DaDa is operated by DaDa Labs Pty Ltd (ACN 700 556 734) ("DaDa", "we", "us", "our"). DaDa is a mobile application through which Australian users aged 18 and over join topic-based communities, post content, and engage with local advertising and prize promotions.
This Privacy Policy explains how we handle your personal information. It applies to the DaDa app and our website at dadalabs.net.
We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Although DaDa's annual turnover may be at or below the small business threshold, we are not a small business operator for the purposes of the Privacy Act because we disclose personal information about individuals to other entities (including advertisers and service providers) for a benefit, service or advantage. This means the APPs apply to us in full, regardless of turnover.
We collect only what we need to run the app, keep it safe, and fund it through advertising.
Mobile phone number — an Australian mobile (+61 4xx), verified by SMS one-time code at sign-up. Your phone number is your login identity.
Date of birth — collected at sign-up to confirm you are 18 or over. We retain only your derived year of birth after verification; we do not retain your full date of birth.
Username and a unique @handle.
An optional short bio/intro.
You may add: gender, city, postcode, university, student type and expected graduation year, personality type, star sign, and preferred language. These are used to (a) match you to communities you are eligible for and (b) target the advertising you see. You choose, per field, whether each is visible to other users.
DaDa previously collected nationality/country of origin (and a Chinese province sub-field), which constitutes sensitive information under the Privacy Act (racial or ethnic origin). Those fields were removed from the app on 16 August 2026, and DaDa no longer collects that category. Of the profile attributes that remain optional (including gender with a non-binary option, preferred language, and any profile photo), none is currently treated by us as sensitive information within the meaning of the Privacy Act, and each is collected on the basis of this collection notice and your acceptance of our Terms. If our data model changes in a way that could bring a field within the sensitive information definition, we will update this Privacy Policy and seek your express consent before collecting it.
Posts and replies (text, images, audio, video, documents), poll votes, likes, bookmarks, and the communities you create or join. Other users can see the content you post in a community.
Reports you make or that are made about you — a report may be about a user or about a specific post — any evidence images attached to a report, moderation decisions, your trust/reward scores, and any suspensions or blocks. If a moderator removes one of your posts, we retain the original wording (text only; any attached pictures, audio, video or documents are deleted), hidden from other users, as a record of the moderation action. We keep this to run a safe service.
Which ads you were shown, opened, and answered; the community an answer was given in; prize vouchers you win; and redemption events. We use this to deliver ads and prizes and to report aggregate performance to advertisers.
An optional recovery email address (used only to reset your password), and the contents of any support or feedback message you send us (with your app version and device platform attached).
A "last seen" timestamp and an online-status setting you control; device/app version and crash diagnostics; and standard technical data needed to operate and secure the app.
We do not intentionally collect health information, biometric information, precise device location, or financial account numbers from users.
We collect information: directly from you (sign-up, profile, content, support); automatically as you use the app (usage, diagnostics, ad-engagement events); and from service providers who verify or deliver on our behalf (e.g. SMS/email delivery). We do not buy personal information about you from data brokers.
We use personal information to:
create and secure your account, and verify you are 18+ and eligible for a community;
operate the core service — communities, posting, messaging, polls, notifications;
keep the platform safe — moderation, reports, trust scoring, ban and abuse prevention;
select and deliver advertising relevant to your declared profile attributes, and run prize promotions;
provide support and send you service messages (e.g. security codes, password resets);
comply with our legal obligations and enforce our Terms.
We use your declared profile attributes to decide which ads to show you inside the app. We give advertisers aggregate campaign reporting (e.g. how many people saw or answered an ad). We do not give advertisers your identity, phone number, or individual profile. When you redeem a prize at a merchant, the merchant sees only what is needed to honour it (e.g. your winning voucher and the merchant's own name/logo on your screen).
We disclose personal information only as described in this policy. We do not sell your personal information.
| Provider | What they handle | Location |
|---|---|---|
| Supabase | Primary database, authentication, realtime | Sydney, Australia (ap-southeast-2) |
| Cloudflare R2 | Storage of post media, avatars, thumbnails, documents | Oceania (Cloudflare region hint "OC" — Australia/New Zealand) |
| Resend | Transactional email (password reset, student verification) | United States |
| Sentry | Crash/error diagnostics (with PII scrubbing) | European Union |
| Apple / Google | App distribution and push notifications | Global |
| Stripe | Merchant advertising payments (merchant data, not user data) | Australia |
We disclose personal information to service providers located in, or with access to information from, the United States (Resend, for transactional email) and the European Union (Sentry, for crash diagnostics, with personal information scrubbed before transmission where practicable). Push notification delivery through Apple and Google also involves transmission of push tokens and notification content through their global infrastructure, which may include locations outside Australia. Before making these disclosures, we take reasonable steps to ensure each recipient handles your information consistently with the APPs, including by entering into data processing terms that require appropriate security, use and confidentiality commitments, and by using additional contractual safeguards (such as standard contractual clauses) where a recipient is not otherwise subject to a comparable privacy law.
