Privacy policy

1. The short version

• We never sell, rent or trade your personal information, and we never share it with advertisers or data brokers.
• There are no advertising or tracking tools in Chaana. We do not use third-party analytics, ad networks or cross-app tracking.
• We collect what you give us to run your account and listings, and a small amount of usage data to show posters how their listings are doing.
• A few service providers help us run Chaana (for example our database host and Stripe for card payments). They may only use your information to provide their service to us. They are listed in section 6.
• Your name and suburb are shown with what you post. Your phone number is never printed on a listing, but it sits behind the Call, Message and WhatsApp buttons.
• You can delete your account at any time, in the app or on the website. It happens straight away.

2. Who we are and what this policy covers

This policy explains how Roshan Uchai, a sole trader trading as Chaana, of Sydney, New South Wales ("Chaana", "we", "us"), collects, holds, uses, discloses and protects personal information when you use the Chaana app, the website at chaana.com.au and the member dashboard.

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Even where the Privacy Act might not strictly apply to a small business like ours, we choose to follow the APPs, and this policy is our promise to you.

"Personal information" means information or an opinion about you, where you are identified or reasonably identifiable.

3. What we collect

When you sign up and fill in your profile

• First, middle and last name, and email address.
• Password. It is stored by our sign-in provider only in a scrambled (hashed) form, and we cannot read it.
• Suburb, postcode and state.
• On website sign-up: whether you are in Australia or still in Nepal, your expected arrival date, a contact phone number, and your account type (member, parent or business owner).
• Optional: phone number, visa type and a profile photo. Visa type is optional; you choose whether to add it and whether to show it on your "looking for work" posts.

When you post

• Rooms: photos, the street address and suburb, price, features, house rules and description. A room's street address is shown to signed-in members.
• "Looking for a room" and "looking for work" posts: what you are looking for, budget, preferred suburbs, your suburb, and for work, roles, skills, certifications, languages and (if you add it) visa status.
• Job ads: company, address, pay, hours and description.
• Businesses: name, category, photos, address (street address hidden by default, with an approximate map pin), phone, WhatsApp, email, website, social links, opening hours, tags, menu or catalog, specials and, if you add it, the ABN for our manual check.
• Events: title, date, venue, price, description, photos, booking link and, on the website, an organiser name and phone.
• Saath posts, comments and reactions, business reviews, and business claims (the reason you give and an optional phone number).

When you use Chaana

• Contacts: when you tap Call, Message or WhatsApp on a room or job, we record that you contacted that listing, so the poster can see who contacted them (your name and how many times). We never see what you say. For every listing type we also count, per day, that someone contacted it and by which method, so the owner sees totals (never who).
• Appointments: viewing and interview times you arrange in My Appointments.
• Favourites, follows, checklist ticks and notification settings.
• Reports you make, reports about your content or account, and any moderation decisions, warnings, pauses or blocks.
• Listing statistics: when you are signed in to the app, we record which listing cards were on your screen (at least half visible for at least one second, with the app open), which listings you opened and how you got there (for example from a list, a notification or your saved items), and which you contacted, saved or shared. We store this against a scrambled code made from your account (never your name or user id), so owners only ever see counts of people, never who. We use it to show owners how many real people their listing reached, to stop the same person being counted twice or the same listing being shown to you over and over, and to make sure every listing, free or paid, gets seen fairly.
• Push notifications: if you allow them, your device's push token, so we can send you notifications. It is removed when you sign out.
• Terms acceptance: which version of our terms and this policy you accepted, when, and where (sign-up, app, website, business upgrade or checkout), with a one-way scrambled fingerprint of your IP address, never the address itself.
• Technical data that our hosting and sign-in providers log automatically for security, such as IP address, device and browser type, and sign-in times.
• Website visits: our website sets one small first-party cookie (`chaana_vid`) so a visit to a listing is counted at most once per day. We combine it with a scrambled fingerprint of your IP address (never the address itself). Website visits are shown to owners only as an estimate and are never used to order listings. The website does not use advertising or third-party tracking cookies.

Location. If you allow it, the app uses your phone's location to show "your location" on the business map and to sort nearby results. Your location is used on your phone only. It is not sent to or stored on our servers, and it is never shown to other members. You can turn location off in your phone's settings at any time.

Payments. Stripe collects your card details directly. We receive only a payment reference, the amount, the date, what you bought and whether it succeeded or was refunded. We never see or store your full card number.

