Privacy Policy

1. Scope and commitment

This Privacy Policy explains how PressHat Pty Ltd (PressHat, we, us or our) collects, holds, uses, discloses, secures and deletes personal information in connection with the PressHat application, website (https://www.presshat.com) and related services.

PressHat intends to design its privacy practices to align with the Australian Privacy Principles, whether or not every obligation applies to PressHat at every stage of the business. This Policy does not limit rights available under applicable privacy, consumer or online-safety laws.

Important: PressHat hosts user-generated photos, videos, audio, descriptions and location information. Published material may identify users and non-users and may be copied or reposted outside PressHat.

2. Information we collect

Depending on how you use PressHat, we may collect the following categories.

2.1 Account and profile information

• name, display name and PressHat handle;
• email address and mobile number;
• date of birth and the result of the minimum-age check made at signup;
• country, state, city, suburb and general location;
• profile photo, biography and selected social-media handles;
• authentication credentials or tokens; and
• account settings, language and notification preferences.

2.2 User content

• photos, videos, audio and other uploaded files;
• captions, headlines, descriptions, tags and comments;
• replies, polls, community posts and messages made available through the Platform;
• information visible within content, including faces, voices, number plates, addresses and events; and
• promotional permission choices associated with each upload.

2.3 Location and media metadata

Where permitted, we may collect:

• exact or approximate device location;
• a user-selected map pin;
• suburb and city displayed publicly or in a watermark;
• file creation time, capture time and modification information;
• EXIF or similar embedded metadata;
• device, camera, codec, file and integrity information; and
• hashes, fingerprints or identifiers used to identify duplicate or altered files.

Location is central to how PressHat works. When you upload content, PressHat extracts the exact GPS coordinates from the photo or video's embedded metadata and retains them. We use this information to place content on the PressHat interactive map and to help verify reported events, including, as the Platform develops, by cross-referencing reports from other users in the same area. By default, content appears on the map at the exact location taken from its metadata. You can choose to display a broader location instead, such as the street or suburb, for example where content was captured in a sensitive area. Where a broader location is displayed, PressHat still retains the exact coordinates extracted from the file, because they form part of the verification and credibility record for that content. Exact GPS coordinates do not appear in the watermark on downloaded copies, which shows only suburb and city. PressHat may generalise or omit location information for safety, privacy, moderation or legal reasons.

2.4 Usage and technical information

• IP address;
• device model, operating system and app version;
• app instance, installation and push-notification tokens;
• login, security and access records;
• pages, feeds, searches, views, follows, reactions and interactions;
• upload, download and reposting events;
• crash reports, diagnostics and performance data; and
• cookie or similar technology data used on PressHat websites.

2.5 Safety, moderation and verification information

• reports, complaints, evidence and appeal submissions;
• blocking and enforcement information;
• Jury Duty eligibility, assignments and votes;
• credibility, Community XP, Moderation Trust and reputation signals;
• ownership and authenticity evidence;
• support correspondence; and
• records reasonably required to prevent fraud, infringement or ban evasion.

2.6 Information about non-users

Users may upload media containing information about people who do not have PressHat accounts. This may include image, voice, location, conduct, health circumstances or other details visible in the media.

Non-users may contact PressHat to request review, blurring, location generalisation, restriction or removal. PressHat will consider privacy, safety, lawfulness, newsworthiness, public interest, the uploader's rights and the risk of harm. Appearance in legitimate public-interest footage does not automatically guarantee removal.

2.7 Launch list

If you join the PressHat launch list on our website, we collect the email address you enter. We do not ask for your name or any other details. To limit misuse of the sign-up form, we also record a one-way hash of the IP address used to sign up. We do not store the IP address itself.

3. How we collect information

We collect information:

• directly from users when they register, upload, post, report or contact us;
• directly from people who join the launch list on our website;
• automatically from devices and use of the Platform;
• from media files and their metadata;
• from connected authentication or social services selected by the user;
• from other users who report or interact with content;
• from service providers supporting security, analytics and delivery; and
• from publicly available sources where reasonably necessary for verification, safety or dispute resolution.

