Privacy Policy

Who we are

tall poppies (“we”, “us”) is a social app for Australian high school students to publicly share daily progress toward a personal goal. This policy explains what we collect, why, and what control you have over it.

Who can use tall poppies

tall poppies is intended for students aged 16 and over with a valid @education.nsw.gov.au email address. We verify your email domain and a one-time code before your account is created, this confirms you control that email address.

What we collect

• Account info: your school email, name, username, school, graduation year, and a password (stored as a salted hash, never in plain text).
• Optional info: an Instagram and/or Discord handle, if you choose to add one.
• Your post: one photo, a short description, and the goal it relates to. Posting again replaces your previous post, we don’t keep a history of past posts, images, or captions beyond your current one.
• Activity: likes, comments, group memberships, and streak counts, so the app can function as a social feed.
• What we deliberately don’t collect: your exact address, phone number, or location/GPS data. Photos are compressed on your device before upload, which also strips most embedded metadata (like GPS tags your phone may otherwise attach to a photo).

Who your posts are visible to

Content in tall poppies is visible to other signed-in, verified students within the app, not the public internet. There’s no way to view a post without a verified account. Your school-mode feed is visible to students who share your school; groups are visible to that group’s members.

Who we share data with

We use a small number of service providers to run the app. None of them can use your data for their own purposes:

• Supabase - hosts our database and handles account authentication.
• Cloudflare - stores and delivers your post photo.
• Resend - delivers the one-time verification/login code to your school email.
• Vercel - hosts the app itself.

We don’t sell your data, and we don’t show ads.

How long we keep things

Your current post replaces the previous one, we don’t retain a rolling history of everything you’ve ever posted. Comments and likes persist as part of the ongoing conversation around a post. If you delete your account, we delete your profile, your current post and its image, your comments, and your group memberships.

Your rights

You can access, correct, or delete your account information at any time from your profile settings, or by contacting us at the support page. You can also ask us what data we hold about you.

Changes to this policy

We may change this policy as needed, for example to comply with new laws or regulations. It will be visible at tallpoppies.app/privacy

Contact

Questions about this policy or your data: tall poppies Support.