Privacy Policy
Last updated: 7 October 2026
ParkAhead shows live and forecast occupancy for Sydney's Park & Ride car parks at parkahead.app. It is run by Shumin Kong, a sole trader in New South Wales, Australia ("ParkAhead", "we", "us"). This policy explains what personal information we collect, why, where it is kept, who else sees it, and the choices you have.
The short version: we collect what we need to run accounts and subscriptions and to understand how the site is used. We don't sell personal information, we don't send marketing email, and full card numbers never reach our systems.
1. What we collect
Information you give us
- Account details: your first name, your last name if you choose to give it, your email address and a password. Passwords are stored only as a one-way hash by Supabase, our authentication provider. We never see them.
- Sign in with Google: if you use "Continue with Google", Google sends us your name, your email address and a link to your profile picture. We use the name and email address to create or sign in to your account, and we ask Google for nothing else. Signing in with Google for the first time creates an account under this policy and our terms, which the sign-in page says.
- Your car parks: the car parks you save as favourites, including the one you name in the "Which car park do you use?" step after sign-up.
- Alert setting: whether you want an email the evening before an unusual day at a car park you have saved, and when you last changed it. The setting is on your account page; it starts on for accounts that can get alerts, and the link in any alert turns it off.
- Billing details: when you subscribe, Stripe collects your card details and billing address on its own secure pages. Stripe passes us the name you entered at checkout, your billing address and a card summary (the card's brand, last four digits, expiry month and year, and country), together with your subscription's status and dates. We never receive full card numbers or bank details.
- Messages: anything you send to support@parkahead.app.
Information collected automatically
- Usage events: which pages and features are used, such as viewing the list, opening a car park page, saving a favourite, seeing or clicking a sign-up or subscribe prompt, starting checkout, opening a page from an alert email, and the steps of signing up; the car park concerned; whether you were signed out, in the free trial, on the free plan or subscribed; the time; your browser's user agent; and the visitor identifier from our cookie (section 4). While you are signed in, events are also linked to your account.
- How you first arrived: on your first visit we note any campaign tags in the link (such as utm_source), the site that referred you and the first page you opened. If you later create an account, this is saved with it so we can tell which channels bring new users.
- Technical logs: our hosting providers, Vercel and Supabase, record IP addresses, request details and errors in their server logs and keep them for a short time under their own settings. We use your IP address in memory to limit abusive request rates; we don't store it in our database.
- Alerts log: for each alert email we send you, the day it was about, the car parks it covered and its sending status (whether our email provider accepted it).
- Google Analytics: see section 4.
Your location
The home page asks your browser for your location so it can sort car parks by distance and centre the map near you. You can decline. The position stays in your browser's session storage for the current tab and is never sent to our servers.
What we don't collect
We don't collect government identifiers, dates of birth or any sensitive information, and we don't knowingly collect information from anyone under 16.
2. Why we use it
We use this information to:
- create, sign in to and run your account, including the free trial every new account gets;
- show you your saved car parks;
- take payments and manage subscriptions through Stripe, and keep the billing records tax law requires;
- email you the evening before an unusual day at a car park you have saved, if alerts are on;
- answer your emails;
- understand how the site is used and improve it, including which prompts lead to sign-ups and subscriptions;
- keep the service secure, and detect and limit abuse;
- meet our legal obligations.
We don't sell or rent personal information, we don't use it for advertising, and we don't send marketing email. Alert emails are optional forecast alerts about the car parks you have saved, with an unsubscribe link in each. If we ever want to email you about new features, we'll ask first, and every such email will have an unsubscribe link too.
3. Where your information is kept
Our database and the servers that run the site are in Sydney, Australia, in Supabase's and Vercel's Sydney regions. Account emails and alerts are sent through Mailgun's servers in Germany. Support email is received on our own mail server in Germany. Our forecasting jobs run on Amazon Web Services in Sydney and handle car park data. The alerts job runs there too: each evening it reads which accounts have alerts on, with their email address, first name and saved car parks, sends each alert through Mailgun, and writes a run log on AWS that names the account and car parks, kept for one month. (The alerts log in section 6 is the record in our own database.)
Some of the companies that help us run the service are based overseas or process data there:
- Stripe (United States; its privacy policy also names India as a place it may process data): payments and subscriptions.
- Google (United States, and the other countries where Google runs its services): Google Analytics and sign in with Google.
- Amazon Web Services (United States company, Sydney region): runs our forecasting jobs and the alerts job described above.
- Mailgun (United States company; our account is in its European region, hosted in Germany): sends our account emails and alerts, and sees your email address and each email's content.
- Supabase and Vercel (United States companies): our database, authentication and hosting providers. Our data sits in their Sydney regions, but their staff and support systems are overseas, mainly in the United States.