4. Why we use information

We may use personal information to:

• create, authenticate and secure accounts;
• validate the minimum age requirement at signup;
• operate profiles, feeds, maps, alert zones and community features;
• upload, process, transcode, watermark, display and deliver content;
• display the uploader's chosen handle and suburb/city on downloadable media;
• provide downloads and maintain download records;
• send service and safety notifications;
• tell people on the launch list when PressHat is available and how to get it;
• assess authenticity, provenance and file integrity;
• identify duplicate, manipulated, unlawful or prohibited content;
• provide credibility and reputation signals;
• moderate content and accounts;
• operate reports, appeals and Jury Duty;
• respond to support, privacy, copyright and safety requests;
• detect fraud, abuse, account compromise and ban evasion;
• analyse and improve Platform performance;
• comply with legal obligations and enforce our agreements;
• protect users, PressHat and the public; and
• use a specific upload in PressHat marketing where the uploader separately selects the optional marketing permission.

We will not use uploaded media to train a general-purpose generative AI model without separate express permission. We may use automated tools to operate, secure, caption, verify and moderate the Platform.

5. Permissions requested by the app

PressHat may request:

• Camera access when you capture media;
• Microphone access when you record audio;
• Photo or media library access when you select existing media;
• Location access when you add or verify a location;
• Notification permission when you enable alerts; and
• other permissions only when needed for a clearly described feature.

Permissions should be requested in context. You may change device permissions, but some features may no longer work. You can still upload content without allowing location access, but PressHat strongly recommends allowing it, because content without location metadata may receive a lower credibility score.

PressHat does not currently collect location continuously in the background. In future, PressHat may introduce an optional feature that uses background location to identify users who were near a reported event when it happened, so that PressHat can send them a push notification asking whether they can help confirm it. If introduced, this feature will be clearly explained in the app, will require your separate permission, and can be switched off at any time in your device settings.

6. Public information and sharing by users

Information you publish may be visible to users in Australia and overseas. Public content may be:

• viewed, commented on or shared;
• displayed in feeds, maps, profiles, alerts or search;
• downloaded where the uploader leaves downloads enabled;
• reposted on external social-media platforms under the Download and Reposting Licence in the Terms and Conditions (https://www.presshat.com/terms);
• cached, indexed, screenshotted or archived; and
• retained by people who obtained a copy before deletion.

The download toggle is on by default but can be switched off on the Review Upload page before publishing, and downloads can be disabled at any time after publishing. PressHat cannot guarantee retrieval of copies that leave the Platform.

7. Marketing use of uploaded content

Acceptance of the Terms and Conditions, including its media upload, download and reposting terms, does not by itself activate external promotional use.

On the Review Upload page, an uploader may separately and optionally select: Allow PressHat to use this content for marketing.

If selected, PressHat may reproduce, edit and display that upload in PressHat advertising, social media, app-store listings, presentations and other promotional materials, as explained in the Terms and Conditions.

If the uploader later withdraws that permission or deletes the upload, PressHat may continue using promotional materials already created, published, distributed or contractually committed, but will not ordinarily create materially new campaigns using the content. Continued use remains subject to applicable law and serious privacy or safety concerns.

8. Service providers and disclosures

We may disclose or make information available to providers that help us operate PressHat, including providers of:

• cloud hosting, databases and file storage;
• authentication and account security;
• notifications and email;
• analytics, crash reporting and performance monitoring;
• content moderation, security and fraud detection;
• customer support and communications;
• professional legal, accounting, insurance and security services; and
• future payment or identity services only if those features are introduced and separately disclosed.

Providers may use information only to deliver contracted services or as otherwise disclosed in their terms and applicable law.

We may also disclose information:

• with the user's direction or consent;
• to investigate and respond to a complaint or dispute;
• to protect a person from a serious safety threat;
• to courts, regulators, law-enforcement agencies or authorities where required or permitted by law;
• to enforce agreements or protect legal rights; or
• in connection with a genuine corporate restructure, financing, merger, acquisition or sale, subject to privacy obligations.

PressHat does not sell account information to data brokers or advertisers.

9. Third-party infrastructure and notifications

PressHat uses Amazon Web Services (AWS), Google Firebase and Apple Push Notification service (APNs) to operate the Platform.

