Privacy policy

1. Who we are

FundBuddy is an Australian mobile app that helps NDIS participants and their families keep track of their plan budget. It is made and operated by fabricat3d (ABN 19 502 462 976) ("FundBuddy", "we", "us"). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we've written this policy to follow their structure.

2. What we collect

We only collect information that you give us or that the app needs to run. Specifically:

• Account email. Used to create your account, sign you in, and send you essential service emails (like a password reset or an account-deletion confirmation).
• Participant details you enter. Display names for up to four participants on a family subscription, and the NDIS plan budget details you type in — funding categories, amounts, plan dates and funding periods.
• Claims and spending you enter. Records of supports, sessions and purchases you log against a budget, including amounts, dates, providers and NDIS support codes.
• Receipt photos you choose to upload. Only when you take or pick a photo in the app. We never access your camera roll in the background.
• Subscription and purchase status. Whether your subscription is active, which plan you're on, and when it renews — supplied by Apple or Google via our subscription service (see section 6). We never receive your card details.
• Basic technical information. Standard, minimal logs our hosting provider keeps to run the service securely (for example, the time of a request and an IP address). We do not use these to profile you.

We don't ask for, and we ask you not to enter, your NDIS number, myGov or myplace/PACE login, bank details, or medical records. FundBuddy never connects to the NDIS portal — you enter your own budget numbers.

3. Why we collect it

We use your information to:

• show you your live budget balance, "safe to spend" figure, and spending forecast;
• read receipts and suggest support codes when you ask us to;
• keep your data in sync between your devices and safely backed up;
• manage your subscription and family participants;
• reply when you contact support;
• keep the service secure and fix bugs.

That's the whole list. If we ever want to use your information for something new, we'll ask you first.

4. Reading receipts with AI

FundBuddy can read a receipt photo and pull out the total, the date, the merchant, and a suggested NDIS support code so you don't have to type it. Here is exactly how that works:

• It only happens when you tap "Read receipt". Nothing is sent anywhere automatically.
• When you tap it, the photo is sent to our AI provider, Anthropic, and processed on servers in the United States. This is a disclosure of your information overseas under APP 8, and by tapping "Read receipt" you consent to it for that photo.
• Anthropic processes the photo to return the extracted details to the app. Under our agreement with them, they do not use the photo to train their models.
• The results are suggestions. You can always edit or discard them before anything is saved.
• You can use FundBuddy without this feature — just type the receipt details in yourself.

5. Where your data lives

• Your account data, budgets and spending records are stored, encrypted, in our database hosted by Supabase.
• Receipt photos are stored in private storage that only your account can access. They are never public and never shared between accounts.
• Our hosting region is Sydney, Australia (ap-southeast-2). Apart from the receipt-reading step in section 4, we do not routinely send your data overseas.

6. Payments

Subscriptions are bought through the Apple App Store or Google Play. Your payment is handled entirely by Apple or Google under their own privacy policies. We use a subscription service called RevenueCat to know whether your subscription is active. We never see, store, or have access to your card number.

7. What we don't do

• No advertising. There are no ads in FundBuddy, and we don't share your data with advertisers.
• No selling data. We never sell, rent, or trade your personal information. Full stop.
• No analytics trackers. We don't embed third-party analytics or marketing SDKs that watch how you use the app.
• No cross-app tracking. We don't track you across other apps or websites, and we don't ask for tracking permission on iOS because we don't need it.

8. Who we share with

We share your information only with the service providers we need to run FundBuddy, and only for that purpose:

We may also disclose information if the law requires it (for example, a court order), or to protect someone's safety. We'll tell you if we're allowed to.

9. Keeping and deleting data

• We keep your data for as long as your account exists, so your history is there when you need it.
• You can delete individual receipts, claims and participants at any time inside the app.
• Delete account (in the app's settings) permanently deletes your account and all data attached to it — budgets, claims, participants and receipt photos. This can't be undone. Encrypted backups are purged within 30 days.
• If you'd rather we do it, email support@fundbuddy.com.au from your account email and we'll delete everything within 7 days and confirm.
• Support emails are kept for up to 2 years so we can help with follow-ups, then deleted.

10. Your rights and choices

Under the APPs you can ask us to:

• Access the personal information we hold about you (most of it is already visible in the app);
• Correct anything that's wrong (you can edit almost everything yourself);
• Delete your data (see section 9);
• Export your data in a common format;
• Withdraw consent for receipt reading — simply don't tap "Read receipt".

We won't charge for these requests and we'll respond within 30 days. You can also use the app without giving us your real name — a display name is fine.

11. Security

We protect your data with encryption in transit (TLS) and at rest, row-level security so accounts can only reach their own records, private storage for photos, and access controls on our side. No system is perfectly secure, so if we ever discover a breach that is likely to cause you serious harm, we'll notify you and the OAIC as required by the Notifiable Data Breaches scheme.

12. Children and nominees

FundBuddy is designed for adults: NDIS participants, and parents, guardians and plan nominees managing a plan on someone's behalf. A parent or nominee may enter details about a child participant — that information is used only to show that participant's budget. We don't knowingly create accounts for anyone under 16 without a parent or guardian's consent. If you think a child has created an account, email us and we'll remove it.

13. Changes to this policy

We'll update this page if our practices change. When we do, we'll change the effective date at the top and, for anything significant, tell you in the app before it takes effect. Older versions are available on request.

14. Contact and complaints

Questions, requests or worries about privacy: email support@fundbuddy.com.au with "Privacy" in the subject line. We aim to respond within 2 business days and resolve anything within 30 days.

If you're not happy with how we've handled a complaint, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.