Privacy Policy

1. What this policy covers

Abora Pty Ltd (“Abora”, “we”, “us”) operates abora.com.au. This policy covers both the public site — suburb pages, Market Pulse, calculators, the search box — and the signed-in Abora app. Where something applies to only one of the two, it says so.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are in the UK or the European Economic Area, the rights described in §7 are available to you regardless of which law you rely on.

2. What we collect

Browsing the public site. No account, no name, no email. What reaches us is the request itself: the page you asked for, your IP address, and the search terms or addresses you type into the search box. §4 covers what happens to those.

Contacting support. The form at /support collects your name, email address, a subject category and your message, because we cannot reply otherwise. Your IP address is held for one hour to rate-limit the form against spam, and is then gone.

Holding an account. Signing in adds your email address, your display name, the properties and suburbs you save or shortlist, the reports you generate and, on a paid plan, a billing record held by Stripe. This all sits in the app, not on the public pages.

We never receive your password. Sign-in is handled by Firebase Authentication: your password goes from your browser directly to Google and never passes through our systems, so there is nothing for us to store or lose. The same is true of card details, which go straight to Stripe.

What we never collect. We do not buy personal information from data brokers, we do not track you across other websites, and we do not build advertising or behavioural profiles. We have never sold personal information and the business does not depend on doing so.

3. Cookies and browser storage

Everything this site puts in your browser is listed below — there is no separate category we have left out. Items marked Essential are needed for the site to work and are set without asking. Everything else is on by default and can be turned off at any time — in the notice on your first visit, or afterwards through Cookie settings in the footer. Turning something off deletes what was already stored rather than merely stopping new writes.

There is one exception, and it is marked set regardless of your choice in the table. Google AdSense loads on every page for every visitor, so the cookies it sets are not covered by the switches above and turning advertising off does not remove them. We would rather label that row honestly than offer you a control that does not do what it appears to.

Rows marked not in use yet are declared here in advance. The consent controls for analytics are already built and already enforced; the tool itself is not switched on. We would rather tell you what is coming than add it quietly later.

You can change your answer at any time using Cookie settings at the bottom of any page.

The three cookies above marked set regardless of your choice — __gads, __eoi and _gac_* — are set by Google AdSense, which funds the free articles on Market Pulse. They control how often you are shown the same ad and help Google spot fake ad traffic. They are set by Google rather than by us, so the cookie settings on this site cannot remove them; you can block them in your browser, or manage what Google does with them at myadcenter.google.com.

3.1 What is not here

No session-replay or screen-recording tools, no social media embeds, and no third-party trackers beyond the Google products named on this page. Our fonts are served from our own domain rather than fetched from Google. If any of that changes, this table and the notice change with it before the code ships — see §10.

3.2 Google Analytics and Google Ads

Both run on Google’s gtag.js script, which your browser loads from Google when — and only when — you have agreed to the matching category. Decline, and the script is never requested, so Google is never contacted for these two at all.

We use these to count feature usage and to tell which of our own advertisements are worth paying for. We do not use them to build a profile of you as an individual and we do not upload customer lists.

3.3 Advertising on Market Pulse

Abora is a free site and the advertising on Market Pulse is part of how it pays for itself. Those advertisements are served by Google AdSense.

The AdSense script behaves differently to the two above, and it is worth being plain about it. It loads on every page for every visitor, whatever you chose in the cookie notice. Google therefore receives your IP address, your browser’s user-agent and the page you are on, and may set cookies to measure and to select advertising. Advertisements themselves only appear on Market Pulse and its articles; the script is sitewide because Google requires it for the site to be verified.

Google may use those cookies to show you advertising based on your visits to this site and to others. You can switch personalised advertising off at any time at My Ad Center — the setting is yours and applies wherever Google serves ads, not just here. Google explains what it collects when serving ads in its advertising technologies notice. You can also opt out of interest-based advertising from many networks at once through YourAdChoices.

Australian privacy law does not require opt-in consent for advertising cookies, and we do not ask for it. What we do instead is tell you exactly what happens, on this page, and point you at the controls that actually work.

3.4 Refusing everything

Choosing Essential only leaves the site fully usable. The single thing you lose is the list of recent searches on the home page. Blocking cookies entirely in your browser also works: the usage allowance falls back to counting by IP address, which is slightly less generous when you share a connection, and nothing else breaks.

It does not stop the advertisements. Declining cookies stops Google Analytics and Google Ads from loading, but the AdSense script described in §3.3 loads either way — so you may still see advertising, and it may be less relevant rather than absent. The controls in §3.3 are the ones that change what you are shown; a browser content blocker is the one that removes it.

4. What reaches our servers either way

A cookie choice governs what is stored in your browser. It cannot govern what a request contains, and it would be misleading to imply otherwise. The following happens whatever you choose:

• Your IP address. Passed to our backend so free-tier limits count against you rather than against everyone sharing your network. Without it, one heavy user on an office connection would exhaust the allowance for the whole building.
• Searches and addresses you enter. Sent to our API to be answered. They are not attached to your identity when you are signed out.
• Ordinary web server logs. The URL, timestamp, response status, and how long it took. These exist so we can tell whether the site is working.

