Privacy Policy

Effective 16 September 2026. Last amended 16 September 2026.

whichbins is a bin-collection-day service for Australian addresses, provided through the whichbins.com website, the whichbins iPhone app and its widgets, and the whichbins API (together, the Service).

This page sets out our policies on the collection, use, and disclosure of Personal Information (as defined in the Privacy Act 1988 (Cth)) when you use the Service. We are bound by that Act and by the Australian Privacy Principles. By using the Service you agree to the collection and use of information in accordance with this policy. We will not use or share your information except as described here.

Information we collect and how we use it

Looking up a collection day, without an account

You do not need an account to look up a bin day, and we do not create one for you. Two records are still written, and neither is associated with you, with a session, or with any account:

• An address and its coordinates, retained indefinitely, so that the same address need not be resolved again. An address does not move.
• An address and the collection days returned for it, retained for a few hours, so that a frequently requested address does not cause us to query the council on every page view.

These are caches of addresses. They contain no name, email address, account identifier or record of who made the request.

If you create an account

Sign-in is passwordless. You provide an email address and we send a six-digit code, which we store only as a cryptographic hash and which expires after ten minutes. There is no password to store. We collect and hold:

• Your email address, in lower case, with the dates your account was created and last used to sign in.
• Your sessions — one for each device — including the browser or app user-agent string, so that you can identify a device and sign it out.
• The addresses you save: the address as the council records it, the council it is in, and any nickname you choose to give it.
• Your reminder preferences: whether you want the evening-before email and the weekly summary, the hour each is to be sent, how many days ahead, and which day of the week for the summary. Times are interpreted in the council's own timezone.
• A record of the reminders sent, so that the same reminder is not sent twice.
• A link for your reminder emails: a random identifier that goes in the footer of every reminder we send you, so that you can change or stop those emails without signing in. It opens your reminder settings and nothing else — it cannot be used to sign in, to see a collection day, to add an address, or to change the email address the reminders go to.

The iPhone app

The app holds your session token in the device Keychain. It writes the addresses you have saved, and their upcoming collection days, into a shared container on the device so that the widgets can display them without holding a session of their own. It may schedule local notifications on the device for the reminders you have chosen. That information stays on your device; it is not additional information sent to us. The app contains no advertising identifier, no analytics framework and no third-party tracking code.

Log data

Our web server keeps ordinary request logs, which include the Internet Protocol (IP) address the request came from, the date and time, the page or API endpoint requested, the response status and the user-agent string. These are used to operate and secure the Service and to diagnose faults.

Cookies

If you sign in on the website we set one cookie, which holds your session and nothing else. It is marked HttpOnly, so it cannot be read by scripts in the page. We set no advertising or analytics cookies, and the Service loads no third-party scripts, fonts or tracking pixels; the only scripts are ours, served from this domain. If you do not sign in, no cookie is required.

How we use the information

For two purposes only:

• To provide the Service — to answer a lookup, to send the reminders you have asked for, and to keep you signed in.
• To improve the Service, using de-identified, aggregated information: how many councils answer, which sources break, how often an address cannot be resolved. These are counts and rates that identify no individual.

We do not sell Personal Information, we do not disclose it for advertising or marketing, and we do not use it to build a profile of you.

Service providers and disclosure

We engage third-party providers, each for a single purpose, and disclose to each only what that purpose requires.

• Linode (Akamai Technologies) — hosting of our server and database. Everything described above is stored there.
• SendGrid (Twilio) — delivery of our email, being the sign-in codes and the reminders. It receives the recipient address and the message.
• Your council, and the providers it engages. For many councils the only way to obtain a collection day is to query the council's own address lookup, so the address you enter is sent to that lookup, or to the waste contractor or mapping provider the council itself uses. We send the address alone: no email address, no name, no account identifier, and nothing that identifies the person asking. The coverage page identifies, for every council, where its collection days come from, and links to the council's own page.
• The OpenStreetMap Foundation (Nominatim) — for the small number of addresses that our own copy of the Commonwealth's Geocoded National Address File cannot resolve. Measured on 16 September 2026, that file resolved 91 of the 94 sources requiring a geocoder.

