Michi privacy policy
How we collect, use, store and share your personal information.
Contents
- Introduction
- Types of personal information we collect
- [Optional] Personal information of minors
- How personal information is collected
- Use of your personal information
- Automated decision-making
- How we disclose your personal information
- Storage of your personal information
- Sensitive information
- Marketing
- [Optional] De-identified information
- Security
- Links
- Requesting access or correcting your personal information
- Complaints
- Contact us
1. Introduction
This document sets out the privacy policy of [insert] (referred to in this privacy policy as ‘we’, ‘us’, or ‘our’).
The Privacy Act 1988 (Cth) (Privacy Act) requires entities bound by the Australian Privacy Principles to have a privacy policy. We take our privacy obligations seriously and we’ve created this privacy policy to explain how we store, maintain, use and disclose personal information.
We are committed to preventing serious invasions of privacy and ensuring the protection of your personal information, so you can contact us using the details below if you have any questions or concerns.
By providing personal information to us, you consent to our storage, maintenance, use and disclosure of personal information in accordance with this privacy policy. Where we collect sensitive information (including health information), we will seek your express consent at the point of collection, such as through an in-app consent prompt, before collecting, using or disclosing that information.
We may change this privacy policy from time to time by posting an updated copy within the app and on our website. Where we make material changes, we will notify you through the app before the changes take effect. We encourage you to review this privacy policy regularly to ensure that you are aware of our most current practices.
2. Types of personal information we collect
The personal information we collect may include the following:
(a)name;
(b)device type, operating system, and app version;
(c)email address;
(d)social media information;
(e)subscription and purchase history (via Apple, Google, and RevenueCat);
(f)age or date of birth (if collected in connection with a future age-verification feature);
(g)usage analytics data, including screens visited and interaction counts;
(h)purchase status and subscription information received from Apple, Google, and RevenueCat (we do not collect or store credit card or payment card details);
(i)sensitive information (such as [insert e.g., health information]) as set out below;
(j)information you provide through in-app features, such as gratitude lists and feedback;
(k)responses to in-app quizzes and guided lesson exercises;
(l)your device identity and type, I.P. address, geo-location information, page view statistics, advertising data and standard web log information;
(m)reminder preferences and notification settings; and
(n)any other information provided by you to us via our app, or otherwise required by us or provided by you.
3. [Optional] Personal information of minors
If we collect personal information from individuals under the age of 18, we will assess their capacity to consent on a case-by-case basis in accordance with the Australian Privacy Principles (APP) Guidelines. As a general principle, an individual under the age of 18 may have the capacity to consent if they demonstrate sufficient maturity to understand the nature and consequences of what is being proposed. Where it is determined that the individual does not have such capacity, we will seek verifiable consent from a parent or guardian.
If it is not practicable to assess capacity on a case-by-case basis, we will generally assume that individuals aged 15 and above have the capacity to provide consent, unless there are reasonable grounds to believe otherwise. Our app is not intended for use by children under the age of [13/15 - to be confirmed]. Parents or guardians may contact us at usefulthings.studio@gmail.com to review, manage, or request deletion of their child’s personal information.
4. How personal information is collected
We will collect your personal information in a lawful and fair way. We will only collect your personal information where you have consented to it, or otherwise in accordance with the law.
How we collect information from you
We may collect personal information where you:
(a)use our app, including by creating entries, drawings, or providing feedback;
(b)subscribe to or use our services;
(c)submit any of our online inquiry forms;
(d)communicate with us via email, telephone, SMS, social applications (such as LinkedIn or Facebook) or otherwise;
(e)interact with our website, social applications, services, content and advertising; and
(f)provide us with feedback or contact us for support.
How we collect information from third parties
Where possible, we collect your personal information directly from you. However, there may be occasions when we collect personal information about you from someone else. For example, we receive subscription status and purchase information from Apple, Google, and RevenueCat in connection with managing your subscription.
How you provide information for someone else
If you are providing personal and/or sensitive information on behalf of someone else, you must have the consent of that person to provide their personal and/or sensitive information to us for collection, use, and disclosure in accordance with this privacy policy. We reserve the right to request evidence of this consent.
