← Back to Troupe
troupe
Privacy Policy
Effective 3 August 2026 · Last updated 3 August 2026 · Version 1.1
This is the Privacy Policy for Troupe, a mobile app and website that helps people find someone to play sport with locally. This policy explains what personal information we collect, why we collect it, who we share it with, and what rights you have.
We wrote this in plain English on purpose. If anything is unclear, email us at lucas@troupeapp.com.au.
1. Who we are
Troupe is operated by Lucas Bru, a sole trader based in Fairlight, New South Wales, Australia.
- Business name: Troupe (ASIC business name registered under Lucas Bru)
- ABN: 62 332 540 560
- Contact: lucas@troupeapp.com.au
- Privacy officer: Lucas Bru (same contact as above)
- Postal address: Available on request via email
As a sole trader with turnover below A$3 million, we are technically exempt from the Privacy Act 1988 under the "small business operator" exemption (ss 6C-6D). We have chosen to voluntarily comply with the Australian Privacy Principles (APPs) anyway, because we believe your personal information deserves the same protection whether we're legally required to provide it or not. If we grow beyond the exemption threshold, or if we opt in formally under s 6EA, we will update this policy.
2. What this policy covers
This policy covers personal information we collect through:
- The Troupe mobile app (iOS and Android)
- The Troupe website (troupeapp.com.au)
- Our email and other direct correspondence with you
- Community events we run in person (launch events, Trouper Sundays, etc.)
3. What information we collect
3.1 Information you give us directly
When you join the waitlist (website):
- Email address
- Optionally, your first name
When you create an account (app):
- Email address
- Password (stored as a one-way hash, we never see it in plain text)
- First name
- Date of birth (used only to verify you're 18 or older and to display your age range)
- Gender identity
- Nationality (optional, opt-in only. May reveal ethnic origin, which is treated as sensitive information under APP 3.3, so we only collect it if you actively provide it.)
- Short bio (optional)
- Profile photo
When you set up your Troupe profile:
- Which sports you play (tennis, padel, basketball, run, ride, hyrox, etc.)
- Your skill level per sport
- Your suburb (Manly, Fairlight, Freshwater, etc.)
- When you're typically available to play
- Your court, park, or beach preferences (optional)
When you use the app:
- Messages you send to other Troupers
- "Keens" (requests to play) you send and receive
- Reports you file about other users
- Users you block
- Feedback or support requests you send us
3.2 Information we collect automatically
When you use the app:
- Approximate location (city / suburb) to show you nearby players. We do NOT continuously track your GPS.
- Device information (device model, operating system version, app version, language settings)
- App usage data (which screens you visit, how often you open the app, features you use), collected via Firebase Analytics
- Crash reports and performance data (device model, OS version, app version, stack trace, IP address at the time of the crash), collected via Firebase Crashlytics and Sentry. These are pseudonymised (linked to a random device ID, not your name or email) but are not fully anonymous.
- Push notification tokens (issued by Apple Push Notification Service or Firebase Cloud Messaging, sent from Expo servers) so we can send you notifications about keens received, messages, and account activity
- Approximate IP address (used to detect fraud and abuse only)
When you visit our website:
- Basic web analytics (page views, referring URL, browser type, rough country/state), collected via Netlify's built-in analytics
- No third-party advertising cookies. No cross-site tracking.
3.3 Information from third parties
We currently do not collect information about you from third parties, other than what you choose to share with us (for example, photos you upload from your camera roll).
4. Why we collect this information
We collect personal information for the following purposes (aligned with APP 3, purpose of collection):
| Purpose | Notes |
|---|
| To operate the core Troupe service (matching, messaging, showing profiles) | Primary purpose. Without this we cannot provide the service. |
| To check you are 18 or older | We check your date of birth at signup. We do not formally verify identity. |
| To keep the community safe (moderation, blocking, banning, responding to reports) | We may use your data to investigate reports made about you or by you. |
| To improve the app (analytics, crash reports) | Usage patterns help us fix bugs and prioritise features. |
| To communicate with you about your account | Transactional emails you cannot opt out of while you have an account. |
| To send occasional marketing emails about Troupe features or events | Only with your opt-in consent. You can withdraw at any time via the unsubscribe link in every email. |
| To comply with our legal obligations (tax, court orders) | We only disclose when legally compelled. |
We do NOT use your personal information for:
- Selling to advertisers, data brokers, or third parties
- Cross-app or cross-site behavioural advertising
- Automated decision-making with legal effects on you
- Any purpose outside what is described in this policy
5. Who we share your information with
Third-party infrastructure providers:
- Google (Firebase) — user database, authentication, file storage, analytics, crash reporting. Located in the United States.
- Netlify — hosts our marketing website and processes waitlist forms.
- Google Workspace — hosts our email and calendar.
- Sentry — pseudonymised app crash reports and performance data. To opt out, email lucas@troupeapp.com.au and we'll disable crash reporting for your account.
- Expo (EAS + Expo Push) — provides over-the-air app updates, build services, and delivers push notifications from us to your device via APNs (Apple) or FCM (Google).
- SendGrid — sends transactional emails (verification, password reset).
These providers are contractually required to use your information only to provide services to us and to keep it secure.
Australian law enforcement or regulators: only when legally compelled (subpoena, court order, or lawful direction from OAIC or AFP).
