Privacy policy

Aussie Outage Tracker aggregates the outage data Australian utility distributors publish and puts it on one map. This policy explains what we collect, what we deliberately do not, and what choices you have. It covers aussieoutagetracker.com.au (the public map, the suburb pages, the directory and the feed status page), app.aussieoutagetracker.com.au (the subscriber dashboard), docs.aussieoutagetracker.com.au (the API documentation) and the data API.

1. Who we are

Aussie Outage Tracker is operated by MODLL PTY LTD (ABN 79 639 342 484), based in Victoria, Australia. We are the entity responsible for the personal information described here, and we handle it under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This policy is written for two different readers, and the answer is genuinely different for each: people who visit the public site, and customers who hold a subscriber account. Sections 2 and 3 cover the first. Sections 4 onwards cover the second.

2. The public site collects nothing

The map, the state pages, the suburb pages, the directory and the feed status page are static files. There is no login and no form. To be specific about what that means:

• No cookies. We set none on the public site, for any purpose, including analytics and preferences.
• No analytics or tag manager. There is no Google Analytics, no advertising pixel, no session recorder and no A/B testing tool.
• Two first-party counters, for sponsored units and listed businesses. Some pages carry a sponsored unit, labelled as such, bought by a business through our dashboard. When one is shown, or tapped, the page sends our own server the unit's id and the word "render" or "tap". When a listed business is shown in the directory, on a suburb page or on the map, or its phone number or main button is pressed, the page sends the listing's id, which kind of page it was, and the word "view", "call" or "cta". Either way: no cookie, no identifier, nothing about you or your device — it tells the business how often it was seen, not who saw it. The directory pages show details that listed businesses entered themselves and asked us to publish.
• No third-party requests. Fonts, icons, brand images, the map tiles and the outage data files are all served from our own origin. Your browser is never asked to contact anyone else while the page loads, which means no other company learns that you opened it. That is a design constraint rather than a happy accident: this page gets opened during blackouts, and nothing on it may depend on a third party at runtime.
• No sign-in wall and no paywall on any of it.

Our web server keeps ordinary access logs, IP address, the page requested, the timestamp, browser user-agent and referrer. They exist to keep the service up and defend it: sizing capacity during a storm, and identifying abusive traffic. They are not used to build a profile of you, are not joined to any account, and are discarded within 30 days.

Suburb search on the map runs entirely in your browser, against a data file we have already sent you. What you type into it is never transmitted to us.

The API documentation works the same way: no cookies and no analytics. Its interactive console lets you try a request with your own API key. The key is kept in your own browser's local storage and sent only with the requests you make, straight from your browser to the API; the documentation site never receives it.

3. Outage data is not personal information

This is the question people ask first, so it gets its own section: the archive does not record who lost power.

What the distributors publish, and therefore all we hold, is the outage itself, an affected area as a polygon or an approximate point, the names of affected suburbs and sometimes streets, how many customers are off supply as a count, whether the work is planned or unplanned, the cause, the estimated restoration time, and the status over time. No feed we ingest names a customer, a household, an account number, a meter, or the street address of an affected premises, and we make no attempt to derive any of that.

So a suburb page can tell you that 412 customers in Cranbourne were off supply on a Tuesday afternoon. It cannot tell you, and neither can we, whether one of them was you or your neighbour. The historical archive is a record of network events, and it stays that way.

Areas differ in precision by network, and we say so rather than smoothing it over. Most distributors publish polygons; some, including AusNet, publish approximate points, which the map and the outage panel both label as approximate.

4. What the subscriber dashboard holds

This section applies only if you create an account at app.aussieoutagetracker.com.au.

Identity and sign-in

We collect your email address, and optionally your name and a name for your account. Signing in sends a one-time link and a six-digit code to that address; either works, and both expire after fifteen minutes. There is no password, so there is none to leak. Sign-in tokens, session tokens and invitation tokens are stored as SHA-256 hashes rather than as the values themselves, which means a stolen copy of our database contains nothing that can be replayed.

The session cookie

Signing in sets one cookie on .aussieoutagetracker.com.au. It holds an opaque session identifier and nothing else, no personal information, no tracking identifier. It is strictly necessary: the dashboard cannot know who you are without it. It is marked HttpOnly, Secure and SameSite=Lax, lasts 30 days, and is extended each time you use it. Signing out deletes the session on our side, not just in your browser. This is the only cookie we set anywhere. The one exception on any surface of the product is not ours: the card form on the dashboard's Billing page is Stripe's own, loaded from Stripe, and Stripe may set its own cookies to prevent fraud while you use it (see section 5).

