What we collect
Habi-Food is restricted to holders of a current Victorian wildlife rehabilitation permit. At registration you provide your correct permit number. In using the platform you enter your own operational records — animals in care, rescue and release records, browse runs and saved browse spots, release site assessments — along with your contact details and preferences. These are your records: how they are protected and what stays private is set out below.
Privacy & Data Handling
What is shared with the network: Anonymous, gridded rescue density (species, cause, approximate location) and anonymous release density (species, habitat type, approximate location). Individual care methods, treatment duration, outcomes, shelter throughput and any data that identifies individual carer practice are never shared.
What stays private: Your exact rescue and release coordinates, animal care records, permit number, contact details, and any personal information you enter remain private to you and accessible only by you and the Habi-Food administrator for platform operation purposes.
Sharing preferences: You control whether your shelter name appears on release records and whether you contribute to network density data. These toggles are available in My Shelter → Privacy & Sharing and are off by default.
Licensee organisations: Habi-Food licenses account-management access to wildlife rehabilitation organisations, councils and government agencies.
Data retention: Your data is retained for the duration of your access. Upon revocation you receive a 30-day window to export your records. After this window, your personal data is removed.
Third-party data: Habi-Food connects to government APIs (FFMVic, VicMap, EPA, Melbourne Urban Forest, iNaturalist). This data is governed by the terms of the relevant agency.
Data storage: Animal records and account data are stored in Google Firebase (asia-southeast1 region). Data is encrypted in transit and at rest.
Access Controls & Security
Your access code is single-use and bound to your licence number. It cannot be reused after initial activation.
You are responsible for keeping your device secure. Habi-Food stores your credentials locally on your device. If your device is lost or stolen, notify the Habi-Food administrator immediately to revoke access.
You must not attempt to access, modify or delete other users’ data. Attempts to do so will result in immediate revocation and may be referred to DEECA and relevant authorities.
Habi-Food implements gridding (location rounding) and aggregation to prevent identification of individual carers through pattern analysis.
Data & Security Statement
Where data lives. Habi-Food runs on Google Firebase (Realtime Database and Authentication) and Netlify. Your animal, browse and release records are stored against your own account; only anonymous, ~1 km-gridded rescue and release density (species, cause, month, LGA) is shared with the network.
Encryption of locations and contact details. Your shelter's exact location, street address, phone and email are stored only as an AES-256-GCM encrypted record whose key exists solely on the server. No browser, no administrator and no database console can read them. They are decrypted in server memory only to connect a specific request to the closest shelter, and only what you have chosen to show (suburb, LGA, a distance band or "Victoria") is ever returned to anyone.
Who can see what. Other shelters see your capabilities and capacity only if you opted in, at the precision you chose. Community members and organisations see only shelters that opted into community programs. Your contact details are released to a requester only when you say Yes to that request — once — after which the platform deletes its copy. External requesters' details are encrypted on receipt and deleted 14 days after their request is answered (72 hours for animal requests).
Routing. External requests are routed to the closest participating shelter by distance. This rule is fixed at jurisdiction level and cannot be altered by any user or administrator; the only exception is a register of verified specialist shelters maintained by the jurisdiction administrator, every change to which is logged.
Lawful requests. Where Habi-Food is compelled by a court order, warrant or notice to release information, it will release only the minimum required, scoped to the specific suburb or LGA, incident category and date range named in the order, decrypting nothing outside that scope. Every release is recorded in an immutable log. Affected users are notified of the release by default, unless the order itself legally prohibits notification — in which case that decision is also logged.
What we will never do. Sell or license personal data; compare shelters against each other; publish individual animal records; use location data for any purpose other than connecting a need to the closest shelter; or retain a requester's contact details beyond the retention period above.
Agreement records. Your agreement to the Privacy Policy, Conditions of Use and this Statement is recorded with a timestamp on your profile. You can re-read all three from About at any time.
Contact, access and complaints
Privacy questions, requests to access or correct your information, and complaints can be sent to the Habi-Food administrator (Carni Evans, Totally Untamed Wildlife Rescue & Rehabilitation) using the in-app Send to Admin form. If a privacy concern cannot be resolved with us, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.