App privacy policy

Who is responsible

SAUNDAY PTY LTD (Saunday, we, us), ABN 58 700 932 716, is responsible for the Saunday iOS and Android apps and the information described here. Contact our privacy team at hello@saunday.co.

This policy covers app accounts and the membership, booking, support and community services connected to them. The apps and venue membership are for adults aged 18 and over. Our website privacy policy separately covers website visits, waitlists, giveaways and advertising cookies, including when you open a website link from the app.

Information we collect

• Account and profile: your name, email, account identifier, authentication details, profile fields you provide, such as a phone number, and an optional profile photo. If you choose Sign in with Apple, this includes the identifier and details Apple shares, which may use a private relay email address.
• Membership and payments: your plan, agreement, billing contact details, purchase and payment status, invoices and payment-provider references. A payment interface may also collect a billing address, card or wallet details and information needed to prevent fraud.
• Visits: venues and times you book, changes, cancellations, guest passes, visit history and private notes you choose to save. If a venue records attendance or provides digital access, this can also include access credentials, entry attempts and recorded entry or exit times. A reservation is not proof that you attended.
• Community: friend requests and connections, invitations, clubs, events, song suggestions, content you create, sharing preferences, reports and blocks. Connections in Saunday are distinct from your phone’s address book.
• Support and service operation: messages you send us, relevant records used to resolve your request, network and device information, authentication activity and error or security logs. Information you choose to send about an injury or access need may include health information.

We collect information directly from you, when you use a feature, and from the providers and people involved in that feature, such as a payment provider, an invitation host or someone making a safety report. Optional notes and profile fields are your choice. Avoid putting unnecessary medical information or another person’s private details into them.

How we use it

We use this information to create and secure your account; provide membership and bookings; administer payments and cancellations; manage guest visits and venue access; display the content and connections you choose; respond to support and privacy requests; investigate abuse or fraud; and meet our legal obligations.

Booking and access checks use your membership entitlement, booking time, venue rules and available capacity. If a result seems wrong, contact us for review. Where progress features are available, recorded attendance may support your activity history and earned levels; a scheduled booking alone does not establish attendance.

We use information supplied about your health or access needs to handle the relevant support or safety request, not for advertising. We only collect sensitive information where permitted by law, including with your consent where required.

What other people can see

Your community profile, photo and content may be visible to the members using that feature. Friends, hosts, guests and club or event participants may see information needed for their connection or shared visit. Review Privacy & sharing and the audience shown before you share your plans.

Private visit notes are not shared with other members. Authorised staff and providers may access relevant information when needed to operate the service, investigate a problem or meet a legal obligation. Reports are used for moderation and safety; we do not make them public community content.

We do not sell your personal information. The native app does not use an advertising SDK to track you across other companies’ apps and websites. Marketing website measurement is explained separately in the website policy.

Providers and overseas processing

We use service providers for authentication, databases, file storage, hosting, payments, account messages and customer support. These include Supabase for app authentication and data storage, Vercel for web and API delivery, Stripe for payments, and Apple if you choose an Apple sign-in or payment feature. Our membership administration and customer support systems may hold records separately from your app sign-in.

Saunday does not store your full card number in its app database. Stripe receives payment details and relevant device, identifier and payment-interface activity for payment processing, security, fraud prevention and its service analytics. Its own privacy policy explains that processing.

Information can be processed outside Australia, including in the United States and Singapore. Payment and other service providers may also process information in additional countries listed in their current disclosures. Hosting a database in Australia does not mean every support, security or delivery service stays in Australia. See Supabase’s provider locations, Stripe’s provider locations and Vercel’s provider locations for the current lists.

We share relevant information with authorised Saunday staff, venue operators and service providers for the purposes described here, and with regulators, professional advisers or others where required or permitted by law. Access should be limited to what the recipient needs for its role.

Permissions and choices

You can update supported profile fields, change sharing choices and block members in the app. Optional features may ask for device permission, such as selecting a profile photo or receiving notifications. You can decline or change permissions in your device settings; the related feature may then be unavailable.

Where local routine reminders are available, they are scheduled on your device. If a feature uses remote notifications, a device notification token is used to deliver them. Availability and permission prompts depend on your app version and device.

You can unsubscribe from marketing messages using the message’s unsubscribe option or by contacting us. Essential account, booking, payment and safety messages may still be sent. If you choose not to provide information required for an account, payment or booking, we may be unable to provide that service.

Security, retention and deletion

We store information in our service providers’ systems and use measures such as encrypted connections, authentication and restricted staff access to protect it. No online service can guarantee absolute security. Keep your account credentials private and contact us if you notice suspicious activity.

We keep personal information while it is needed for the purposes in this policy or to meet legal obligations. Different records have different needs: your account and visit information supports the service; security and support records support investigations; and agreements, billing contacts, invoices and payment references may be needed for outstanding payments, tax, disputes or other legal requirements.

You can request deletion through Account details where available, or by following our account-deletion instructions. We verify the request and explain any membership, payment or access implications. App identity, profile, photos and personal app records are removed or de-identified as appropriate; records we must retain for a lawful purpose are handled separately. Deletion is not complete just because a request was submitted.

Some information may remain in restricted backups until those backups are replaced, or be retained for a legal hold. Retention varies by system and record; we do not promise an immediate purge of every provider’s backups. Contact us for information about a particular record or deletion request. Necessary retained financial records must not be used to restore your deleted app account.

Access, correction and complaints

You can ask to access or correct your personal information, request deletion, or raise a privacy concern by emailing hello@saunday.co. Include your account email and what you would like us to help with. We may ask for reasonable proof of identity to protect your information; do not send passwords, verification codes or full payment-card details.

We review the request, investigate the relevant records and respond with the outcome or next steps. If we cannot provide access, make a correction or delete a record, we explain why, subject to any legal restriction. For complaints, we aim to respond within 30 days and will let you know if more time is needed.

If you are not satisfied with our response, or we have not responded within a reasonable time, you can contact the Office of the Australian Information Commissioner.

Keeping this policy current

We update this policy when our services or information practices change. The date above identifies the current version. We will draw material changes to your attention through the app or another appropriate channel, and request consent where required.