Your sites

A site is a place you have asked us to watch, a depot, a cold store, an aged care facility, a tower, and we store the name you gave it, its coordinates or suburb, and the category you filed it under. We treat this as commercially sensitive. Where your assets are is information about your business, not about the network. It is never published, never included in anything we make public, and never shared with a distributor or with another customer.

When you type a street address to place a site, the dashboard asks our server for suggestions, and our server asks Google's Places service for them. Google receives the text you typed and the place you choose, from our server rather than from your browser; it does not receive your account, your other sites or anything identifying you.

Alert rules, recipients, matches, filters and digests

We store the alert rules you write (the name, the area they watch, the radius, which utilities and networks, and any threshold), the email addresses you ask alerts to go to, a record of each outage that matched a rule and whether an alert was sent, the filters you save in History, and which email digests you subscribe to and at what time of day they should arrive.

An alert recipient need not hold an account. Their address is used only to send them the alerts for that rule, every alert carries a link that stops them, and if they use it we keep a record of the opt-out so that it stays honoured.

Your business listing and advertising

If you list a business on the directory, we store what you enter: the business name, ABN, address, service area, phone, website, categories, description, logo and photographs. A listing is public by design, published on the site once it is verified. We check the ABN against the Australian Business Register. If you ask us to fill in a listing from your website, we fetch the pages of the site you name and extract the business's details from them.

Listings and ad images are screened before they are published, automatically using OpenAI's moderation and language models and by our staff. What is sent for screening is the business content you supplied for publication, not your account or your sites.

If you advertise, we also store your bids, budgets, the positions and states you chose, the ads you uploaded, the outcome of each auction, and the render and tap counts for your ads.

API keys and usage

API keys are stored as SHA-256 hashes; we show a key once, when it is created, and cannot show it again. For each key we record when it was created and last used, and how many calls it made each day to each endpoint, which is what the charge for calls beyond your API plan is calculated from. We also keep the state of your API plan: when it started, the month it is paid up to, and whether it has been cancelled.

If you ask for a bulk export of the archive, we keep the request, the states, the dates, what you told us it is for and who asked, and email it to our staff so they can quote it.

Invitations

If you invite a colleague onto your account we store their email address and the role you chose, until the invitation is accepted, revoked, or expires. Inviting somebody does not create a login in their name; nothing exists for them until they accept.

Support

Anything you send us when you get in touch, the message, your address, and whatever you choose to include, is kept so we can answer it and refer back to it.

5. Billing

Card payments are processed by Stripe (Stripe Payments Australia Pty Ltd). The card form on the dashboard's Billing page is Stripe's own, loaded from Stripe when you open it, so your card details go from your browser straight to Stripe and we never receive, see or store your card number. Stripe holds the card and charges it when we ask, under its own privacy policy.

We are the seller, and we issue the tax invoice for each charge ourselves. What we keep: the reference Stripe gives your account as its customer; for each saved card, its brand, its last four digits and its expiry date, so the dashboard can tell your cards apart and say which one paid; the billing status of your account; and a record of each charge, the amount, what it was for, each attempt to collect it and its outcome (paid, or declined and the reason, and any refund or dispute), and the invoice issued for it. Prices and charges are in Australian dollars; see our pricing policy. We keep charge records for as long as tax and accounting law requires.

6. Email we send

We send sign-in and account messages (one-time codes, invitations), billing messages (the tax invoice for each payment, with a PDF copy, and a failed payment), directory messages about your listing, alerts when a rule matches an outage, to the addresses on that rule, and digests you have subscribed to. Delivery is handled by Resend, and we record whether each send succeeded, so we can tell the difference between an alert that never fired and one that never arrived.

Every alert and digest carries a link to stop it, and you can turn them off in the dashboard at any time. Sign-in, account and billing email has no unsubscribe, because it is the mechanism by which you reach and pay for your own account. We do not send marketing email to your account address unless you have separately asked for it.

7. How we use it

• To run the service: sign you in, keep your account working, and watch what you asked us to watch.
• To send the alerts, digests and account email described above.
• To publish your directory listing and run your ads, once they are verified.
• To meter API calls and advertising, and to bill you accurately.
• To answer support requests.
• To keep the service available and defend it against abuse.
• To understand which parts of the product are used, so we can improve it.
• To meet our legal obligations.