Other users of Troupe:
- Your profile (first name, age range, gender, sports, skill level, suburb, photo, bio) is visible to other Troupe users.
- Your date of birth is NEVER shown to other users, only the age it produces.
- Your email, password, and personal contact info are NEVER shown to other users.
- Messages you send to another Trouper are visible to that person.
In the event of a business sale or restructure: personal information may transfer to the new operator, subject to this policy. We would notify you before this happens.
We never sell your personal information. Full stop.
6. Where your information is stored (overseas disclosure)
Troupe uses Google Firebase for our backend. Firebase servers are located in the United States. This means your personal information is stored on servers outside Australia.
Under Australian Privacy Principle 8 (APP 8), we take reasonable steps to ensure your information is protected to Australian standards wherever it is stored:
- Google is bound by data processing terms requiring it to safeguard your data and use it only to provide services to us
- Google Cloud is certified against major international standards (ISO 27001, SOC 2, etc.)
- We remain accountable to you under Australian privacy law for any information we send overseas
Overseas storage carries some inherent risk (for example, US law enforcement can compel disclosure under US law). If you are uncomfortable with this, please do not create a Troupe account. If you have an account, you can delete it at any time (see Section 9).
7. How long we keep your information
- Active account: while your account is active.
- Deleted account: we delete your profile, photo, messages, and other personal data within 7 days of your deletion request.
- Retention exceptions:
- Tax and business records: kept for 5 years (ATO requirement)
- Blocked accounts: minimal record retained to prevent re-registration
- Messages you sent to other users: stored in the recipient's chat history until they delete it
- Data subject to a legal hold: retained until the hold is lifted
8. How we keep your information secure
- Encryption in transit — all communication uses HTTPS (TLS)
- Encryption at rest — Firebase encrypts data at rest by default
- Firebase Security Rules — server-side rules restricting access
- Password hashing — passwords never stored in plain text
- Access control — only Lucas Bru has administrative access to Troupe user data
- No third-party access — no partner, contractor, or vendor has administrative access
- Ongoing monitoring — Firebase Crashlytics and Sentry detect anomalies
If a data breach occurs that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme (Privacy Act 1988, Part IIIC).
9. Your rights and choices
9.1 Access your personal information
Ask us for a copy of the personal information we hold about you. We will respond within 30 days.
- In the app: Me → Settings → Export My Data (delivers a JSON copy by email)
- By email: lucas@troupeapp.com.au
9.2 Correct your personal information
- In the app: Me → Edit Profile
- By email: lucas@troupeapp.com.au for fields that are not user-editable
9.3 Delete your account and personal information
9.4 Withdraw consent to marketing
We only send marketing emails to people who have opted in (never pre-ticked, never bundled with signup). You can unsubscribe from marketing emails at any time using the unsubscribe link in every email, or by emailing lucas@troupeapp.com.au. Every marketing email includes our sender identification (Troupe / Lucas Bru / ABN 62 332 540 560) and a functional unsubscribe link, as required by the Spam Act 2003. Transactional emails cannot be unsubscribed while you have an active account.
9.5 Opt out of analytics
Email lucas@troupeapp.com.au and we'll disable Firebase Analytics tracking for your account. You can also disable app-level analytics system-wide via your iOS or Android device settings (Settings → Privacy → Analytics).
9.6 Ask to remain anonymous or use a pseudonym
Under Australian Privacy Principle 2, you have the right to interact with us anonymously or under a pseudonym where practicable. For the Troupe app specifically, this is not practicable, we need at least your real first name and date of birth to run a safe community.
9.7 Complain about how we've handled your information
See Section 12.
10. Children under 18
Troupe is for adults 18 and over. We do not knowingly collect personal information from anyone under 18.
- Our signup flow requires a date of birth and blocks anyone under 18
- Our Terms of Service prohibit users under 18
- If we discover a user is under 18, we delete their account immediately (typically within 24 hours of the report reaching us)
If you are a parent or guardian and believe your child under 18 has created a Troupe account, please contact us at lucas@troupeapp.com.au and we will delete the account within 7 days.
11. Cookies and similar technologies
Website (troupeapp.com.au): We use essential cookies to make the website work. We do not use tracking, advertising, or analytics cookies.
Mobile app: The app does not use cookies. It uses Firebase Analytics identifiers (local device identifiers you can reset in your phone's settings) and Firebase Auth tokens (needed to keep you logged in).
12. Complaints
If you believe we have breached your privacy or the Australian Privacy Principles, please contact us first at lucas@troupeapp.com.au. We take complaints seriously and will investigate and respond within 30 days.
If you are unsatisfied with our response, you can escalate to the Office of the Australian Information Commissioner (OAIC):
13. Changes to this policy
We may update this policy from time to time to reflect changes in our services, technology, or Australian law. When we make material changes we will:
- Update the "Last updated" date at the top of this page
- Notify you by email (for account holders) at least 14 days before the change takes effect
- Post a notice in the app for material changes
Your continued use of Troupe after a change takes effect means you accept the updated policy.
Version history:
- Version 1.0 — 3 August 2026 — initial policy
- Version 1.1 — 3 August 2026 — corrections after critical review (APP entity claim, APP 8 wording, Sentry / push notification disclosure, nationality sensitivity flag, GDPR language removed)
14. Contact us
This policy is drafted in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Notifiable Data Breaches scheme, the Spam Act 2003, and the requirements of the Apple App Store and Google Play Store.