Privacy policy · Draft

Privacy for a location-aware night out.

Last updated 1 September 2026.

Operator, retention rules and role contacts selected; not yet effective. The registered street address, phone number, final vendor list and overseas processing locations must still be confirmed and reviewed before paid launch.

1. Who we are

NightRoute is operated by DREAMLAB STUDIO PTY LTD (ABN 77 673 584 426), an Australian private company with its main business location in VIC 3805, Australia. The Privacy Officer can be contacted at privacy@nightroute.com.au. Registered street address and telephone: [TO BE PUBLISHED BEFORE PAID LAUNCH]. Other business and support contacts are listed in the contact directory.

2. Information we collect

  • Account details such as email, display name and Firebase user identifier.
  • Ticket, event, group invitation, payment-status, transfer and refund information.
  • A Stripe payment or customer reference; Stripe processes card details.
  • Precise device location, reported GPS accuracy and check time when you activate, check eligibility or redeem.
  • A device identifier and App Check/security signals used to bind a ticket and detect abuse.
  • Redemption, event-progress, support and security audit records.
  • Directions requests, accessibility enquiries and communications with event runners.
  • Feedback, ratings, referral activity and any recap content you choose to submit.
  • Waitlist email address and marketing preference.
  • Technical records such as IP address, browser/app version, crash information, request time and rate-limit signals.

NightRoute does not intend to collect full card numbers. [TECHNICAL INPUT REQUIRED: verify production analytics, crash reporting, push notifications, email and cookie tools before launch.]

3. Precise location and anti-fraud checks

NightRoute uses precise location only for event actions that depend on physical presence: first-venue activation, showing redemption eligibility, final redemption validation and operational support. Location is checked both before a claim is shown and when staff completes the live control.

NightRoute’s intended launch configuration does not continuously track a guest or collect background location. Device, token, time, location accuracy and redemption records are combined to prevent duplicate claims, investigate disputes and protect venue partners. The app asks for permission in context and explains that location-dependent features will not work if permission is declined.

4. Why we use information

  • Provide accounts, tickets, route reveals, directions, group invitations, support and recaps.
  • Confirm attendance and prevent duplicate or fraudulent redemptions.
  • Process payments, transfers, refunds and customer-service requests.
  • Operate events safely and communicate urgent changes.
  • Improve reliability and understand aggregate event performance.
  • Send marketing only where permission or another lawful basis exists, with an unsubscribe option.
  • Comply with legal, safety, accounting, insurance and venue obligations.

5. How we collect it

Information comes directly from you, automatically from your device when you use relevant features, and from providers such as Firebase, Stripe, mapping services, Apple/Google platform services and email providers. Participating venues and event staff may provide check-in, redemption, safety or support information. A group purchaser may provide your email to send an invitation; NightRoute should tell you who invited you and avoid creating a full account until you accept.

6. Who may receive it

  • Google Firebase/Cloud for authentication, database and backend hosting.
  • Stripe for payment processing and fraud prevention.
  • Mapping and device-platform providers when directions or location services are requested.
  • Email, messaging, analytics, crash-reporting and customer-support providers once confirmed.
  • Participating venues and event staff only where necessary for entry, redemption, safety or incident support.
  • Professional advisers, insurers, regulators and law enforcement where required or authorised by law.

NightRoute does not sell personal information. Venue partners must not use attendee details for their own marketing unless the attendee separately agrees.

7. Overseas processing

Some technology providers may process or store information outside Australia. [LEGAL INPUT REQUIRED: identify likely countries and the safeguards used after confirming Firebase, Stripe, Expo/EAS, Apple, Google, mapping, email, analytics and support configurations.]

8. Retention and security

NightRoute uses access controls, server-authoritative redemption, device binding, App Check, one-time tokens, restricted database rules and audit records. No system is completely secure.

The launch retention schedule is:

Raw GPS eligibility attempts30 days after the event, then delete or de-identify
Successful redemption location and security record24 months after the event; longer only for an active fraud, safety or legal matter
Unaccepted group invitations30 days after the event
Account and profileWhile active, then delete or de-identify within 30 days of a valid deletion request, subject to retained transaction and safety records
Support and ordinary complaints24 months after closure
Safety, ejection and serious incident records7 years after closure, or longer while a claim is active
Payment, refund, tax and accounting recordsAt least 5 years, or longer where tax, corporate or legal rules require
Optional recap photos and feedback12 months unless the guest deletes them sooner or separately agrees to longer publication
Waitlist and marketing contactUntil unsubscribe; remove from active marketing within 10 business days and retain a minimal suppression record for 3 years

At the end of a period, NightRoute deletes the record or removes identifiers so it can no longer reasonably be linked to a person, unless a legal hold or unresolved dispute requires longer retention. The schedule will be reviewed annually and whenever the product or law changes.

9. Access, correction, deletion and marketing

You may ask to access or correct personal information, and request account deletion, at privacy@nightroute.com.au. NightRoute will verify identity before disclosing or deleting account information. Some records must remain for tax, fraud, safety, insurance or dispute reasons; NightRoute will explain any lawful refusal or limitation.

You can withdraw marketing consent using the unsubscribe option. Transactional and safety messages about a booking may still be sent. Device location permission can be changed in system settings, but location-dependent event features will not work without it.

10. Privacy complaints and changes

Send a privacy complaint to the Privacy Officer at privacy@nightroute.com.au. NightRoute will acknowledge it within two business days, investigate fairly and aim to provide an outcome within 30 calendar days. If it remains unresolved, you may complain to the Office of the Australian Information Commissioner.

Material policy changes will be explained through the app, website or email before they apply where appropriate. The final policy will show an effective date and version.