Privacy Policy
Last updated: 6 November 2026
1. About this policy
1.1 This Privacy Policy is issued by Vella Labs Pty Ltd (ABN 20 701 816 202) (Vella Labs, we, us or our). It explains how we collect, hold, use and disclose personal information, and how you can access and correct that information or make a complaint.
1.2 This policy applies to the Vella mobile application and its web version (the App), the website at vellaapp.com.au (the Website), our places service known as VellaMaps, and any correspondence you have with us. Together these are the Services.
1.3 We are bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) in it. Where this policy refers to personal information, it has the meaning given in the Privacy Act: information or an opinion about an identified individual, or an individual who is reasonably identifiable.
1.4 By creating an account, using the Services or giving us your personal information, you acknowledge that you have read this policy. If you do not agree with it, please do not use the Services.
1.5 This policy should be read with our Terms of Service at vellaapp.com.au/terms, which govern your use of the App.
2. Summary
2.1 The detail is in the sections that follow. In short:
- We collect what we need to run the Services and nothing to sell. We do not show advertising, we do not use analytics or tracking tools, and we do not sell personal information.
- Your location is used only when you ask for it, and a place you tag is recorded at town or suburb level, never as a precise position.
- Your information is stored with service providers in the United States and, for the Website waitlist, in the European Union. The people who build and moderate Vella work from Australia and the Philippines.
- You can delete your account yourself, at any time, from inside the App, and everything you made is deleted with it. Section 12 says exactly what deletion does.
- You can block any person and report any post, comment, challenge, message or place.
3. The personal information we collect
3.1 Account information
When you create an account we collect your email address, a username, a password and your date of birth. We store your password only as a cryptographic hash; nobody at Vella Labs can read it. We collect your date of birth to confirm that you meet the minimum age in section 13.
3.2 Profile information
You may choose to add a display name, a biography, a profile photo, a home location and the type of vehicle you travel in. Each of these is optional. Your username and display name need not be your legal name.
3.3 Content you create
We collect the content you create in the App: journal posts and the photos in them, challenges and your progress in them, comments, likes, map pins, reviews and ratings of places, the places you mark as visited, your collections and bookmarks, and the people you follow, block or report.
3.4 Messages
We collect the direct and group messages you send and receive in the App, including any photos, GIFs and voice messages in them. Messages are delivered and stored by our messaging provider (section 7.3) on our behalf.
3.5 Location information
We collect location information only when you ask for a feature that needs it: finding places near you, or tagging a post or a place with where you are. Your device asks for your permission first, and you can refuse or withdraw it in your device settings at any time; the rest of the App continues to work. A place you tag is recorded as a town or suburb, resolved from the location your device reports, and not as the coordinates themselves.
3.6 Photos
A photo you add to a journal post, a place or your profile is re-encoded on your device before it is uploaded. That step removes the metadata a camera embeds in a photo, including the place and time it was taken. A photo you send in a message is uploaded as it is, without that step, so it may carry that metadata.
3.7 Device and technical information
If you turn notifications on we collect a notification token for your device, together with the platform (iOS, Android or web) and the software description your device reports (a "user agent" string). Our hosting provider keeps standard server logs of requests to the Services, which include the internet address (IP address) your device connects from, the time of the request and the address requested. We do not use these logs to profile you.
3.8 Crash reports
If the App fails, a crash report is sent to our error-monitoring provider (section 7.3). Crash reports are configured to carry no personal information: no user identifier, name, email address, username, message text or sign-in token. They describe what failed, the type of device and operating system, the version of the App, and an anonymous count of App sessions.
3.9 Website and waitlist
The Website sets no cookies of its own and uses no analytics. If you join the waitlist on the Website we collect your email address through our email-marketing provider (section 7.3). The Website loads fonts and icon files from third-party content networks, which receive your IP address when your browser requests those files.
3.10 Correspondence
If you contact us we collect your email address, the contents of your message and any information you give us to resolve your enquiry.
3.11 Information we do not collect
We do not collect information for advertising or analytics. We do not collect government identifiers. We do not ask for sensitive information (as defined in the Privacy Act, including health, religious, political or sexual information). If you choose to include sensitive information in content you post, you consent to us handling it for the purposes in section 5.
3.12 Unsolicited information
If we receive personal information we did not ask for and could not lawfully have collected, we will destroy or de-identify it as soon as practicable, where it is lawful and reasonable to do so.
4. How we collect personal information
4.1 Directly from you, when you create an account, fill in your profile, create content, send messages, use a location feature, join the waitlist or contact us.
4.2 Automatically, from your device and our systems, as described in sections 3.7 and 3.8.
4.3 From other users, when another person tags you, mentions you, messages you, adds you to a group, or reports content involving you.
4.4 From our service providers, when they return information to us in the course of providing their services, for example a delivery result for an email we sent you.
