auspensify.
• We do not store your access or refresh tokens in your browser's local storage.

8. Analytics and error monitoring — and the honest current state

We are preparing two third-party tools:

• Google Analytics 4 (GA4) — aggregate product analytics, so we can see which features are used and where people get stuck.
• Sentry — error and crash monitoring, so we can find and fix faults.

Current status, stated honestly: neither is live. Both SDKs are wired into the application against placeholder credentials, as an internal engineering decision recorded on 28 September 2026, so that they are ready before launch rather than retrofitted afterwards. With placeholder values they are inert: no data is being sent to any GA4 property or Sentry project today. This section describes what will happen when they are switched on, and this policy will be updated with the go-live date before that happens.

When they are live:

• What they will collect. GA4: anonymised, aggregated usage events — which screens and features are used, in what order, on what kind of device, plus an analytics identifier stored in a cookie. Sentry: technical error and diagnostic data — error type and message, stack trace, the route it happened on, browser and device information, and a trail of the preceding technical events.
• What they will not collect, as a hard rule. We require both tools to be configured to strip out, before anything leaves the application: any money amount, any tax figure or Tax position value, and any authentication material (passwords, tokens, cookies, session identifiers). Transaction amounts, estimate figures, document contents and credentials are not to appear in any analytics event, error payload or diagnostic trail. This is a build requirement carried from our security rules, not a preference.
• What we use them for. Improving and fixing the product. Not advertising. We do not enable Google advertising features, ad personalisation or audience sharing on our GA4 configuration.

Cookies and similar technologies. We use cookies that are strictly necessary to run the service — principally a secure, httpOnly session cookie that keeps you signed in, which cannot be read by JavaScript in your browser. When analytics goes live it will set an additional analytics cookie. You can block or delete cookies in your browser settings; blocking the strictly necessary ones will stop you being able to sign in. You can also opt out of Google Analytics across all sites using Google's own browser add-on, and many browsers offer tracker-blocking that will stop our analytics from loading.

[Drafting note: a separate cookie notice and a consent mechanism were not in scope for this draft. Australia has no dedicated cookie-consent statute, but analytics cookies can involve personal information and therefore the APPs. Before GA4 goes live, get advice on whether a consent banner or an in-app analytics opt-out toggle is needed, and add a cookie table with names, purposes and lifetimes. Also confirm the final GA4 data-retention and IP-handling settings, and whether Google Consent Mode is required.]

9. APP 8 — Overseas disclosure

APP 8 requires us to take reasonable steps, before disclosing personal information to an overseas recipient, to ensure that recipient does not breach the APPs. Under s 16C of the Privacy Act we generally remain accountable for an overseas recipient's acts and practices, as if we had done them ourselves.

Your financial records, tax profile and authentication data are held in Australia and are not routinely disclosed overseas. But some of our supporting services are operated by overseas companies, and we would rather name them than hide behind "service providers may be located overseas":

The reasonable steps we take include contracting with each provider on terms requiring APP-consistent handling, limiting what each receives to what it needs, and requiring the scrubbing described in section 8.

Where you choose an overseas storage destination, the position is different, and we want you to understand it before you choose: by selecting Google Drive, Dropbox or local download you are directing us to send your documents to a service you control, under your own agreement with that provider, and you have accepted the liability waiver described in section 10. That is a disclosure you have expressly authorised and directed, and once your documents are in that destination they are governed by that provider's terms and privacy policy, not ours.

[Drafting note: this table must be re-verified against the actual vendor list, sub-processor lists and contracts before publication, and kept current. Get advice on whether each overseas disclosure relies on APP 8.2(a) (substantially similar law with accessible enforcement mechanisms) or APP 8.2(b) (informed consent) or on reasonable steps under APP 8.1 — the analysis differs per vendor and drives whether s 16C accountability is displaced. Also confirm the hosting region and every sub-processor of the AU vault, and whether any backup, CDN, email-delivery or support tool sits outside Australia. The APP 8 guidance chapter could not be retrieved during this drafting session and the statements here are from the statute rather than the OAIC's guidance — check them.]

