Privacy Policy

Who runs this

Project Big Things is operated by Project Big Things Pty Ltd, an Australian company. It is not owned by, affiliated with or sponsored by any of the towns, businesses or attractions it lists.

If you want to reach a person about anything on this page, email privacy@projectbigthings.com. We answer privacy and data requests ourselves; there is no third-party support desk in between.

What we collect

You can browse the entire catalogue, use the Standard map and read Visitor Log entries without an account, and without telling us anything about yourself. On the website, Satellite view requires a signed-in account because access to its protected Google map service is authenticated; your Project Big Things account is not sent to Google.

If you create an account, we ask for an email address and a password, and nothing else. We do not ask for your name, your age, your phone number or your address.

• Your email address, so you can sign in and so we can contact you about your account.
• The Big Things you record as visited, along with any date and private note you choose to add.
• The Big Things you save to visit later.
• The Challenges you follow, and the achievements those visits earn.
• Anything you deliberately submit: a Visitor Log entry, a contributed photo, a correction, or a report about someone else’s contribution.
• If you set one up: your display name, handle, home country, avatar image and Explorer Stamp design.
• If you hold a membership: your subscription status.

Location

Project Big Things does not build or retain a location trail. There is no background location access.

If you tap Locate me, your device supplies a foreground location so the map can centre on your current area. We do not save that sample to your account or database.

If you deliberately use Verify Here, the app sends one foreground location sample and its accuracy to Project Big Things so the server can decide whether you are inside the governed interaction zone for that Big Thing. The server stores the verification outcome and related non-coordinate evidence needed for the Site Pass, but the database schema deliberately has no latitude or longitude field for that sample and discards the coordinates after the check.

What we do not collect

Some of what this product does not do is as important as what it does, because the alternative is usually assumed.

• We do not continuously track your location, keep a route history, or use background location. Recording an ordinary visit is something you choose to enter; it is not silently detected.
• We do not build a public profile for you unless you turn one on. If you do, it shows only the display name, handle, home country and joined year you chose, and counts you opted into – never your visit history. There are no follower lists, no public travel timelines and no leaderboards.
• We do not sell or rent personal information to anyone, and we do not share it for anyone else’s marketing.
• We do not currently show Google advertising and we do not use cross-site tracking cookies. If advertising is added later, advertising cookies will be used only where your consent and our configuration permit, and your choice will be respected.

What stays private

Your collection is private by default and stays that way unless you take a deliberate, separate action to publish something.

Your visits, the dates you visited, your private notes, your saved list and your contribution history are visible only to you. Your email address is never shown to other users.

A Visitor Log entry is the one place where something you write becomes public, and it only happens because you chose to write one. It shows the display name you pick for that entry and the note you wrote. It does not show your email address, your exact visit time, your other visits or anything else in your collection. Pick a display name you are comfortable being public; the field will not accept an email address.

Photographs you contribute

A photo attached to a Visitor Log entry is reviewed before it appears publicly. A photo offered for the catalogue is reviewed separately and is only published if the rights are clear.

Photographs can carry more than they appear to. We ask you to confirm that you took the photo or hold the rights to it, and that anyone identifiable in it is comfortable being shown. Please do not upload photographs of other people, of children, or of private property interiors without their agreement.

Cookies and similar storage

If you sign in, we store a session on your device so you stay signed in. That is what the storage is for; it is not used to profile you or to follow you to other sites.

If you choose Satellite view on the website, we set a short-lived HttpOnly functional cookie containing a sealed map-session capability. It is scoped to satellite-map requests, is not used to track you, and expires within an hour.

We keep a small amount of information on your device to remember things like a search you were part-way through. It stays on your device.

On the website, Google Analytics uses Google’s Consent Mode, and what happens depends on where you are. In the European Economic Area, the United Kingdom and Switzerland, analytics storage, advertising storage, advertising data sharing and advertising personalisation are all denied by default, before anything is stored on your device, and they stay denied until you choose otherwise through our consent-management system. Without your consent there, Google Analytics receives cookieless measurement pings so we can understand broad site and feature use, and it does not read or write first-party analytics cookies such as _ga on this site.

Elsewhere, including Australia and New Zealand, analytics storage is allowed by default, so Google Analytics may use first-party analytics cookies on this site to measure sessions and recognise a returning browser. We do not currently show a consent message outside the European Economic Area, the United Kingdom and Switzerland. You can stop this by blocking or deleting cookies in your browser settings, or by installing Google’s Analytics opt-out add-on. We do not look up where you are to decide this: Google’s tag applies the regional setting itself.