App PIN. If you set an app lock PIN, it is stored as a scrambled (salted hash) value on your phone only and is never sent to us.

What we do not collect. We do not ask for your passport, visa grant number, tax file number, bank account details, date of birth, religion, caste or health information. Please do not put these in your listings or posts.

4. How we collect it

We collect personal information directly from you, when you sign up, fill in your profile, post, or use Chaana. Sometimes we receive information about you from other people, for example when another member reports your content, names you in a post, or claims a business you listed. We will not collect personal information by unlawful or unfair means.

You can browse the public business directory without an account. To post and use members-only features we need your real name, because Chaana is built on members knowing who they are dealing with.

If you do not give us the information we ask for, you may not be able to create an account or use some features.

5. How we use it

We use your personal information only for the reasons we collected it, or related reasons you would reasonably expect:

• to create and run your account and keep you signed in;
• to show your listings, posts and reviews to other members, and business listings to the public;
• to let people contact you through the buttons on your listings;
• to show listings near your suburb and state;
• to send notifications you have not switched off, and service messages about your account (such as sign-up confirmation, password reset and changes to our terms);
• to show posters and business owners their views, contacts and other statistics;
• to keep Chaana safe: safety warnings, posting limits, reviewing reports, and warning, pausing or blocking accounts;
• to check a business's ABN on the public ABN Lookup, when the owner asks;
• to process Featured payments and refunds, and keep financial records;
• to answer your questions and complaints, and fix problems;
• to meet our legal obligations and respond to lawful requests.

Marketing. We do not use your information for third-party marketing. We will only send you our own promotional emails if you have agreed, and every such email will have a working unsubscribe link. You can switch notification categories on or off in the app at any time.

Automated decisions and how listings are ordered. Our software decides the order listings appear in. It uses how relevant a listing is to what you are looking at (for example your suburb and filters), how new it is, whether it has had a fair share of views, whether you have already seen it, and whether the owner paid for Featured placement. Featured listings are always labelled "Sponsored", and no more than one in every five places goes to them. This ordering does not decide anything about your rights: every listing stays findable. See "How listings are ordered" on our website. We do not use computer programs to make decisions that significantly affect your rights or interests without a person being involved. Some content is hidden automatically after several safety reports, to protect people while it waits for review, but a person reviews it before any content is removed or any warning, pause or block is given. Our software also enforces daily posting limits and Featured eligibility rules, which are set out in our terms.

6. Who we share it with

We do not sell your personal information, and we do not share it with anyone for their own marketing or advertising.

We disclose personal information only in these limited cases:

1. Service providers who run Chaana for us. They may only use it to provide their service to us, must keep it secure, and are not allowed to use it for their own purposes:

• Supabase (on Amazon Web Services): our database, sign-in, file and photo storage, sign-up and password-reset emails, and server functions;
• Stripe: card payments and refunds for Featured;
• Expo and Google Firebase Cloud Messaging (and Apple Push Notification service on iPhone): delivering push notifications;
• Vercel: hosting the website;
• OpenStreetMap Nominatim: turning an address you type into a listing into map coordinates (only the address text is sent);
• OpenFreeMap: loading map images (your device requests map tiles directly, which shares your IP address with that service).

2. Other members and the public, as you choose when you post (see section 7).

3. When the law requires or allows it, for example to the police or a regulator such as the eSafety Commissioner in response to a lawful request, or where we reasonably believe it is necessary to lessen or prevent a serious threat to someone's life, health or safety (for example content involving a child, or a threat of violence).

4. If Chaana is sold or transferred, to the new owner, who must continue to protect it in line with this policy. We will tell you before this happens.

Apple (App Store) and Google (Google Play) handle app downloads and updates under their own privacy policies.

7. What other people can see

• Business listings (not the owner's private details): anyone, on the public website and in search engines and other online tools that read public web pages.
• Your name, suburb and profile photo on your posts: signed-in members.
• Room street addresses: signed-in members.
• Your phone number: never printed, but any signed-in member who taps Call, Message or WhatsApp on your listing can reach you, and people you contact will see your number.
• Who contacted a room or job: the poster (name and count).
• Business views and contacts: the business owner, as counts only, never who.
• Reports you make: only the Chaana team. The person you report is not told who reported them.

8. Overseas storage and processing

Some of our service providers store or process information outside Australia. At the time of writing, these include the United States (Stripe, Expo, Google, Vercel and Supabase support systems) and the United Kingdom and European Union (OpenStreetMap and OpenFreeMap map services). Our providers may also use data centres in other countries.