10. Data residency, your storage choice, and the liability waiver

The default: our Australian vault

By default, your receipts and documents are stored in the Auspensify AU vault — storage we operate, treated as Australian-resident, alongside your financial and account data. This is deliberate: we do not use non-Australian authentication services for your account, and we treat your financial and auth data as AU-resident as a standing rule.

On the default option, we commit to retaining your documents for five years, which lines up with the general five-year record-retention expectation in Australian tax law (see Income Tax Assessment Act 1936 (Cth) s 262A and current ATO guidance).

Your alternatives, and exactly what changes

You may instead choose to have your documents stored in your own Google Drive, your own Dropbox, or downloaded locally to your own device. If you pick any of these, we show you a waiver you must accept before the choice takes effect, and we record your destination and the time you consented.

Accepting that waiver means, plainly:

• You take responsibility for the security of those documents. Once a document goes to your Drive, your Dropbox or your device, its security is a matter between you and that provider, or you and your device. We cannot protect what we do not hold.
• We are not responsible for what happens to it there — including loss, deletion, unauthorised access, a breach of that provider, or a device you lose. To the extent the law allows, you release us from liability for it.
• The five-year retention commitment is waived. We do not guarantee those documents will still exist, and we cannot get them back for you if they are gone.
• Export packs link out instead of bundling files, because we no longer hold the files.
• Thumbnails become generic icons, for the same reason.
• For local download, shareable links are disabled.

You can change destination later in Settings. Changing it affects documents from that point forward; it does not retrieve documents already sent elsewhere, and it does not restore the retention commitment over them.

This is your choice to make, and it is a legitimate one — some people would rather hold their own records. We just will not pretend the consequences do not exist.

11. APP 11 — Security of your personal information

[Drafting note — READ BEFORE PUBLISHING. Every claim in this section is taken from the build brief's security requirements and is a design intention, not a verified fact. This repo's securityModel.md is an empty template as at 28 September 2026, and the application is not yet built or deployed. Each bullet must be individually confirmed against the implemented system, and anything not actually implemented must be deleted, before this section is published. An overstated security claim here is both a privacy breach risk and potentially misleading conduct under s 18 of the Australian Consumer Law.]

APP 11 requires us to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The measures we are building are:

• Encryption in transit for all traffic between your browser and our servers.
• Encryption at rest for stored financial data and documents in the AU vault.
• Password storage as salted cryptographic hashes only — we cannot read your password.
• Mandatory email verification before an account can be used.
• Session tokens held in httpOnly, Secure, SameSite cookies, handled server-side. Your authentication tokens are never placed in your browser's local storage, where malicious scripts or browser extensions could reach them.
• Strict access scoping. Every request for your data is checked against your ownership of it. There are no shared accounts, no delegated access and no organisation or team concept, so no other user can be granted a path to your records.
• A rule against logging sensitive values. Passwords, tokens and financial figures are not to be written to production logs, analytics or error reports.
• Security headers on the application, including a content security policy, HTTPS enforcement, and a prohibition on the app being embedded in another site's frame.
• Least-privilege internal access. Staff access to production data is limited to those who need it for support or operations, and is logged.

What we do not yet have: two-factor authentication. It is planned and appears in Settings as a disabled "coming soon" row. Until it ships, your password and your email account are the front door, so please use a strong, unique password and keep your email account secure.

No system is perfectly secure, and we do not claim otherwise.

If something goes wrong: the Notifiable Data Breaches scheme

Part IIIC of the Privacy Act establishes the Notifiable Data Breaches scheme. If we suspect an eligible data breach — unauthorised access to, unauthorised disclosure of, or loss of personal information we hold that is likely to result in serious harm — we will:

1. Contain it and assess it. We will take all reasonable steps to complete that assessment within 30 calendar days of becoming aware of the grounds for suspicion, as required by s 26WH(2), and we treat 30 days as a maximum rather than a target.
2. If it is an eligible data breach, notify you and give a statement to the Australian Information Commissioner as soon as practicable, as required by s 26WK. The statement sets out our identity and contact details, a description of the breach, the kinds of information involved, and what we recommend you do in response.
3. Tell you what we are doing about it, in plain English.

We will not delay telling you in order to manage our own reputation.