- OpenStreetMap Foundation (United Kingdom): the map images on our pages come from its servers, which see your IP address and the map area you view.
- Buy Me a Coffee (United States): the "support us" button loads a script from its servers, which see your IP address and browser details.
Each provider handles information under its own privacy policy and data protection terms, and we share with each only what it needs to do its job.
4. Cookies, analytics and browser storage
We set these cookies ourselves:
- pa_vid: a random visitor identifier, kept for up to 400 days. It holds no name, email address or other personal details. It lets us see that a visitor who later signs up is the same person who used the site before.
- pa_src: how you first arrived (section 1), kept for up to 400 days.
- Sign-in cookies, set by Supabase and named "sb-…", which keep you signed in.
Google Analytics. We use Google Analytics to understand how visitors use the site: the pages viewed, actions such as signing up, device and browser type, and an approximate location worked out from your IP address. Google sets its own cookies, named "_ga…", which last up to two years, and processes this data on its servers in the United States. Google Analytics processes your IP address to estimate your approximate location and to protect its service, but doesn't log or store it. Google explains what it does with this data at How Google uses information from sites or apps that use our services. To opt out of Google Analytics, install Google's opt-out browser add-on, or use a content blocker that stops Google Analytics' scripts and requests; blocking cookies alone doesn't stop the tag from sending. That doesn't stop our own usage events (section 1), which stay with us and never go to Google; there is no separate switch for them.
Browser storage. The home page keeps your chosen sort order and, if you allowed it, your last known position in your browser's session storage for the current tab. Nothing in it reaches our servers.
You can block or delete cookies in your browser settings. Without the sign-in cookies you can't stay signed in.
5. Who else sees your information
- Service providers: the companies in section 3, each receiving only what it needs.
- Transport for NSW provides the live occupancy data we show. We send it nothing about you.
- The law: we may disclose information where the law requires or authorises it, or where it is reasonably necessary to establish, exercise or defend a legal claim, to deal with suspected unlawful activity, or to respond to a serious threat to someone's life, health or safety, in each case as the law and the Australian Privacy Principles allow.
- A change of owner: if ParkAhead is sold or transferred, your information would pass to the new owner under this policy, and we would tell you.
We don't share personal information with advertisers or data brokers.
6. How long we keep it
- Account details, favourites and sign-up source: until you delete your account.
- Usage events: for as long as we run the service, so we can see how use changes over time. When you delete your account, we delete the events linked to it, including those recorded under the visitor identifier it signed up with.
- Alert setting and alerts log: until you delete your account.
- Billing records: the card summary and billing address in your profile go when your account does. We keep our own records of invoices and payments for five years from when the record was made or the payment completed, whichever is later, which is the Australian Taxation Office's minimum for business records, and longer only where the law requires. Stripe keeps its own records of your payments under its privacy policy, for its own legal and fraud-prevention obligations, and we can't delete those.
- Support emails: for as long as we need them to help you.
- Technical logs: for the short periods Vercel, Supabase and Google set.
7. Security
Everything between your browser and ParkAhead travels over HTTPS, and our providers encrypt stored data. Our database enforces row-level security, so an account can read only its own data, and access to it is limited to the people who run ParkAhead. Full card numbers and security codes are handled only by Stripe; we keep the card summary described in section 1. No service can promise perfect security. If a data breach is likely to cause you serious harm, we will tell you, and the Office of the Australian Information Commissioner (OAIC), as soon as we can.
8. Your choices and rights
- Update your name or password on your account page.
- Access, correct or export anything else we hold about you by emailing support@parkahead.app. We'll reply within 30 days.
- Delete your account by emailing support@parkahead.app from your account's email address. Any subscription is cancelled from the moment we receive your email, so no further payment is taken, and a payment taken after that is refunded. Within 30 days we delete your account, profile, favourites, alert setting and log, sign-up source and the usage events linked to you. Invoices and payment records stay as section 6 says.
- Alerts: turn them off on your account page, or with the unsubscribe link in any alert email, which works without signing in and takes effect at once.
- Location: decline the browser prompt, or revoke the permission in your browser settings.
- Google Analytics: use Google's opt-out add-on, or a content blocker that stops Google Analytics' requests (section 4). Our own usage events continue, as section 4 explains.
9. Children
ParkAhead is not for anyone under 16. If we learn that we hold a child's information, we delete it.
10. Complaints
If you think we've mishandled your information, email support@parkahead.app with "Privacy" in the subject line. We'll reply within 30 days with what we found and what we'll do about it. We apply the Australian Privacy Principles even though, as a small business, ParkAhead is not currently required to. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner, which can tell you what options you have.
11. Changes to this policy
We'll post changes here and update the date at the top. If a change matters to you, for example a new kind of information we collect or a new use of it, we'll email account holders before it takes effect.