Privacy Policy

Cactive Pty Ltd (ABN 61 667 172 394) provides the Cactive apps and services: the apps on the web, our iPhone and Android apps, Cactive Browser, our API, MCP server and command-line tools, and this website. In this policy, “Cactive”, “we”, “us” and “our” mean Cactive Pty Ltd.

This policy explains what personal information we collect, why, who we share it with, where we store it, how long we keep it, and how you can see, correct or delete it. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Personal information is information or an opinion about you, where you are identified or can reasonably be identified. The Privacy Collection Notice is the short version, for when you create an account or start using an app.

With a personal account, we decide how your information is handled, as this policy describes.

If you use Cactive through an organisation, such as your employer, the organisation manages its workspace and decides what happens to the information in it. We handle that information on the organisation’s behalf, to provide the service to it, and its own privacy policy applies too. Ask the organisation first about information in its workspace.

An organisation’s owners and administrators can:

• see and export its member list: names, email addresses, roles, titles, departments, groups and sign-in status
• see every browser session your account is signed in on, including ones you use outside the organisation, with each session’s IP address and approximate location
• read the organisation’s audit log, which records what members do there and every sign-in to your account, successful or not, with IP address and browser
• block you, sign you out, change your role, remove you (they can restore you for 30 days), and export the organisation’s data, including its mail and files

What we collect depends on the apps and features you use.

Your account

• your name, email address and date of birth, when you create your account
• your password, stored only as a one-way hash we can’t reverse, or your passkey’s public key
• phone numbers you add, for sign-in codes and texts
• your two-step sign-in settings: an authenticator app’s secret (encrypted) and backup codes (hashed)
• your profile: display name, username, photo, banner, colours, About Me and language. Your profile photo can be seen by anyone who has its link.
• for each browser session and sign-in: the IP address, browser, operating system, device type, and the country, region and city worked out from the IP address
• for each phone you sign in on or approve sign-ins with: its name, model, operating system, app version and time zone
• if you use your Cactive account to sign in to another company’s app, the details you agree to share with that app (your name and email address)

Your age

We ask for your date of birth when you create an account. Apps get only what it means, such as whether you’re 16 or over, never the date. You can set it once; after that, our support team corrects it if you show it’s wrong. For Mirage’s social features we may also ask for a face check that estimates your age (see Children and young people).

What you store and share

Whatever you put in the apps is personal information when it’s about you or someone else: email, calendar events, contacts, files, photos and videos, notes, tasks, documents, spreadsheets, presentations, recipes, meal plans, receipts you send to Food, saved places, customer records, code repositories, messages, posts, voice messages and your conversations with Caity.

• Photos and files keep their metadata, such as where and when a photo was taken. Photos’ shared albums leave out locations unless you include them, and people who open a Drive file through a link get a copy without its metadata.
• Mail scans incoming mail for spam and viruses, and looks up roughly where each message was sent from, using the IP addresses in its headers. Images in incoming mail stay blocked until you allow them. Mail doesn’t track whether people open the mail you send.
• Git and Cloud keep the names and email addresses of commit authors, and build logs for 90 days. Cloud counts visits to the sites you host from request logs without visitors’ IP addresses or browsers.

Health

• On iPhone, Health reads the Apple Health data you turn on, such as activity, body measurements, heart, sleep, vitals, cycle tracking, symptoms, medications and mood, including in the background. Sensitive categories start off. It saves entries you add, and meals Food logs for you, back to Apple Health.
• Health information is sensitive information. We collect it only with your consent. Withdrawing consent in Health stops collection and sharing at once; deleting what’s stored is a separate step, Delete everything.
• Your individual readings are encrypted with a key of your own; daily totals aren’t.
• Only you can see your Health data unless you share it: with people or servers in Mirage, with apps or keys you connect, or with Caity once you allow it. Caity gets daily summaries, and never sexual activity.
• We don’t use Health data for advertising, sell it, or store it in iCloud.

Location

• Our phone apps never ask for your location in the background (“Always”).
• Maps shows where you are on the map; that stays on your phone.
• Weather’s My Location and Home’s widgets send your location to us rounded to about 100 metres, to find the weather and aircraft near you. We don’t keep a history of where you’ve been.
• Places you save in Maps and Weather are kept with your account.

Calls, texts and voice

• If you turn on Caity by phone, you can call or text Caity from a number you’ve verified. Calls go through Amazon Connect and Caity listens and speaks with Amazon Nova Sonic; texts go through Amazon’s messaging service. We keep a transcript of each conversation for 7, 30 or 90 days (your choice; 30 by default). By default a summary and the transcript are also saved to Notes, where they stay until you delete them; you can choose Tasks instead, or neither.
• Mirage’s voice and video channels run on Amazon Chime SDK. We don’t record them. Voice messages are stored like other attachments.
• We text only numbers whose owners have agreed to receive our texts. Reply STOP to stop them.

