Privacy

What we collect

When you are invited and sign in, we store your email address, your name, and the association and club you belong to. You can add a phone number; you don't have to.

When you ask a question, we store the question, the answer, which documents were used to answer it, and the grade, format and club you had selected. We also store what the answer cost us to produce.

Whose data it is

Your association owns everything in Bylaw and Order that belongs to it: its rule documents, its rulings, its review findings and the questions its members ask. We hold that data on the association's behalf. We claim no ownership of it, we do not use one association's documents or questions to answer another's, and we do not train models on it.

Your own account details — your name, your email address and a phone number if you added one — are yours. You can change them on your account page at any time.

Why

Your questions and answers are stored so you can find them again, so your association can act on anything you escalate, and so we can see what the service costs to run.

Who can see it

You can see your own questions and answers. Administrators at your association can see questions you escalate to them, and the rulings they issue in response. System administrators can see the full query log, including questions and answers, because they are responsible for the cost and correctness of the service. Nobody else has access.

We do not sell your data, and we do not use it for advertising.

Where it goes

To answer a question, the text of your question and the rule documents in force for your organisation are sent to Google's Gemini model through Lovable's AI gateway. Your name and email address are not sent with it.

Your data is stored with Supabase in Singapore. Sign-in links and notification emails are sent through Lovable's email service. We use no other third parties, and we do not transfer your data to anyone else.

How access is controlled

You sign in with a link sent to your inbox. There is no password to guess or reuse, and the link expires. What you can see is set by your role, your club and your association, and that separation is enforced in the database itself, not only in the app.

An administrator can revoke any member's access from the Users page and it takes effect immediately. Role grants and revocations, invitation acceptances, changes to your own account details, data exports and research decisions are all recorded in the activity trail your administrators can read.

How long we keep it

While your association's account is active. Revoking someone's access removes their access; it does not by itself delete their questions. If you ask us to delete your account, we delete your profile and your questions and answers within 30 days and confirm when it is done. If an association leaves Bylaw and Order, we delete its documents, findings, questions and member accounts within 30 days of the request, and confirm in writing.

One exception, so you know before you escalate: if you escalate a question and your association publishes a ruling on it, that ruling stays. Rulings are your association's governance records, not ours to delete, and they are kept without your name attached.

Research use

We take part in research on how community sport's rules get used and where they break. An association can choose to include its de-identified question history and review findings in that work. It is the association's decision, made by its administrators, recorded with who made it and when, and it can be withdrawn at any time from the association's data and consent page. Your name and email address are never part of what is shared. While an association is taking part, a note on the Ask page says so.

If something goes wrong

If we become aware that your data has been seen by someone who should not have had it, we will tell your association administrator within 72 hours of confirming it, say what was affected and say what we have done about it. Where the Privacy Act requires it, we notify the OAIC as well.

Enquiries from our website

If you send us a message through the contact form on our website, we store your name, organisation, sport, email address and message, and email it to our team so we can reply. We use those details only to answer your enquiry.

Getting your data deleted, corrected or exported

Ask your association administrator, or email privacy@bylawandorder.app. Corrections to your own details you can make yourself on your account page. Deletion is done within 30 days and we confirm when it is done.

An association administrator can export the association's documents, rulings, review findings and question log as spreadsheets or JSON from the data and consent page, whenever they like.