[insert for minors] If you are providing personal and/or sensitive information on behalf of someone under the age of 18 (Minor), you must be that Minor’s parent or legal guardian and you must provide consent for the Minor’s personal and/or sensitive information to be collected, used and disclosed in accordance with this privacy policy.
How we collect information from cookies
We may also collect personal information from you when you use our app. This may be done through the use of analytics tools such as PostHog, which collect usage data including screens visited, device type, and country. You can disable analytics collection in the app’s settings (on the Me tab).
We use PostHog to collect and process anonymised usage data. PostHog drops your IP address and retains only your country. You can opt out of analytics collection at any time in the app’s Me tab.
5. Use of your personal information
We collect and use personal information for the following primary purposes:
(a)to provide goods, services or information to you;
(b)for record keeping and administrative purposes;
(c)to provide information about you to our contractors, employees, consultants, agents or other third parties for the purpose of providing goods or services to you;
(d)to improve and optimise our service offering and customer experience;
(e)to comply with our legal obligations, resolve disputes or enforce our agreements with third parties;
(f)to send you administrative messages, reminders, notices, updates, security alerts, and other information requested by you; and
(g)to perform automated safety checks on your written entries to identify signs of distress and offer helpline information, as described below.
We may also use your personal information for:
(h)secondary purposes closely related to the primary purpose, in circumstances where you would reasonably expect such use;
(i)such purposes where we reasonably believe that use of your personal information is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety, and it is unreasonable or impracticable to obtain your consent;
(j)any other purpose for which we receive consent from you; or
(k)any other purpose which is permitted or required under applicable privacy laws.
6. Automated decision-making
We use an automated safety check (powered by OpenAI’s moderation model) to review your gratitude entries and feedback for signs of self-harm, harm to others, or abuse. If the safety check identifies concerning language, the app will display helpline information – it will never block, alter, or report what you have written, and we are not alerted. This check has limitations: it may not catch all concerning language, and it may sometimes respond to language that is not a cause for concern. You may request human review of any automated decision by contacting us at usefulthings.studio@gmail.com.
7. How we disclose your personal information
We respect your privacy, and we will take reasonable steps to keep your personal information confidential and protected. We may disclose your personal information to:
(a)our third-party service providers, including Supabase (database and storage, Australia), OpenAI (safety check, United States), PostHog (analytics, United States), RevenueCat (subscription management, United States), and Brevo (transactional emails, European Union);
(b)our professional advisors such as lawyers, accountants and auditors;
(c)our related entities; or
(d)any third parties you have consented personal information to be disclosed to.
We may also disclose personal information to third-party contractors as required for us to provide our services to you, such as cloud-service providers, IT professionals, and analytics providers.
We take care to work with such third parties who we believe maintain an acceptable standard of data security and require them not to use your personal information for any purpose except for those activities we have asked them to perform on our behalf.
We will not otherwise disclose your personal information unless:
(e)you have consented to us disclosing your personal information for particular circumstances;
(f)as needed in an emergency or in investigating suspected criminal activity;
(g)we are required to disclose under a subpoena, court order or other mandatory reporting requirements;
(h)we reasonably believe that disclosure of your information is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety, and it is unreasonable or impracticable to obtain your consent;
(i)it is reasonably necessary for the establishment, exercise or defence of a legal claim; or
(j)it is otherwise authorised or required by law.
8. Storage of your personal information
All personal information we collect is primarily stored on servers located in Australia (Sydney). However, in providing our services, we disclose personal information to the following overseas service providers: OpenAI (United States) for safety checks on user-written content; PostHog (United States) for anonymised analytics; RevenueCat (United States) for subscription management; and Brevo (European Union) for transactional emails. We take reasonable steps to ensure these providers comply with the Australian Privacy Principles or are subject to comparable privacy protections.
However, the cloud service providers we engage to provide us with Australian-based servers may operate overseas disaster recovery sites or have personnel overseas who may access the personal information we hold to assist us in managing our servers.
We use PostHog for app analytics, which may store anonymised usage data in the United States. PostHog drops your IP address before storage and retains only your country.
When you use the “Pass it on” sharing feature, the content is shared through your device’s native share functionality (such as WhatsApp or Messages). This sharing occurs directly from your device and does not pass through our servers. We do not collect or store information about who you share content with.