9.1 Amazon Web Services

PressHat uses AWS for:

• account authentication (Amazon Cognito);
• its core database (Amazon RDS), hosted in Australia;
• the launch list (Amazon DynamoDB), hosted in Australia;
• delivery of account verification messages, service messages and push notifications (Amazon SNS), which passes push notifications to FCM and APNs for delivery to devices; and
• storage of uploaded media files (Amazon S3), hosted in Australia.

PressHat's core account and content data is hosted in Australia. AWS may process limited operational, security and support data in other regions where required for service integrity.

9.2 Google Firebase

PressHat uses four Firebase services:

Firebase Cloud Messaging (FCM) delivers push notifications to Android devices. To deliver a notification, PressHat may send Google a device registration token and the notification payload.

Firebase Analytics collects app-usage and device information (such as device model, app version, screen views and interaction events) to help PressHat understand and improve how the app is used.

Firebase Crashlytics collects crash and error reports (such as device model, operating system and app version, and the state of the app when the problem occurred) to help PressHat find and fix problems.

Firebase Performance Monitoring collects app performance data (such as app start-up time, screen rendering times and the timing of network requests) to help PressHat improve speed and reliability.

Analytics, crash and performance data are linked to a pseudonymous account identifier, never your name, email address or handle, and do not include the content you publish. PressHat does not collect your device's advertising identifier. These services do not offer Australian regional hosting, and this information is processed on Google infrastructure, including in the United States. You can turn them off at any time in the app under Settings → Privacy → Analytics and crash reports.

9.3 Apple Push Notification service

For Apple-device notifications, PressHat may send Apple a device token and notification payload. APNs may temporarily store a notification for delivery when a device is unavailable.

PressHat avoids placing exact locations, private messages, sensitive report details or unnecessary personal information in notification payloads or lock-screen previews.

10. Overseas storage and processing

PressHat's core account and content data is stored in Australia. However, some limited information is processed overseas:

• push-notification tokens and payloads are processed by Google (FCM) and Apple (APNs), which operate facilities in the United States and other countries; and
• app-usage analytics, crash reports and performance data collected through Firebase Analytics, Crashlytics and Performance Monitoring are processed by Google, including in the United States.

PressHat takes reasonable steps to use appropriate contractual, technical and organisational safeguards for overseas handling. PressHat does not send uploaded media files or core account records overseas as part of ordinary operations.

11. Automated systems, credibility and moderation

PressHat may use computer programs to:

• rank or recommend content;
• detect spam, fraud, manipulation and duplicate files;
• extract metadata or create captions;
• calculate preliminary credibility or reputation signals;
• prioritise content for human moderation;
• identify potentially prohibited or distressing content; and
• support Jury Duty selection and Platform security.

A computer-generated signal may be incomplete or wrong. Where an automated decision significantly restricts an account or content, PressHat should provide a reasonable explanation and an avenue for review, except where safety, law or security prevents disclosure.

Users may ask PressHat to correct inaccurate personal information that materially affected a decision.

12. Data retention

PressHat retains information only for as long as reasonably needed for the purposes described, legal obligations, safety, security and dispute resolution. The following are proposed maximum periods.

• Active account and profile data: while the account remains active.
• Deleted profile data in active systems: generally within 30 days.
• Deleted public uploads: removed from public display promptly.
• Deleted media in active storage: generally within 30 days.
• Location and other metadata extracted from uploaded content: retained for as long as the associated content is retained, as part of its verification and credibility record.
• Backup copies: deleted through the ordinary backup cycle, maximum 90 days.
• Unpublished drafts: proposed maximum 30 to 90 days.
• Security and access logs: proposed maximum 24 months.
• Download records: proposed maximum 3 years.
• Moderation reports and ordinary appeals: proposed maximum 3 years after closure.
• Serious safety, fraud, infringement or legal evidence: up to 7 years where reasonably necessary.
• Financial and transaction records: the period required by law if payment features are later introduced.
• Support correspondence: proposed maximum 3 years.
• Launch list email addresses: until you ask to be removed, and in any case no longer than 12 months after PressHat becomes publicly available.
• De-identified analytics: may be retained longer where re-identification is not reasonably possible.

A maximum period does not mean every record will be retained for the full period.

13. What happens when content is deleted

When an uploader deletes content, PressHat will generally:

• remove it from public display;
• prevent future downloads and new uses through the Platform;
• remove active production copies within the stated period;
• delete backup copies through the ordinary backup cycle; and
• retain only limited copies where reasonably needed for a legal obligation, safety matter, moderation or copyright dispute, fraud prevention, enforcement or defence of a claim.