Advertising storage, advertising data sharing and advertising personalisation are denied for every visitor in every region. Our consent-management system is Google’s certified consent platform (Google Privacy & messaging), shown where it is configured and required; where it is shown it is the only way analytics or advertising consent is recorded or changed on this site. Analytics choices and advertising choices are separate: allowing one does not allow the other. Where the message is shown you can change your choices at any time using the privacy settings control it provides, and if you withdraw analytics consent we ask Google’s tag to stop using analytics storage and remove the analytics cookies we can reach. We configure Google Signals off, and we do not send Google your email address, Google account ID, exact location, private notes, visit dates or the identity of a Big Thing you verify at or record as visited through Google Analytics.

We may in future show advertising on the website supported by Google AdSense. We do not show Google advertising at the time of this version of the policy. If we do, it will use the same consent-management system: advertising storage, advertising data sharing and advertising personalisation will remain denied unless you allow them where consent applies, and advertising may involve additional Google processing and storage where consent and configuration permit. This policy will be updated before advertising begins, and any change to advertising defaults outside the European Economic Area, the United Kingdom and Switzerland will be a separate decision announced here.

Where your information is held

Account data is stored using Supabase, and the website is delivered through Cloudflare. Both are established providers used under their standard terms, and both may process or store data outside Australia and New Zealand.

Map services differ by platform. On the website, Stadia Maps serves the Standard map tiles; if you explicitly choose Satellite, our Cloudflare service requests Google Map Tiles for the requested viewport. In the native app, Android maps use the Google Maps SDK and iPhone/iPad maps use Apple MapKit. Those map providers receive the network, viewport and service-request information needed to render the map. If you have deliberately centred the map on your current area, the requested viewport naturally reflects that area. We do not send a map provider your Project Big Things email address, collection or private notes.

RevenueCat handles membership billing. For web purchases, RevenueCat Billing uses Stripe as the payment gateway. They receive the account, billing contact and payment information needed to process and manage the subscription. Project Big Things does not receive your full card number. We do not send RevenueCat or Stripe your collection, private notes or location history.

Google Analytics receives page paths and a limited set of product-usage events so we can understand whether the field guide and key features are being used successfully. In the European Economic Area, the United Kingdom and Switzerland analytics storage is denied until applicable consent is obtained, so by default this is sent without Google Analytics cookies and is not used to recognise a repeat visit from the same browser; elsewhere Google Analytics may use first-party analytics cookies unless you block them. Product events are deliberately stripped of account identifiers and private travel details. Google may process that analytics information outside Australia and New Zealand under its standard terms, and Google’s consent platform processes your consent choice where its message is shown.

These providers may process information overseas. We use them only for the functions described here and do not sell or rent your information to them or anyone else.

Google Privacy Policy Apple Privacy Policy RevenueCat Privacy Policy Stripe Privacy Policy

How long we keep it

Account information is kept while your account exists. If you delete your account, it goes.

Two things deliberately survive account deletion, and it is fair that you know before you contribute rather than afterwards.

• A report you made about someone else’s contribution stays in the moderation record with your identity removed from it, because it is evidence about content that may still be public.
• A photograph you contributed that has already been reviewed and published in the catalogue stays published, along with the record of the permission you gave for it. If you want a published photograph taken down, ask us and we will consider it.

Deleting your account

You can delete your account yourself, at any time, from your account page. You do not need to ask us and you do not need to give a reason. If you do not have the app available, the public account-deletion page explains how to request deletion from the web.

Deleting removes your visits and their dates and notes, your saved list, your Challenge progress and achievements, your Visitor Log entries and their photographs, and any photo contribution still awaiting review. It cannot be undone.

Your account and everything about you in our database go immediately. Stored image files are removed at the same time wherever we can, but they are held in a separate storage system, and if that removal does not succeed straight away the file is put on an internal list and deleted promptly afterwards. We would rather your account went now and a file followed shortly than make you wait for both. If you want confirmation that a specific photograph has gone, ask us and we will check.

If something goes wrong, or you would rather we did it, email privacy@projectbigthings.com.

Account deletion

Seeing or correcting your information

Most of what we hold about you is already visible to you in your collection and on your account page.

You can ask us for a copy of your personal information, ask us to correct it, or ask us to delete it, by emailing privacy@projectbigthings.com. We will respond within a reasonable time and will not charge you for asking.

If you are not satisfied with how we have handled a privacy matter, you can complain to us first, and then to the Office of the Australian Information Commissioner, or to the Office of the Privacy Commissioner in New Zealand.

Security

Accounts are protected by password, connections are encrypted, and access to your data is enforced by database rules rather than only by the app in front of it.

No system is perfectly secure. If we become aware of a breach that is likely to cause you serious harm, we will notify you and the relevant regulator as the law requires.

Children

This product is not aimed at children, and we do not knowingly collect personal information from children. If you believe a child has created an account, tell us and we will remove it.

Changes to this policy

If we change this policy in a way that materially affects you, we will say so on the site rather than quietly replacing the page. The effective date at the top always reflects the current version.