We choose well-known providers that publish their security and privacy commitments, and we take reasonable steps to make sure they handle your information in a way that is consistent with the APPs.

9. How long we keep it

We keep personal information only for as long as we need it, then delete it or make it anonymous:

• Account and profile: until you delete your account.
• Listings: rooms stop showing after 7 to 30 days and jobs and "looking for" posts after 30 days, and are archived or removed by nightly jobs. You can delete any listing at any time.
• Contact records and appointments: deleted by nightly jobs after the listing has expired.
• Detailed listing statistics: which listing cards were shown to you, and your scrambled viewing code, are kept for 30 days; records of listings you opened or contacted for 90 days; records of what was served to you for about a day. After that only daily totals are kept, for 13 months, which do not identify anyone. Delivery summaries for Featured purchases (counts only) are kept for 18 months in case of a payment dispute.
• Broadcast notifications: deleted after 30 days.
• Payment records: kept for 5 years, in our Stripe account, because Australian tax law requires business records to be kept for 5 years.
• Moderation records (reports, warnings, pauses and blocks): for as long as we need them to keep Chaana safe and deal with disputes. For blocked accounts, the email address and phone number are kept so they cannot sign up again.
• Backups: our database provider keeps backups for a short period for disaster recovery. Deleted information disappears from backups when they are overwritten.

10. Deleting your account

• In the app: Profile, then My Details, then Delete my account.
• On the website: sign in to your dashboard at chaana.com.au, open My Details, and choose Delete my account.
• Without the app, or if you cannot sign in: email [email protected] from the email address on your account. We will confirm it is your account and delete it within 30 days, usually much sooner.

You confirm with your password, and deletion happens straight away. It cannot be undone. We delete your account, profile, businesses, rooms, jobs, events, Saath posts, comments, reactions, reviews, favourites, follows, appointments, notifications, push tokens and uploaded photos, and your listing statistics records (the viewing data stored against your scrambled code).

We keep only the limited records described in section 9 that the law requires or that we genuinely need (payment records for tax law, and the email and phone of blocked accounts). Content that another person already copied or shared outside Chaana is outside our control.

11. How we protect it

We take reasonable technical and organisational steps to protect your information from misuse, interference, loss and unauthorised access, change or disclosure, including:

• encrypted connections (HTTPS/TLS) between your device and our servers, and encryption of stored data by our database provider;
• database access rules (row-level security) so each person can read and change only what they are allowed to;
• passwords stored only as hashes, and a password check before an account can be deleted;
• an optional app PIN that stays on your device;
• limiting moderation and admin tools to a small number of authorised people, with a log of admin actions;
• keeping secret keys on our servers only, never in the app;
• payment card details handled only by Stripe, which is certified to the PCI DSS security standard.

No system is completely secure. Please use a strong, unique password and tell us straight away if you think your account has been misused.

Data breaches. If we suspect a data breach, we will act quickly to contain it and assess it. If a breach is likely to result in serious harm to you, we will tell you and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires, and tell you what you can do to protect yourself.

12. Your rights and choices

• Access: you can see most of your information in My Details. You can ask us for a copy of the personal information we hold about you by emailing us.
• Correction: you can change most details yourself in My Details. You can also ask us to correct information that is wrong, out of date or misleading.
• Deletion: see section 10.
• Notifications: switch categories on or off in the app's notification settings, or turn off notifications in your phone's settings.
• Location: turn off location access in your phone's settings. The rest of Chaana still works.

We will respond to access and correction requests within 30 days, free of charge. We will need to confirm your identity first. If we refuse a request, we will tell you why in writing (where the law allows) and how to complain.

13. Children

Chaana is for adults. You must be 18 or older to create an account. We do not knowingly collect personal information from children. If you think a child has created an account, or that content puts a child at risk, use the Report button or email us and we will act quickly.

14. Changes to this policy

We may update this policy, for example when we add features or the law changes. Each version has a version number and a date. If a change matters, we will tell you in the app or by email before it takes effect.

15. Questions and complaints

Email [email protected], or write to Roshan Uchai (Chaana), Sydney NSW. Tell us what your concern is and how we can contact you. We will acknowledge your complaint within 7 days and give you a response within 30 days.

If you are not happy with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au/privacy/privacy-complaints, phone 1300 363 992.