Devices and notifications

• To send notifications to your phone, we keep a push token for it and send each notification through Expo’s push service, which passes it to Apple or Google. A notification can include part of what it’s about, such as a Mirage mention (up to 280 characters) or a post. A Mirage direct message notification shows only who sent it, unless the iPhone app decrypts the message on your phone.
• Home’s widgets read your phone’s calendars, reminders, and today’s steps and distance, to show them on your phone.

Payments

Card details go into Stripe’s form and to Stripe, not to us. We keep your Stripe customer and subscription identifiers, your card’s brand, last four digits and expiry date, your billing name, email address and address, your ABN or tax number if you give one, and your invoices.

Our website and logs

• cactive.com.au sets no cookies and runs no analytics or advertising scripts. Your browser remembers that you closed an announcement, and carries a link’s campaign tags (utm tags and LinkedIn’s click identifier) to the sign-up page; we don’t store them.
• Our delivery network logs each request to the website and the apps: the time, address, status, country and edge location, without your IP address or browser. We keep these logs for 90 days and use them for traffic totals.
• Our servers keep operational logs for up to 3 months, to run the service and fix problems.

Cookies

The apps use their own cookies to keep you signed in (an access token for 15 minutes and a refresh token for 30 days), to remember which account you’re using, and to remember preferences such as your theme, organisation, language and recent apps, for a year. None are for advertising or analytics. The payments page shows Stripe’s card form, which may set Stripe’s own cookies to prevent fraud.

Feedback and support

Feedback you send from an app includes what you write, any screenshot you attach (you can blur parts of it first), and details of the app, browser, page and recent errors; your email address only if you agree. It never includes cookies, sign-in tokens or what you’ve typed into forms. When you contact us, we use what you send to answer you.

Information about other people, and from them

• You may give us information about other people: contacts, customer records, email recipients, calendar guests, people in your photos. Make sure you’re allowed to.
• We receive information about you from others: people who email you or share with you, your organisation, Discord if a Mirage server is connected to it, and Last.fm if you connect it to show what you’re listening to. You can also bring in files from other services, such as a Google Takeout of your photos.
• If we receive personal information we didn’t ask for and couldn’t have collected, we destroy or de-identify it where it’s lawful and reasonable to do so.

You can read this website and our documentation without telling us who you are. An account needs a name, an email address and a date of birth, and paying needs a billing name and address. In Mirage and on your profile you can use a username and display name of your choice.

• to provide the apps and features you use, on all your devices, and share with the people you choose
• to create and protect your account: check your email address, sign you in, show you where you’re signed in, and warn you about new sign-ins
• to apply age rules, for Mirage’s social features and some Health categories
• to bill you and keep financial records
• to send service messages: sign-in codes, security alerts, notices about your account and subscription, and the notifications you set up
• to rank Mirage’s Feed, using what you’ve engaged with in the last 60 days
• to answer support requests and feedback, and fix problems
• to deal with reports and abuse, enforce our Terms of Use and keep people safe
• to count traffic, from logs that don’t identify you
• to meet our legal obligations

We don’t sell personal information, use it for advertising, or give it to advertisers or data brokers. We use it for another purpose only with your consent or where the law allows, such as a related purpose you’d reasonably expect, or to lessen a serious threat to someone’s life, health or safety. We don’t use government identifiers, such as a tax file number, to identify you.

• Caity, our assistant, and the AI help in Documents, Sheets, Slides, Video and Food use models made by Anthropic (Claude), Amazon (Nova) and OpenAI (gpt-oss), run by Amazon Web Services in Amazon Bedrock. Your content goes to AWS, not to the companies that make the models.
• Caity receives what you ask, your name, email address and organisations, and what it reads to answer from the apps it can use for you. It can’t use Photos, Health or Mirage until you allow it. In a Mirage channel, Caity reads the channel’s recent messages when someone asks it something; never direct messages.
• If your organisation connects Caity to another company’s service, the requests Caity makes there for you go to that company.
• Your conversations with Caity are kept until you delete them.
• Food reads photos of recipes and pantry shelves with Claude, then deletes the photos. Video makes captions with Amazon Transcribe, then deletes the audio it sent.
• We don’t use your content to train AI models. Under AWS’s terms, Amazon Bedrock doesn’t use prompts or responses to train models or share them with the companies that make the models.

