Legal

Privacy policy

Last updated: 28 May 2026

Humbird is a private, building-only platform that lets neighbours share items, services, and announcements within their building. This page explains what we collect, why, how it's used, and the choices you have. We've tried to keep it plain-English; if anything's unclear, email support@humbird.com.au.

1. Who runs Humbird

Humbird is an Australian-built product. It's currently operated by the Humbird founding team based in Brisbane, Queensland. References to "we", "us", "our", or "Humbird" mean the entity operating the platform.

2. What data we collect

When you join Humbird as a resident:

• Account details: your first name, email address, and unit number.
• Building affiliation: which building you're a resident of, established via a building join code.
• Optional profile data: a profile photo if you upload one.

As you use the app:

• In-app activity: listings you create, borrows you initiate, bookings you make, posts you publish, reactions and comments.
• Messages: chat threads between residents (item enquiries, borrow coordination, service bookings, request responses).
• Device + session metadata: a device identifier (used to bind your sign-in to your phone), basic technical metadata, and the IP address of requests for security and abuse protection.

We do not collect: your location continuously, your contacts, your photos beyond images you intentionally upload, or behavioural data from outside the app.

3. How we use your data

Your data is used in two distinct ways, with different consent treatment.

Operational use (required)

To make the app work: showing your listings to neighbours in your building, delivering chat messages, enabling borrow + booking flows, surfacing maintenance requests to your manager, sending in-app and push notifications, and providing customer support when you contact us. This use is required to provide the service — opting out means closing your account.

Anonymised aggregate insights (default on, opt-out anytime)

We aggregate activity across our buildings to improve the product and to identify partners who might genuinely add value to apartment living (e.g. local businesses for the promotions surface). All aggregates pass through a k≥10 anonymisation floor — no slice we publish or share can be narrowed to fewer than ten residents, and no individual is ever identifiable. Aggregate insights are on by default when you sign up and can be switched off anytime in Profile → Privacy. Opting out excludes you from future aggregations; previously aggregated data is not retroactively recomputed.

4. Building-only data scoping

Everything that happens in your building stays in your building. Other buildings' residents never see your listings, your messages, or your profile. Your building's manager (if your building has one) sees activity within their building only — never anything from elsewhere. Cross-building aggregations are anonymised per the k≥10 rule above and are never linkable back to a specific person.

5. Who else has access

We use a small number of trusted third parties to operate the platform:

• Hosting: Supabase (Postgres, file storage — Sydney region) and Render (API hosting). Both are bound by their own privacy + security commitments.
• Email delivery: Resend (or an equivalent transactional email provider) for magic-link sign-in and notifications you've asked to receive by email.
• Push notifications: Apple Push Notification Service and Firebase Cloud Messaging for delivering push to your device.

We do not currently use any analytics product (no Google Analytics, no behavioural trackers). If we add one in future, we'll update this policy and notify residents in-app.

We never sell personally identifiable data. Aggregate, anonymised insights may be shared with commercial partners under the k≥10 floor; an individual resident is never identifiable in those insights.

6. Your rights under the Australian Privacy Act 1988

Humbird is bound by the Australian Privacy Principles (APPs). You have the right to:

• Access the personal information we hold about you (APP 12).
• Correct information that is inaccurate, out-of-date, or incomplete (APP 13).
• Delete your account, which removes your personal information from active systems. Some data may persist in backups for up to 90 days before being purged; aggregate, anonymised data that no longer identifies you may be retained indefinitely.
• Lodge a complaint about how we've handled your information, either with us or with the Office of the Australian Information Commissioner (oaic.gov.au).

To exercise these rights, email support@humbird.com.au with the subject line "Privacy request".

7. Children

Humbird is for adults. Residents must be 18 or older to sign up. Buildings are responsible for ensuring their residents meet this eligibility before issuing join codes.

8. Data retention

We retain account and activity data for as long as your account is active. When you delete your account, we remove your personal data from active systems promptly and from backups within 90 days. Audit-trail records relevant to safety, abuse, or legal compliance may be retained for longer where required by law.

9. Security

We hold personal information securely using current industry practice (encrypted-in-transit and at-rest, role-scoped database access, tenant-isolation enforced at the database level so cross-building leaks are structurally prevented). No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the OAIC as required under the Notifiable Data Breaches scheme.

10. Changes to this policy

We may update this policy from time to time. Material changes will be communicated to residents in-app before they take effect, with a clear summary of what's changing and why.

11. Contact

Questions, requests, or complaints about your privacy?
Email: support@humbird.com.au
Based in Brisbane, Queensland, Australia.