Privacy Policy

Who we are

Xalo ("Xalo", "we", "us") is an event discovery platform for Melbourne, Australia. Contact: contact@xalo.au

What we collect

• Email address — when you create an account, contact us, apply as a venue, promoter or reporter
• Username, display name, bio and optional social links — when you create and customise your profile
• Gender — optional, used only to display aggregate statistics (e.g. "15 female, 10 male going"). Never exposed individually to other users without your consent
• Event participation — when you mark yourself as attending an event ("Going")
• Approximate location — only when you request location-based results. We do not store precise GPS coordinates
• Push notification preferences — stored on your device only

What we do not collect

• We do not sell your data to any third party
• We do not track you across other websites
• We do not store your precise GPS coordinates
• We do not serve advertising based on your personal data
• We do not collect facial recognition data or biometric identifiers

How we use your data

Your email is used for account authentication, password recovery, account security and communications you have requested. We do not use your email for unsolicited marketing.

Public profiles

If you create a Xalo account and set your profile to Public, information such as your username, display name, avatar, bio and public event activity may be visible to other users and visitors at xalo.au/u/[username]. You may change your profile to Private or update your information at any time through your account settings.

Event participation visibility

When you mark yourself as attending ("Going") an event, your public profile information — including username and avatar — may be visible to other users viewing that event. If your profile is set to Private, your participation will not be shown publicly.

Account deletion

You may request deletion of your account and associated personal data at any time by emailing privacy@xalo.au. We will process your request within 30 days in accordance with the Australian Privacy Act 1988.

Event photography

Event photographs may be submitted by approved reporters, photographers or partners attending public events. Photos are reviewed before publication. If you appear in a photo and wish it removed, email photos@xalo.au.

Third party services

• Ticketmaster Discovery API — event listings
• Google Places API — venue and location data
• City of Melbourne Open Data — pedestrian sensor datasets for aggregated activity signals
• Supabase — secure user data storage (AWS Sydney region)
• Netlify — website hosting (CDN)
• Mapbox — mapping and geolocation display

Your rights under Australian Privacy Act 1988

You have the right to access, correct or delete your personal information at any time. Email privacy@xalo.au.

Cookies and local storage

Xalo uses essential cookies and browser local storage required for site functionality (session management, preferences, cached event data). No third-party tracking or advertising cookies are used. If this changes, this policy will be updated.