• Messages in servers and channels are stored so their members can read and search them. Direct messages are end-to-end encrypted: we store them encrypted and can’t read them, but we can see who messages whom, when, and the size of files. On the web, our servers fetch previews of links you send.
• Your social profile can be seen by signed-in people aged 16 or over unless you make it followers-only or private. A community server’s public page shows its name, banner, description and member count to anyone.
• Members of your servers, your friends and the people you message see your profile and whether you’re online, unless you’ve blocked them. How far you’ve read goes only to your own devices.
• Server moderators see reports about their server without who sent them; our staff see every report and who sent it. Reporting a direct message sends us the reported messages, decrypted. We keep reports and a copy of what was reported.
• Bots a server’s managers add receive messages that mention them and news of members joining, and can read channel history and the member list within the permissions they’re given; never direct messages.
• If a server is connected to a Discord server, messages, edits, reactions and files in its connected channels go to Discord under your name and profile photo, and messages from Discord come in under the sender’s Discord name and picture. If you link your Discord account, we keep its identifier, names and picture.
• GIF searches go to our GIF provider (GIPHY or KLIPY) with an identifier that isn’t your account’s.
• Deleting a channel message deletes it and editing one replaces it; a post keeps its edit history until you delete it. Deleting a channel message or a post doesn’t delete files attached to it; ask us and we will. Stories move to your archive after 24 hours.

• people you choose: those you share with, message, invite or call, members of your servers, and anyone with a link you make
• your organisation, for accounts and workspaces it manages (see Personal and organisation accounts)
• service providers that run parts of the service for us (below)
• others where the law requires or allows it, such as a court order or a request we must answer, or to lessen a serious threat to someone’s life, health or safety

Our service providers

• Amazon Web Services: hosting, storage and databases, email (Amazon SES), texts, calls (Amazon Connect), AI (Amazon Bedrock, Amazon Transcribe), age checks (Amazon Rekognition) and voice and video (Amazon Chime SDK)
• Stripe: payments
• Expo, Apple and Google: notifications to your phone
• Mapbox: map search text and the map’s position, and the location of photos in Photos, to name places
• Apple Maps on iPhone and Google Maps on Android: the maps in our phone apps
• Discord: connected Mirage servers (see Mirage)
• GIPHY or KLIPY: GIF searches
• Last.fm: your Last.fm username, if you connect it to Mirage
• Open-Meteo: locations rounded to about a kilometre and place searches for Weather, without your identity
• Open Food Facts: barcodes you scan in Food
• Have I Been Pwned: if you turn on Watchtower in Passwords, the first five characters of a password’s hash, sent from your phone

Our domain names are managed with Cloudflare; your traffic doesn’t pass through it. Maps’ flight and emergency information comes from public feeds; the areas people look at are added to our flight data requests without identifying anyone.

We’re moving our storage to Australia, in Amazon Web Services’ Sydney region, and the move isn’t finished. For now, your information is also stored or handled in these countries:

• The United States: a full copy of our databases, our backups, the keys that encrypt stored data, email sending and receiving, request logs and some older file storage, in Northern California; Mirage voice and video setup, Caity by phone, face age checks and some AI requests, in Oregon; request logs on their way to storage, in Northern Virginia.
• Australia or the United States: other AI requests to Amazon Bedrock, including Caity’s, depending on where we run them.
• Around the world: Amazon CloudFront serves the apps from the location nearest you, and our service providers above handle what they receive where they operate. Stripe, Expo, Apple, Google, Mapbox, Discord and GIPHY are based in the United States.

We remain accountable under the Privacy Act for how our service providers handle the personal information we give them.

We send service messages while you have an account: sign-in codes, security alerts and billing notices. You choose other notifications in each app’s settings, and every email has a link to manage them.

We send marketing only if you’ve agreed to receive it, and each message has a way to unsubscribe; we act on an unsubscribe within five business days. We don’t use or disclose your information for other companies’ marketing.

• Mirage’s social features (profiles, follows, posts, feeds, stories, reels, Explore, group feeds, pages and live) aren’t open to anyone we know to be under 16, in line with Australia’s social media minimum age rules. Mirage’s chat, direct messages and voice stay open.
• We go by your date of birth and, where we need more certainty, a face check: you take a short live video selfie in your browser and Amazon Rekognition estimates your age, in Amazon Web Services’ Oregon region in the United States. We keep the outcome (16 or over, or under 16, and whether you’re 18 or over), how it was checked, the provider and when; never the image or video. You can try three times a day, and an under-16 result stands for a year before you can check again.
• Some Health categories, such as sexual activity, are for adults only.
• If you’re a parent or guardian and think your child has given us information they shouldn’t have, contact us.