12. APP 10 — Quality of your information, and APP 11.2 — retention and destruction

Quality (APP 10). We take reasonable steps to keep your personal information accurate, up-to-date and complete — but the substance of your records is what you enter. We do not verify your figures against your bank, your payslips or the ATO, and we do not correct them. If your entries are wrong, your estimate will be wrong. You can edit or delete any transaction, bucket or profile field at any time.

Retention (APP 11.2). We keep your information only while we need it, or while the law requires us to keep it:

• Your account, buckets, transactions and profile: for as long as your account is open.
• Documents in the AU vault: for five years, consistent with the record-retention commitment in section 10.
• Documents at a destination you chose: not held by us at all, and subject to no retention commitment.
• After you close your account: we delete or de-identify your personal information within [RETENTION PERIOD — e.g. 30 days] of your deletion request, except where we are required or permitted by law to keep it longer, and except for backups, which age out on our normal backup cycle of [BACKUP CYCLE]. Some limited records — such as proof that an account existed and was closed — may be retained for legal and audit reasons.

Before you close your account, export your records. Once deletion is done we cannot get them back.

[Drafting note: the retention period, backup cycle and post-closure deletion process must be confirmed against the actual implementation, and the tension between APP 11.2's destroy-when-no-longer-needed obligation and the five-year retention commitment needs a lawyer's eye. Retention that is legally required is fine; retention that is merely a product promise is a harder APP 11.2 argument.]

13. APP 12 and APP 13 — Access to, and correction of, your information

Access (APP 12). You can see most of your personal information yourself, any time, by signing in — your profile, your buckets, your transactions and your documents are all visible and editable in the app. For anything else we hold about you, ask us at [PRIVACY CONTACT EMAIL]. We will verify who you are, then respond within a reasonable period, and we aim for 30 days. Access is free; if we need to do something substantial to compile it we may charge a reasonable cost-based fee, and we will tell you what it is before we do the work. If we refuse access — which we may only do on the grounds APP 12.3 allows — we will tell you in writing why, and how to complain.

Correction (APP 13). If information we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading, you can correct most of it directly in the app, or ask us to correct it. We will take reasonable steps to do so, free of charge. If we refuse, we will explain why in writing, and you can ask us to note your correction request alongside the information.

A note on what we can and cannot correct. We can correct your personal information. We cannot change a tax estimate other than by correcting the figures it was produced from, because the estimate is arithmetic on your data, and we cannot change an ATO assessment — that is between you and the ATO, with help from a registered tax agent.

14. Children

Auspensify is intended for adults. You must be at least [18] years old to hold an account (see the Terms of Service). We do not knowingly collect personal information from children. If you believe a child has created an account, contact us at [PRIVACY CONTACT EMAIL] and we will delete it.

[Drafting note: the minimum age needs a decision. 18 aligns with contractual capacity and is the cleanest position, but people under 18 do earn taxable income and may legitimately want to keep records. Note also that the Privacy and Other Legislation Amendment Act 2024 requires the OAIC to develop a Children's Online Privacy Code; confirm its status and whether it applies to this service before launch.]

15. Complaints

If you think we have mishandled your personal information or breached the APPs:

1. Tell us first. Email [PRIVACY CONTACT EMAIL] with what happened. We will acknowledge you within [5] business days, investigate, and give you a written response within 30 days. If we need longer we will tell you why and when to expect an answer.
2. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au/privacy/privacy-complaints, 1300 363 992, or GPO Box 5218, Sydney NSW 2001. The OAIC generally expects you to raise the matter with us first.

Complaining costs you nothing and we will not treat you differently for doing it.

16. Changes to this policy

We will update this policy as the product changes — and this product is early, so it will change. The "Last updated" date at the top always reflects the current version. For any change that materially affects how we handle your personal information, we will tell you in the app or by email before it takes effect, not after. Specific changes already anticipated: switching GA4 and Sentry on, and enabling real Google Drive and Dropbox connections.

17. Contact us

Privacy enquiries, access requests, corrections and complaints: [PRIVACY CONTACT EMAIL]

[LEGAL ENTITY NAME] (ABN [ABN]) trading as Auspensify [REGISTERED ADDRESS]

Related documents: Terms of Service · Disclaimer