Privacy Policy

Barry · Last updated: 31 August 2026

1. Who we are

Barry is operated by The Barry Collective (ABN [ABN, add once registered]), a sole trader based in Australia. In this policy, “we”, “us” and “our” refer to the operator of the app. We are the entity responsible for handling personal information collected through the app.

This policy covers information handled by us as the app operator. Individual events, organisers, or third parties that use the app to run their own programs may collect and handle personal information under their own privacy policies, which they are responsible for providing to you.

2. What information we collect

We only collect information that is reasonably necessary for our functions. The types of personal information we may collect include:

2.1 Contact and account information

• Name, email address, phone number, and postal or residential address.
• Username, password (stored hashed), and other account credentials.
• Communications you send us (e.g. support enquiries).

2.2 Volunteer application information

• Date of birth, emergency contact details, availability, and skills or certifications relevant to a volunteer role.
• Answers to screening questions relevant to the volunteer role.

2.3 Sensitive information

Some volunteer roles require us to collect health information as sensitive information under the Privacy Act, such as medical conditions, allergies, or accessibility needs relevant to the role. We only collect sensitive information where it is reasonably necessary for our functions and with your consent, or where required or authorised by law. You will be asked to give consent at the point we collect this information.

We do not currently collect government-issued identification (e.g. driver’s licence or passport numbers), or run background, police, or Working with Children Checks, through the app. If that changes for a particular role in future, we will update this policy and seek your consent separately before collecting it.

2.4 Payments and donations

Payments and donations are processed by Stripe. We do not collect or store full card numbers, CVV codes, or bank account details on our systems. Stripe collects that information directly from you under its own privacy policy: https://stripe.com/au/privacy (opens in new tab). We may receive limited transaction metadata (e.g. amount, date, last 4 digits, payer name and email) for record-keeping.

2.5 Technical information and cookies

Our hosting and database providers may keep basic technical logs (for example, server access logs) as part of running the app securely and reliably. We do not use analytics, advertising, or tracking technologies, and we do not collect your browsing behaviour, page views, or approximate location. See section 8 below for exactly which cookies and similar technologies the app itself uses.

3. How we collect information

We collect information:

• Directly from you when you create an account, submit a volunteer application, contact us, or use the app.
• From an event organiser, where they import volunteer information they’ve already collected (e.g. through their own external application form) into the app on your behalf.

Where practicable we will collect information directly from you. If we collect information about you from someone else, we will take reasonable steps to notify you.

4. Why we collect and use your information

We use personal information for purposes including:

• Creating and managing your account.
• Assessing and processing volunteer applications.
• Matching volunteers with events and communicating about opportunities.
• Responding to enquiries and providing support.
• Complying with legal obligations (e.g. taxation, work health and safety).
• Improving the app’s security, functionality, and user experience.
• Preventing fraud and misuse.

We will not use your personal information for a secondary purpose unless you would reasonably expect it, you have consented, or an exception under the Privacy Act applies.

5. Disclosure to third parties

We disclose personal information only where necessary, including to:

• Event organisers you apply to volunteer with, so they can assess your application and coordinate your involvement. Each organiser handles that information under their own privacy policy.
• Service providers that support the app, including:
  • Supabase: database, authentication, and file storage. See section 6 below.
  • Stripe: payment processing.
  • Google: only if you, as an event organiser, choose to connect a Google account for spreadsheet exports. We don’t connect to Google on your behalf.
  We may add other service providers as the app grows (for example, hosting or email delivery); we’ll update this section if that changes.
• Government agencies, regulators, or law enforcement where required or authorised by law.

We do not sell personal information, and we do not disclose it for direct marketing without your consent. We do not currently use any background-check providers, since the app doesn’t run background or police checks (see section 2.3).

6. Storage, security, and overseas disclosure

We store personal information in a Supabase project (Supabase Inc., a US company that operates managed infrastructure on AWS). Our Supabase project is hosted in the ap-southeast-2 region (Sydney, Australia). Supabase’s privacy policy is available at https://supabase.com/privacy (opens in new tab).

Even though data is stored within Australia, Supabase Inc. is a US-based company and its personnel or subprocessors may access data from outside Australia to provide support, monitoring, or backups. By using the app you acknowledge that your personal information may be accessed from, or transferred to, countries outside Australia including the United States. We take reasonable steps to ensure any overseas recipient handles your information consistently with the APPs.

We take reasonable steps to protect your information, including:

• Encryption in transit (HTTPS/TLS) and encryption at rest for the database.
• Row Level Security policies restricting who can read or write records.
• Hashed passwords and managed authentication via Supabase Auth.
• Access controls and least-privilege service keys.
• Regular backups and reviews of our security practices.

No online system is completely secure. If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

7. How long we keep your information

We keep personal information only for as long as we need it for the purposes described in this policy, or as required by law. When information is no longer needed we take reasonable steps to delete it or de-identify it. Volunteer application records may be retained for a reasonable period after your involvement ends for audit, safety, and dispute-resolution purposes.

8. Cookies

We use cookies for two purposes only: keeping you signed in (set by our hosting and authentication provider, Supabase), and a short-lived security cookie during the "Connect with Google" flow, used for Google Sheets exports. We also use your browser's local storage, a similar technology to cookies, to remember interface preferences on your own device, such as whether a menu is collapsed. We do not use cookies or local storage for advertising or analytics, and none of this data is shared with third parties for tracking purposes. You can control cookies through your browser settings. Disabling them may affect functionality, for example, staying signed in.

9. Children and young people

Barry is not intended for use by anyone under 18. We do not knowingly collect personal information from anyone under 18 through the app.

10. Access, correction, and deletion

You have the right to:

• Ask for access to the personal information we hold about you.
• Ask us to correct information that is inaccurate, out of date, incomplete, or misleading.
• Ask us to delete your account and associated personal information, subject to any legal retention obligations.
• Withdraw consent for the collection or use of sensitive information (this may affect your ability to participate in some volunteer roles).

To make a request, contact us using the details in section 13. We may need to verify your identity before actioning the request.

11. Complaints

If you believe we have breached the APPs or mishandled your information, please contact us first at [CONTACT EMAIL, set one up and add it here]. We will acknowledge your complaint promptly and aim to respond within 30 days.

If you are not satisfied with our response, you can make a complaint to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au/privacy/privacy-complaints (opens in new tab)
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it was last changed. If we make material changes, we will notify you through the app or by email and, where required, seek your consent again.

13. Contact us

For any privacy questions, requests, or complaints, please contact:

• Email: [CONTACT EMAIL, set one up and add it here]