ForwardPlate
Privacy policy
Plain English, because you deserve to understand it. Last updated September 2026.
Who we are
ForwardPlate is a small, independent pay-it-forward plate service piloting in New South Wales. We collect as little as we can and we don't sell or share personal information for marketing. Questions or requests: [email protected].
What we collect, and why
If you donate
You pay through PayPal. We record the amount, the time, and PayPal's payment reference so we can reconcile the fund. We don't ask for your name or email and we don't store the details PayPal shows about you. PayPal's own handling of your data is covered by PayPal's privacy statement.
If you find a plate
No account, no name, no ID. To keep the fund fair we store a random identifier in a cookie on your device, a scrambled (hashed) form of your internet address, and the time, venue and plate for each redemption. That lets us apply gentle limits (like one plate at a time per device) and lets venues be paid correctly. We can't identify you from it.
If you tap "Use my location", your browser asks your permission and sends your approximate position to us for that one search, so we can list venues near you. We don't store it.
If you run a venue
We collect the business details you give us at sign-up (venue name, address, ABN, contact name, email, phone and where to send payouts) and a record of the plates served, so we can pay you. This is used only to run the service.
Everyone
Like every website, our server keeps short-lived technical logs (internet address, pages requested, browser type) used for security and to fix problems.
Cookies
We use a small number of first-party cookies: one for security (to stop forged requests), the device identifier described above, and a session cookie for venue and admin logins. There are no advertising or tracking cookies.
Service providers
We use a small number of trusted service providers for payment processing, hosting, security and email delivery. They handle information only to provide those services to us, never for their own marketing.
How long we keep it
Donation and redemption records form the fund's financial ledger and are kept for seven years, as Australian record-keeping rules require. Technical logs are kept for a few weeks. Venue accounts are kept while the venue participates and for a reasonable period afterwards for settlement disputes.
Your rights
You can ask us what we hold about you, ask us to correct it, or complain about how we've handled it, by emailing [email protected]. We follow the Australian Privacy Principles. If you're not satisfied with our response you can contact the Office of the Australian Information Commissioner.
Security
Everything travels over HTTPS. Passwords are stored only as strong one-way hashes. Money movements are recorded in an append-only ledger, and the database is backed up every hour, with an encrypted copy taken every night.
Data sources
The map is built from OpenStreetMap contributor data, prepared with Protomaps and served from our own server, so looking at the map doesn't send anything to a third party. Postcode and suburb lookups use Matthew Proctor's Australian Postcodes dataset.
Changes
If we change this policy we'll update this page and the date at the top.