Our media storage provider, Cloudflare R2, is configured to the Oceania ("OC") region, meaning content is stored in Australia or New Zealand rather than the United States or European Union. Storage in New Zealand is still technically an overseas location for the purposes of Australian privacy law, although New Zealand has its own comparable privacy legislation. Because Cloudflare is a US-headquartered company whose support staff could potentially access data from outside Australia, we treat this storage arrangement as a cross-border disclosure for APP 8 purposes. We take reasonable steps accordingly, including data processing terms with Cloudflare that restrict access to authorised support purposes, require appropriate security measures, and prohibit onward transfer inconsistent with the APPs.
We may also disclose personal information: to comply with the law, a court order, or a lawful request from a regulator; to enforce our Terms or protect the safety, rights, or property of users, the public, or DaDa; and, if DaDa is involved in a merger, sale, or restructure, to the party involved (subject to this policy).
We take reasonable steps to protect personal information, including data residency in Australia for our primary database, access controls, encryption in transit, per-field visibility controls enforced server-side, and diagnostics scrubbing.
Retention. We keep personal information only as long as needed for the purposes above or as required by law. Specifically:
Post media and content may expire automatically over time under our content-retention rules (and community owners can set shorter retention).
Content removed by moderators — if we remove a post for breaching our rules, we keep the original wording privately (hidden from users) as an evidence record of the moderation decision. Any attached media (pictures, audio, video or documents) is deleted shortly after removal. We keep the wording record for no longer than the post itself would have been kept under our content-retention rules, and it is deleted with the post.
When you delete your account, we delete your profile and personal data, except:
Content pseudonymisation — posts and replies you made may be retained but re-attributed to "Former member" so conversations others took part in remain intact. Because the underlying post content, timestamps, and community context are retained, other users who interacted with you may in some cases still be able to work out who a "Former member" post came from; we treat this as pseudonymisation rather than full de-identification, and it is authorised by your acceptance of our Terms as a limited retention necessary to preserve the integrity of shared conversations.
Moderation/audit records may be retained in de-identified form to preserve an accurate safety record.
Ban-evasion prevention — if your account is deleted while under an active ban, we retain a one-way keyed hash of your phone number (not the number itself) so the same number cannot immediately re-register to evade the ban. Because this hash can be matched back to your phone number using the key we hold, we treat it as personal information. We retain it only until the ban would have expired, and in any event for no longer than 24 months from account deletion.
You can:
View and edit most of your profile information directly in the app.
Control visibility of each optional profile field.
Request access to the personal information we hold about you, or ask us to correct it, by contacting us (see section 11). We aim to respond within 30 days, as the Privacy Act requires a response within a reasonable period. We may decline an access or correction request in limited circumstances permitted by the Privacy Act (for example, where giving access would unreasonably impact another individual's privacy, or where a request is frivolous or vexatious); if we do, we will explain why in writing and tell you how to complain about the refusal. If we decline to correct information at your request, you may ask us to attach a statement noting your disagreement, which we will do wherever reasonably practicable.
Delete your account in the app (Account → Security and Privacy → Delete account). Deletion is immediate and irreversible, subject to the retention exceptions in section 6.
Turn off your online-status visibility.
We do not currently send marketing messages. Messages we send are service messages (e.g. security codes) or in-app/push notifications about activity on your account, such as ad or prize outcomes; these are not commercial electronic messages under the Spam Act 2003, which applies to messages sent to an email, instant messaging, or telephone account. If we ever introduce marketing communicated by email or SMS, it will be opt-in with a functional unsubscribe option, consistent with the Spam Act 2003 and Australian Privacy Principle 7.
DaDa is strictly for users aged 18 and over. We age-gate at sign-up and do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.
If a data breach occurs that is likely to result in serious harm, we will comply with the Notifiable Data Breaches (NDB) scheme — assessing the breach, notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.
We may update this policy. If we make a material change, we will take reasonable steps to notify you (e.g. in-app notice). The "last updated" date shows the current version.
Questions, access/correction requests, or privacy complaints:
DaDa Labs Pty Ltd — Melbourne, Victoria
Email: privacy@dadalabs.net
We will acknowledge your complaint promptly and aim to investigate and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.