• Information travels encrypted (TLS 1.2 or later) and is encrypted where it’s stored, with keys held in AWS Key Management Service. Drive files, Health readings and stored secrets also have keys of their own, per space, organisation or person.
• Passwords (in the Authenticator) and Mirage direct messages are end-to-end encrypted, and Authenticator backups are encrypted on your phone with your passphrase: we can’t read them, and can’t recover them if you lose your keys.
• Everything else is encrypted where it’s stored, but our systems can decrypt it to provide the service, so it isn’t protected from us in the way end-to-end encrypted data is.
• Account passwords are stored only as hashes; you can use passkeys, two-step sign-in and sign-in approvals on your phone, and see where you’re signed in.
• Access to our Amazon Web Services accounts needs multi-factor authentication, and changes in the apps are recorded in audit logs.

If we have a data breach that’s likely to cause serious harm, we’ll contain and assess it and notify you and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires. If you think someone else has got into your account, change your password, sign out your other sessions, and tell us.

Most information stays until you delete it, or your account or organisation is deleted. Some goes sooner:

• an unfinished sign-up: 15 minutes
• sign-in history: 90 days
• an organisation’s audit log: 90 days to 3 years, depending on its plan; a Mirage server’s audit log: 45 days
• notices: 90 days; the record of notifications we’ve delivered: 30 days
• Mirage notifications: 90 days; what Feed ranks by: 60 days
• Caity by phone transcripts: 7, 30 or 90 days, as you choose; texts with Caity: 1 day
• delivery and server logs: 90 days and 3 months
• items in Trash in Drive, Photos and Mail: 30 days

When an organisation’s subscription ends, access stops at once and its data is kept for 90 days, unless we say otherwise in the app and by email, so it can be exported or the subscription restarted. After that we delete it. An organisation’s owners can delete it once it’s empty, and its members, teams, invites and keys go with it.

Deleted information stays in our backups until they expire: daily backups after 35 days, monthly ones after a year. Records the law requires us to keep, such as tax invoices, we keep for as long as it requires.

You can delete much of what you store yourself: conversations with Caity, files and photos (through Trash), mail, messages and posts, all your Health data (Delete everything) and Food data (Delete all my Food data), and your Passwords and Authenticator backup.

You can’t yet delete your whole account yourself; we’re adding that to your account settings and the phone apps. Until then, to close your account and have your personal information deleted, email support@cactive.com.au from your account’s email address. We’ll check it’s you, tell you what we’ll delete and what the law requires us to keep, and confirm when it’s done. If an organisation manages your account, ask its administrators to remove you; the organisation decides what happens to what you created in its workspace.

You can see and update most of your information in the apps: your profile, phone numbers, sessions and sign-in history in your account, and your Health and Food data, which those apps can export. An organisation’s owners can export its data.

To ask for a copy of the personal information we hold about you, or to have it corrected, email legal@cactive.com.au. We’ll check it’s you and respond within 30 days, at no charge. If we refuse, we’ll tell you why in writing and how to complain. If we don’t make a correction you ask for, you can ask us to keep a statement with the information saying you believe it’s wrong.

Our iPhone and Android apps ask for a permission only when you use a feature that needs it, and you can change your answer in your phone’s settings:

• camera: to scan QR codes, take photos and videos to upload or attach (recipes, pantries, issues, stories), and for Mirage calls
• microphone: Mirage calls and voice messages, and sound in videos you record
• photo library: to pick photos, and for Photos’ backup if you turn it on
• location, while you use the app: Maps, Weather and Home’s widgets
• calendars and reminders: Home’s widgets, and Food’s shopping list
• Apple Health: Health, and Home’s activity widget
• Face ID: to unlock the Authenticator
• notifications

The apps contain no advertising or analytics from other companies and don’t track you across other companies’ apps or websites. This policy covers what they collect, why, who receives it, how long we keep it and how to delete it.

Your history, bookmarks and site permissions stay on your Mac. Cactive Browser checks our download server for updates, downloads lists of ads and trackers to block from Ghostery each day, and sends what you search for to the search engine you choose (Google unless you change it). It sends us feedback only when you send it from the Help menu.

Where the EU or UK General Data Protection Regulation applies, we handle your information to provide the service you’ve asked for, with your consent (Health, face age checks and features you turn on), for our legitimate interests in keeping the service secure and free of abuse, and to meet legal obligations. You can ask us to give you, correct or delete your information, to restrict or stop handling it, or for a copy to move to another service, and you can withdraw consent at any time. You can also complain to your local data protection authority.

If you’re concerned about how we’ve handled your personal information, email legal@cactive.com.au with what happened and what you’d like us to do. We’ll respond within 30 days.

If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We publish each change here with the date it takes effect, and keep earlier versions at cactive.com.au/privacy/archive. We update this policy before we launch a feature that collects a new kind of personal information. If a change significantly affects information we already hold, we’ll tell you in the apps or by email before it takes effect.

• Privacy questions, requests and complaints: our privacy officer, legal@cactive.com.au
• Your account and support: support@cactive.com.au

Cactive Pty Ltd, ABN 61 667 172 394.