Deletion does not automatically remove:

• copies already downloaded or reposted;
• third-party caches, archives, screenshots or search results;
• records required to show what was agreed, reported or moderated; or
• promotional materials already created, published, distributed or contractually committed where the uploader separately granted marketing permission.

After promotional permission is withdrawn or an upload is deleted, PressHat will not ordinarily create materially new promotional campaigns using that content.

14. Account deletion

Users may initiate account deletion through the app and through https://www.presshat.com/delete-account (by signing in to their account).

Deletion may require identity verification. PressHat may retain the minimum information reasonably needed to:

• comply with law or a court order;
• resolve a complaint or legal claim;
• prevent fraud, infringement, harassment or ban evasion;
• preserve serious moderation or safety evidence; and
• maintain records showing acceptance of agreements and permissions.

Comments may be anonymised as "Deleted account" where removal would disrupt a conversation, unless privacy, safety or legal considerations justify deletion.

15. Security

PressHat will take reasonable technical and organisational steps appropriate to the nature of the information. Measures may include:

• encryption in transit;
• encryption at rest where supported;
• role-based access controls;
• multi-factor authentication for privileged accounts;
• logging and monitoring of administrative access;
• separation of development and production access;
• secure configuration of cloud infrastructure, databases and storage;
• vendor and contractor controls;
• backup and recovery procedures; and
• incident-response planning.

No service is completely secure. Users should use strong credentials, secure their devices and promptly report suspected compromise.

16. Data breaches

If PressHat becomes aware of a suspected data breach, it will assess, contain and investigate the incident, take reasonable remediation steps, and notify affected people and regulators where required by law.

17. Access and correction

Subject to lawful exceptions, users may request access to or correction of personal information by contacting privacy@presshat.com.

PressHat may require identity verification and may refuse or limit a request where permitted by law, including where access would unreasonably affect another person's privacy, expose confidential security information or interfere with an investigation. Where required, PressHat will explain a refusal and available complaint options.

Users may update many profile details directly in the app.

18. Privacy and content complaints

Privacy complaints should be sent to privacy@presshat.com and should include enough detail for PressHat to investigate. Content concerns can also be reported directly in the app using the report tools, and copyright or content complaints may be sent to report@presshat.com.

Requests relating to a person appearing in footage may seek:

• removal or restriction;
• face, number-plate or address blurring;
• location generalisation;
• correction of misleading context; or
• urgent action where safety is at risk.

PressHat aims to acknowledge and respond to complaints in a timely manner, having regard to the urgency and seriousness of the issue. If a complaint cannot be resolved, the person may have a right to contact the Office of the Australian Information Commissioner or another relevant regulator.

19. Direct marketing

PressHat may send product announcements or promotional messages where permitted by law. Users may unsubscribe from optional marketing communications.

The launch list is used only to announce that PressHat is available and how to get it. You can ask to be removed from the launch list at any time by emailing privacy@presshat.com.

Users cannot opt out of essential service messages, including security alerts, material agreement changes, moderation notices and account-deletion communications.

PressHat will not provide user email addresses or phone numbers to advertisers for their independent marketing.

20. Children and age assurance

PressHat requires Australian account holders to be at least 16 years old. Users must provide a date of birth at signup and confirm by checkbox that they meet the age requirement. PressHat validates this information against the minimum age requirement and may request additional verification where reasonably necessary for legal compliance or safety concerns. Other users may report a suspected underage account through the in-app reporting tools, and PressHat reviews and acts on credible reports.

PressHat minimises age-assurance data and does not require government identity documents as a condition of using the service. If an underage account is identified, PressHat may restrict or delete the account while retaining limited records required for safety and compliance.

21. Changes to this Policy

PressHat may update this Policy to reflect legal, technical, security or service changes. The current version and effective date will be published. PressHat will provide reasonable notice of material changes and obtain additional consent where law requires it.

22. Contact

Privacy enquiries and requests: privacy@presshat.com

General support: support@presshat.com

Copyright and content complaints: report@presshat.com

Postal address: 50 Willis Street, Hampton VIC 3188, Australia