Recs privacy policy
Effective 13 October 2026. Operator: Recs, Melbourne, Australia ("we", "us"). Contact: hello@getrecs.com.au.
Recs is a social app for saving, rating and recommending places. This policy explains what we collect, why, who processes it for us, and your rights under the Australian Privacy Principles (APPs) and, where they apply, the GDPR and UK GDPR.
1. What we collect
Account. Your email address (from Sign in with Apple, Google sign-in or an email code), your username, display name, home city, date of birth (for the age gate; never shown to anyone), and an optional profile photo, bio and Instagram or TikTok handle. Apple may give us a relay address instead of your real email; Google gives us your name and profile picture, which we use only to pre-fill your profile.
What you create. Your ratings, reviews, review photos, lists and the places in them, comments, @mentions, direct messages, recommendations you send, who you follow, who you block or mute, and reports you file.
Location. Your home city is what you type. When you search "near me" or open the map, your device gives us a location that we round to about one kilometre before it leaves your phone. We use it only to find nearby places. We never store it on your profile and never show it to other people.
Device and usage. Device model, operating system version, app version, a push notification token when you turn notifications on, and product analytics (which screens you open and what you do, as counts and flags, never the text you type). If the app crashes or hits an error we record the error message, a stack trace and the device facts above.
Support. Messages you send through Help, with the same device facts, so we can answer.
2. Why we use it
To run the app: show you and your friends places, deliver recommendations and messages, send push notifications you asked for, and keep your account secure. To keep Recs safe: review text and photos are screened automatically for abuse, and people can report content and accounts. To improve the product: aggregate analytics. To meet legal obligations.
Legal bases where the GDPR applies: performance of our contract with you (the Terms), our legitimate interests in a safe, working product, and your consent for notifications and photo access, which you can withdraw at any time in your phone's settings.
3. Who sees what
Your profile picture, username, display name, city, bio and handles are visible to signed-in users. Your ratings, reviews, photos, comments and public lists are visible to signed-in users, or only to approved followers if you make your account private. Private lists are visible only to you and people you share them with. Direct messages are visible only to the sender and recipient. Your email address, date of birth, exact location and push token are never visible to other users.
4. Who processes data for us
| Processor | What | Where |
|---|---|---|
| Supabase | hosting, database, authentication, file storage, server functions | AWS, Sydney (ap-southeast-2) |
| Apple and Google | sign-in | their regions |
| Google Maps Platform | place search, place details and photos, map tiles; receives your search text and the rounded location | Google's regions |
| PostHog (EU Cloud) | product analytics: a pseudonymous profile id, home city, private flag, platform, screen names and events as counts; no names, emails, messages, reviews or search words; no location derived from IP | Frankfurt, EU |
| OpenAI | automated screening of review text, bios and photos for abuse; content is sent for classification only and is not used to train models | United States |
| Resend | sends sign-in emails from mail.getrecs.com.au | United States |
| Expo (EAS) and Apple Push Notification service | delivering push notifications | United States |
We do not sell personal information and we do not use it for advertising or cross-app tracking.
5. Retention
Your data stays while your account exists. When you delete your account (Settings → Delete account) we delete your profile, ratings, reviews, photos, lists, follows, messages, notifications, push tokens and private data immediately and your authentication record with it. Reports you filed are kept without your identity so moderation history survives. Backups are overwritten within 30 days. Analytics events are retained in pseudonymous form.
6. Your rights
You can see and change your profile in the app, export everything you created (Settings → Export my data), and delete your account in the app in three taps. You can also ask us to access, correct or delete your data, or object to a use of it, by emailing hello@getrecs.com.au. If you are in the EU or UK you may complain to your supervisory authority; in Australia, to the OAIC.
7. Children
Recs is for people aged 13 and over. We ask your date of birth at sign-up and refuse accounts under 13. If you believe a child under 13 has an account, email us and we will delete it.
8. Changes
We will post changes here and, for material changes, ask you to agree again inside the app before you continue.
‹ Back to Recs