5. Why we collect, hold, use and disclose personal information
5.1 We collect, hold, use and disclose personal information for the purposes in the table below, and for related purposes you would reasonably expect.
| Information | Purpose |
|---|---|
| Email address and password | To create your account, sign you in, send sign-up and password-reset codes, and send notices about your account |
| Date of birth | To confirm that you meet the minimum age (section 13) |
| Profile information | To show you to other users in the way you choose |
| Content, pins, reviews and visits | To provide the App: your content is shown to the audience you choose for it |
| Messages | To deliver your messages to the people you send them to |
| Location, when you ask for it | To find places near you and to tag content with a town or suburb |
| Notification token and device description | To deliver notifications you have turned on, to the right device |
| Server logs | To keep the Services secure and available, and to investigate faults and misuse |
| Crash reports | To find and fix faults in the App |
| Reports, blocks and moderation records | To act on reports, enforce our Terms of Service and Community Guidelines, and keep a record of the decisions we make |
| Waitlist email address | To tell you when Vella is available and about its launch (section 6) |
| Correspondence | To respond to you and to keep a record of our dealings |
5.2 We may also use and disclose personal information where the Privacy Act permits or requires it, including to comply with a law, a court order or a lawful request from a regulator or law-enforcement body, and to lessen or prevent a serious threat to the life, health or safety of any person.
5.3 We do not use personal information for any purpose that is unrelated to the purposes above without first asking for your consent.
5.4 Dealing with us anonymously
You may browse the Website without identifying yourself. The App requires an account, because journals, messages and the map are tied to the person who made them, so it is not practicable to provide the App anonymously. You may, however, use a username and display name that are not your legal name.
6. Direct marketing
6.1 Waitlist. If you join the waitlist on the Website, we will email you about Vella's availability and launch. Every such email carries an unsubscribe link. You can also unsubscribe by emailing support@vellaapp.com.au.
6.2 Account holders. Emails about your account (sign-up codes, password resets, security and policy notices) are not marketing and are sent as part of the Services. We do not currently send marketing email to account holders. If we begin to, each email will carry an unsubscribe link, and you may opt out at any time by emailing support@vellaapp.com.au.
6.3 We do not provide personal information to any other organisation for its marketing, and we do not use information from third parties for ours.
7. Who we disclose personal information to
7.1 Other users
Other users see the content you choose to share, according to your account's privacy setting and whom you follow, approve, block or report. A public account's posts and profile may be seen by any user. A private account's posts are seen only by followers you have approved. Your username is visible to anyone who can see your content or who you message.
7.2 People who build and moderate Vella
Our developers, and the people who moderate on our behalf, work under written confidentiality obligations and see personal information only as far as their work needs. Some of them are located in the Philippines (section 8). A moderator sees the reported content, the reason given, and the account that made the report. The person reported is never told who reported them.
7.3 Service providers
We use the following organisations to provide the Services. Each handles personal information only to perform its service for us, under its own contractual and legal obligations.
| Provider | What it handles | Location |
|---|---|---|
| Render Services, Inc. | Our application servers, database and server logs | United States |
| Vercel Inc. | Hosting of the Website and the web version of the App | United States |
| Cloudflare, Inc. | Storage and delivery of the photos you post | United States |
| Stream.io, Inc. | Direct and group messages, and the photos, voice messages and files sent in them | United States |
| Resend, Inc. | Delivery of sign-up, password-reset and account emails | United States |
| Google LLC (Firebase Cloud Messaging) | Delivery of push notifications | United States |
| Mapbox, Inc. | Map tiles and place search, including the location you search from | United States |
| Giphy, Inc. | The GIF picker, when you open it; your search terms are sent to Giphy | United States |
| Functional Software, Inc. (Sentry) | Crash reports, with personal information removed before sending | United States |
| MailerLite Limited | The Website waitlist email list | Lithuania (European Union) |
7.4 VellaMaps
VellaMaps is our own service for places, pins, reviews, ratings and visits. It records an opaque account identifier against what you add, not your name or email address. It runs on the same hosting provider as the App.
7.5 Legal, safety and regulatory disclosure
We may disclose personal information where we are required or authorised to by law, in response to a court order, subpoena or lawful request from a law-enforcement body or regulator (including the eSafety Commissioner and the Office of the Australian Information Commissioner), to enforce our Terms of Service, or where we reasonably believe it is necessary to lessen or prevent a serious threat to the life, health or safety of any person.
7.6 Change of control
If Vella Labs or the Services are sold, merged or reorganised, personal information may be transferred to the new owner so that the Services can continue. The new owner will be bound by this policy, or will give you notice of any change.
7.7 With your consent
We may disclose personal information for any other purpose with your consent.
We do not sell personal information, and we do not disclose it to advertisers.