None of this is used to profile you, and none of it is shared with anyone for advertising.

5. Who else is involved

We use a small number of service providers. Some are contacted by your browser directly, which means they can see your IP address; the rest are called from our servers, so they see the question and not you. Each entry says which. Anything depending on your consent says so too, and is not contacted at all if you decline.

• Mapbox — your browser contacts itSuburb boundary maps. The image is fetched by your browser directly from api.mapbox.com — Mapbox’s licence does not permit us to serve it from our own servers — so Mapbox receives your IP address, your browser’s user-agent and the page you are on.Their privacy terms ↗
• Google Analytics — your browser contacts itCounts how many people use each feature. On by default; turn it off in the cookie notice or via Cookie settings in the footer, and it stops being contacted and its cookies are deleted.Their privacy terms ↗
• Google Ads — your browser contacts itTells us which of our advertisements brought people to the site. On by default; turn it off in the cookie notice or via Cookie settings in the footer.Their privacy terms ↗
• Google AdSense — your browser contacts itDisplays the advertisements on Market Pulse and its articles. Unlike the two entries above, the AdSense script loads on every page for every visitor, so Google receives your IP address, user-agent and the page you are on regardless of your cookie choice. Google may use cookies and similar technologies to show you advertising based on your visits here and to other sites. You can turn personalised advertising off at any time in Google’s Ads Settings, and that setting applies wherever Google serves ads.Their privacy terms ↗
• Google Maps Platform — we contact it for youAddress search, geocoding, commute times and aerial imagery. Called from our servers, not your browser, so Google receives the query but not your IP address or any identifier for you.Their privacy terms ↗
• Amazon Web Services — your browser contacts itHosting and content delivery for this site and its images. AWS processes traffic on our behalf under its data-processing terms and does not use it for its own purposes.Their privacy terms ↗
• Firebase (Google) — we contact it for youSign-in and account infrastructure for the Abora app. Only used once you create an account — it is not loaded on these public pages at all.Their privacy terms ↗
• Stripe — we contact it for youSubscription billing. Card details go straight to Stripe and are never held by us. Only applies to paid accounts.Their privacy terms ↗

We disclose personal information outside this list only where the law requires it — a court order, a warrant, or a regulator exercising a statutory power — or to professional advisers under a duty of confidence. We will tell you if that happens unless we are prohibited from doing so.

6. How long we keep things

• Support enquiries — kept while we deal with them and for two years afterwards, so we can pick up a thread you return to.
• Rate-limit IP addresses on the support form — one hour, in memory only.
• Server logs — 90 days.
• Account data — for as long as the account is open. Delete the account and we remove it within 30 days, apart from records we are legally required to keep, such as tax records for financial transactions.
• Browser storage — whatever the table in §3 says, and you can clear all of it yourself at any time.

7. How it is protected

Traffic is encrypted in transit. Access to production data is restricted to the people who need it to operate the service and is authenticated individually. Passwords and card details never touch our systems at all — Firebase and Stripe handle them respectively, which is a stronger position than storing them carefully.

No system is perfectly secure and we will not claim otherwise. What we can commit to is §8: if something does go wrong, you find out.

8. Your rights

You can ask us to:

• Show you what we hold about you (APP 12). We will respond within 30 days.
• Correct anything wrong (APP 13).
• Delete your account and its data, subject to records we must keep by law.
• Export your data in a machine-readable format.
• Stop marketing email — every one has a one-click unsubscribe, and it takes effect immediately rather than in the customary few days.

Ask at hello@abora.com.au. There is no charge, and you do not have to give a reason.

If we get it wrong, complain to us first at the same address and we will respond within 30 days. If you are not satisfied, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. You do not need our permission to do that.

9. If there is a data breach

The Notifiable Data Breaches scheme applies to us. If personal information is lost or disclosed without authorisation and that is likely to cause you serious harm, we must notify both you and the Australian Information Commissioner as soon as practicable.

Our own commitment goes slightly further: we will tell you what happened, what was affected, and what to do about it, in plain terms and without waiting to establish whether the legal threshold is met.

10. Overseas disclosure and children

Our infrastructure runs in Australia. Some of the providers in §5 are based overseas, mainly in the United States, and may process data there under standard contractual protections. Using this site means accepting that, as APP 8 requires us to state plainly.

Abora is not designed for and is not directed at anyone under 18. We do not knowingly collect information from children. If you believe a child has given us personal information, tell us at hello@abora.com.au and we will delete it.

11. Changes, and how to reach us

If we add anything that stores data in your browser, this page changes and the notice asks you again before it is set. Material changes are announced by email to account holders and by a notice on the site. The date at the top of this page tells you when it last changed.

Privacy questions and requests: hello@abora.com.au. Anything else: support.