8. What we never do

• We do not sell personal information, and we do not disclose it for anyone else's marketing.
• We do not use your data for advertising or profiling, ours or anyone's.
• Sponsored units on the public site are labelled, and counted without identifying anyone — see section 2. No advertiser learns who saw their ad.
• We do not run third-party trackers on any surface of the product.
• We do not use your data to train AI or machine-learning models. The screening described in section 4 uses OpenAI's API, which by default does not use what it is sent to train its models.
• We do not publish, licence or otherwise pass on your sites or your alert rules. If we ever licence the outage archive to a third party, what leaves is the network event data described in section 3, which contains nothing about you.
• We do not tell a distributor which of their outages you are watching.

9. Who else touches it

We use a deliberately small number of providers, each bound by its own contract and privacy obligations, and each receiving only what its job needs:

• Binary Lane, the virtual server the whole product runs on, in Australia. Application, database, uploaded images and static files all live there.
• Resend, email delivery.
• Stripe (Stripe Payments Australia Pty Ltd), card payments: the card details you enter into its form, the email address and business name the account bills under, and the amounts charged.
• OpenAI, screening directory listings and ad images, and reading a business's website when it asks us to import its details: the business content concerned.
• Google (the Places service), address suggestions in the dashboard: the address text typed, sent from our server.
• The Australian Business Register, a government service, to confirm an ABN on a directory listing.
• Cloudflare R2, offsite storage for encrypted database backups.

There is no content delivery network, no edge platform, no analytics vendor, no font or icon CDN, and no map tile provider in front of this product. Our own server answers every request. That is unusual enough to be worth stating plainly, and it is what lets section 2 make the claim it does.

In the other direction, our server fetches the distributors' public feeds every couple of minutes. Those requests carry our server's address and a User-Agent that identifies us honestly. Nothing about you goes to a distributor, and no distributor learns that you visited this site.

We may also disclose information where the law requires it, a court order, or a lawful request from a regulator or law enforcement, or where it is necessary to protect the safety of a person or the integrity of the service.

10. Where it is held

The application, the database, uploaded images and the archive are hosted in Australia. Four providers process limited data overseas: Resend (email delivery), Stripe (card payments), OpenAI (content screening) and Google (address suggestions). Where personal information is handled outside Australia we rely on the contractual and regulatory safeguards those providers offer, and take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles.

11. How long we keep it

• Public server logs, up to 30 days.
• Sign-in tokens and codes, fifteen minutes, then expired and purged.
• Sessions, 30 days from last use, or until you sign out.
• Account, sites, alert rules, recipients and saved filters, for as long as your account is open.
• Alert matches and digest send records, for as long as your account is open, so you can see what you were told and when.
• Alert opt-outs, for as long as the rule exists, so the opt-out keeps working.
• A directory listing and its images, for as long as it is listed. Removing it takes it off the site at the next publish.
• API keys, until revoked.
• Invitations, until accepted, revoked or expired, then deleted.
• Billing records, including the API usage and advertising results a charge was calculated from, as long as tax and accounting law requires, typically seven years.
• The outage archive, indefinitely, and deliberately. It is the point of the product, no distributor publishes history, and it cannot be backfilled. It contains no personal information, so closing your account does not affect it.
• On account closure, your account, sites, rules, recipients, filters, matches, listing, keys and send history are deleted, other than billing records we are required to keep.

12. How we protect it

Everything is served over encrypted transport. Every token and API key is stored as a SHA-256 hash rather than as the value. There are no passwords in the system to steal, and no card numbers. Database backups are encrypted before they leave our server, so the storage provider holds ciphertext only. Access to your data is scoped per user and per role, and access to the production environment is limited to the people who operate it. No measure is perfect, which is why the design collects as little as it can in the first place, the strongest protection on the public site is that there is nothing there to take.

13. Your rights

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, and you can close your account at any time. Email support@aussieoutagetracker.com.au and we will respond within a reasonable period, normally 30 days.

If you think we have mishandled your personal information, tell us first at that address so we can put it right. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.

14. Children

Aussie Outage Tracker is a business product and is not directed at children. The public map is open to anyone, but it collects nothing from anyone, whatever their age. We do not knowingly collect personal information from a person under 16 through the dashboard.

15. Changes to this policy

We will update this policy as the product changes, and whenever the set of providers in section 9 changes. The date at the top of this page always reflects the current version, and where a change materially affects account holders we will tell them by email.

16. Contact

Privacy questions, access requests and complaints: support@aussieoutagetracker.com.au, or write to MODLL PTY LTD, Victoria, Australia. Our terms of use and pricing policy cover the rest of the relationship.