9. Sensitive information
Collection of sensitive information
We may collect sensitive information about you during the course of providing you with our services. We will only collect this sensitive information where you consent to such collection and directly provide us with this information through the app.
Types of sensitive information we collect
The sensitive information we collect may include the following:
(a)health information, history and reports, including [insert];
(b)mood ratings and, where you choose to connect Apple Health, heart rate, sleep, and mindful minutes data;
(c)journal entries and responses to guided prompts (planned feature); and
(d)any other sensitive information you provide through the app.
(e)information derived from Apple Health or Apple Watch, including heart rate, sleep, and mindful minutes data (only with your express permission, as a planned feature); and
(f)any other sensitive information provided by you or a third party to us via our website or platforms, or otherwise provided by you or a third party to us.
How we use your sensitive information
Your sensitive information will only be used for the purpose of:
(a)providing you with our goods and services;
(b)complying with our legal obligations, resolving disputes or enforcing our agreements with you;
(c)sending you messages, reminders, notices, updates, security alerts, and other information requested by you; or
(d)any other purpose which is permitted or required under applicable privacy laws.
How we disclose your sensitive information
Your sensitive information will only be disclosed to third parties for the purpose of:
(a)providing your written entries to OpenAI’s moderation model for the automated safety check described above (the content may be retained by OpenAI for up to 30 days but is not used for AI training); or
(b)any other purpose which is permitted or required under applicable privacy laws.
How you can withdraw consent
If you wish to withdraw your consent to our collection, use or disclosure of your sensitive information, you can use the “Delete everything” feature in the app to immediately remove your account and all associated data, or contact us using the contact details set out below. We will deal with all such requests within a reasonable timeframe.
10. Marketing
We may at times send you marketing communications in accordance with the Spam Act 2003 (Cth) (Spam Act).
If we do, we will use email to send you direct marketing communications.
Where consent is needed, we will ask you for your consent before sending you marketing communications, except where you:
(a)have explicitly opted in to receiving email marketing from us in the past; or
(b)have explicitly opted in to receiving marketing communications from us.
You can, at any time, opt out of receiving marketing materials from us by using the opt-out facility provided (e.g., an unsubscribe link on emails we send you) or by contacting us via the details provided at the end of this privacy policy. We will implement such a request as soon as possible; however, we cannot guarantee that such a response will be immediate.
11. [Optional] De-identified information
The information we collect may have analytical and research value. Where we have de-identified the information we have collected so that it can no longer reasonably identify you, we may use and share such information for research purposes (including with academic institutions) and to improve our services. We will not sell or commercially distribute de-identified data.
12. Security
We take reasonable steps to ensure your personal information is secure and protected from misuse or unauthorised access. Our information technology systems are password protected, and we use a range of administrative and technical measures to protect these systems. However, we cannot guarantee the security of your personal information.
13. Links
Our app may contain links to other websites and apps, including helpline services (such as Lifeline and Beyond Blue) and the Beyond Now safety planning app. Those links are provided for your wellbeing and convenience and may not remain current or be maintained. We are not responsible for the privacy practices of those linked websites or apps and we suggest you review their privacy policies before using them.
14. Requesting access or correcting your personal information
You can access and export your personal information at any time using the “Send me a copy of everything” feature in the app’s Me tab. If you wish to request additional access to the personal information we hold about you, please contact us using the contact details set out below, including your name and contact details. We may need to verify your identity before providing you with your personal information. In some cases, we may be unable to provide you with access to all your personal information and where this occurs, we will explain why. We will deal with all requests for access to personal information within a reasonable timeframe.
If you think that any personal information we hold about you is inaccurate, please contact us using the contact details set out below and we will take reasonable steps to ensure that it is corrected.
15. Complaints
If you wish to complain about how we handle your personal information held by us, please contact us using the details set out below, including your name and contact details. We will investigate your complaint promptly and respond to you within a reasonable timeframe. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
16. Contact us
For further information about our privacy policy or practices, or to access or correct your personal information, or make a complaint, please contact us using the details set out below:
Name: [insert]
Email: usefulthings.studio@gmail.com
Our privacy policy was last updated on [insert].