These providers may use the information only to perform the task assigned to them, and to the extent permitted by law are obliged not to disclose or use it for any other purpose. We disclose Personal Information to no one else unless required by law.

Overseas disclosure

Our providers operate in several countries and we may move between their regions from time to time. Your information may be stored and processed outside Australia — in Australia, the United States, or another country in which a provider of ours operates. In particular, our server and database are hosted by Linode, which operates data centres in Australia, the United States, Europe and Asia; email is delivered by SendGrid, which operates principally in the United States; and Nominatim is operated by the OpenStreetMap Foundation, which is based in the United Kingdom and operates infrastructure in Europe. Council lookups are generally operated in Australia, but we do not control where a council or its contractor hosts its own systems. By using the Service you consent to your information being stored and processed in those locations.

If you wish to know where your information is held at a particular time, ask us using the contact details below and we will tell you.

Retention

• A sign-in code: ten minutes, after which it cannot be used.
• A session: thirty days, or until you sign that device out.
• A cached collection schedule: a few hours.
• An address and its coordinates: indefinitely, as described above.
• Your account, saved addresses and reminder preferences: until you delete them or ask us to close your account.
• Server request logs: retained only as long as needed to operate and secure the Service.

Deleting a saved address deletes it and the record of reminders sent for it. If you ask us to close your account, we delete the account, every address saved under it, every session, and every reminder record.

Security

The Service is served over HTTPS only. There are no passwords to be stolen. Session cookies are HttpOnly. Each account has a key of its own incorporated into the signing of its sessions, so that signing out of all devices takes effect immediately and everywhere. We use our best efforts to protect Personal Information; however, no method of transmission over the internet, and no method of electronic storage, is completely secure, and we cannot guarantee absolute security.

Access

You may request access to the Personal Information we hold about you at any time using the contact details below. Much of it is visible on your account page at any time. We will promptly acknowledge your request and tell you when we will provide the information. If we refuse access, we will give you written notice setting out (unless the law allows us not to specify a reason) the reasons for the refusal and how you may complain about it. We may recover our reasonable costs of giving access.

Correction

We seek to ensure that the Personal Information we hold is accurate, up-to-date, complete and, in the case of use and disclosure, relevant. Where we believe that information we hold is inaccurate, out-of-date, incomplete, irrelevant or misleading, we will take reasonable steps to correct it and, if you ask and it is reasonable and practicable, to notify that correction to third parties that received the incorrect information from us. You may also request a correction using the contact details below. If we do not agree with the correction requested we are not obliged to make it; we will instead give you written notice setting out (unless the law allows us not to specify a reason) the reasons and how you may complain, and you may ask us to associate with the information a statement that you consider it inaccurate, out-of-date, incomplete, irrelevant or misleading. We do not charge for making a correction request, for correcting information, or for associating such a statement.

Links to other sites

The Service links to council websites and to the sources from which collection days are obtained. Those sites are not operated by us. We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third-party site or service.

Children's privacy

The Service is intended for householders and is not designed for anyone under the age of 13. We do not knowingly collect Personal Information from children under 13. If we discover that we hold such information, we may delete it immediately.

Enquiries and complaints

If you have any enquiry, concern or complaint about this policy, our handling of your Personal Information, or our compliance with the Privacy Act 1988 (Cth) or any related code, please contact us at admin@whichbins.com. We usually respond in writing within 30 days, unless we need further information in order to respond.

You may also contact the Office of the Australian Information Commissioner on 1300 363 992 or at enquiries@oaic.gov.au.

Changes to this policy

We review this policy regularly and may change it from time to time without notice to you. An up-to-date copy is always available on this page, and the effective and amendment dates above are updated when it changes.

Contact us

Questions and requests about this policy, or about the Personal Information we hold, go to admin@whichbins.com.