8. Disclosure of personal information overseas
8.1 The providers in section 7.3 store and process personal information in the United States and, for the waitlist, in Lithuania. Our developers and moderators (section 7.2) work from Australia and the Philippines. Those providers may use data centres in other countries. By using the Services you consent to your personal information being disclosed to recipients in those countries.
8.2 Those countries have privacy laws that differ from Australian law. We choose providers that commit contractually to protect the information they hold for us, and we limit what each one receives to what its service needs. You acknowledge that, where you have consented to an overseas disclosure under APP 8.2(b), we are not required to take the steps in APP 8.1 in respect of that disclosure, and that an overseas recipient may not be subject to the Privacy Act.
9. Security
9.1 We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. Those steps include:
- storing passwords only as salted cryptographic hashes;
- encrypting information in transit between your device and our servers (TLS);
- limiting access to production systems to the people who need it;
- signing you in with tokens that expire after 30 days and that you can end at any time by signing out; and
- removing personal information from crash reports before they leave your device.
9.2 No method of transmission or storage is completely secure. If a data breach involving your personal information is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.
10. How long we keep personal information
10.1 We keep personal information for as long as you hold an account and for as long as it is needed for the purposes in section 5, after which we destroy or de-identify it, subject to the following.
10.2 Deleted accounts are handled as described in section 12.
10.3 Server logs and crash reports are retained for no more than 90 days and are then deleted.
10.4 Reports and moderation records are retained after a decision, and after the account concerned is deleted, so that we can review our own decisions, respond to a regulator, and recognise repeat conduct. They are kept for seven years from the decision unless the law requires longer.
10.5 Backups of our database are kept for up to 30 days. Information deleted from the live system remains in backups until they cycle through.
10.6 Correspondence with you is kept for two years after the matter is closed.
11. Access to and correction of your personal information
11.1 You can see and change your profile information, your content and your settings in the App at any time.
11.2 You may ask us for access to any other personal information we hold about you, or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, by emailing support@vellaapp.com.au. We will respond within 30 days. We may need to verify your identity first, which we do by sending a code to the email address on your account.
11.3 We do not charge for a request for access or correction. If we refuse a request, we will give you written reasons, except where the law prevents it, and tell you how to complain about the refusal. If we refuse to correct information, you may ask us to attach a statement to it noting that you consider it inaccurate, and we will do so.
12. Deleting your account
12.1 You can delete your account at any time in the App, at Settings → Delete Account. The full process is described at vellaapp.com.au/delete-account. If you cannot sign in, email support@vellaapp.com.au from the email address on the account and we will send a confirmation code to that address before acting.
12.2 What deletion does. When you delete your account:
- your account is deleted, not switched off: your email address, password, date of birth, display name, profile photo, biography and home location are deleted, your username is released, your sessions on every device are ended and notifications stop;
- what you created is deleted: journal posts and the photos in them, comments, collections and what you saved in them, badges, who you follow and who follows you, your visit history, your ratings and reviews of places, the roads you marked, and the photos you added to places;
- your messages are deleted: a one-to-one conversation is deleted as a whole, for both people in it, and in a group chat your messages are deleted while the group continues for its other members; and
- two things remain, without you, because other people built on them: a challenge you created that other people joined, shown as made by "No User Found", and a place you added to the map that other travellers have visited, photographed, saved or posted about, which keeps its name and location while your description, photos, review, rating and visit are deleted from it.
12.3 Records of reports and moderation decisions are kept as described in section 10.4. Your account is removed from them, but a report can still quote what was reported. Apart from those records, we keep no copy of anything you made, de-identified or otherwise.
12.4 Our messaging and photo storage providers (section 7.3) and VellaMaps (section 7.4) delete their copies straight after your account is deleted, usually within minutes.
12.5 Deleted information remains in backups for up to 30 days (section 10.5).
13. Children
13.1 The Services are for people aged 17 and over. We ask for your date of birth at sign-up and refuse anyone younger. We do not knowingly collect personal information from anyone under 17.
13.2 If we learn that a person under 17 holds an account, we will close it and delete the personal information we hold about that person. If you believe that a person under 17 holds an account, email support@vellaapp.com.au.
14. Cookies and similar technologies
14.1 The Website does not set cookies and does not use analytics or advertising technologies.
14.2 The App stores a sign-in token and your settings on your device so that you stay signed in and the App remembers your choices. This storage is necessary for the App to work and is not used for tracking.
15. Complaints
15.1 If you believe we have breached the Privacy Act or the APPs, or you are unhappy with how we have handled your personal information, please contact us first at support@vellaapp.com.au or in writing to the address in section 17, marking your message "Privacy complaint".
15.2 We will acknowledge your complaint within seven days, investigate it, and give you a written response within 30 days. If we need longer we will tell you why and when to expect our response.
15.3 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:
Office of the Australian Information Commissioner
GPO Box 5288, Sydney NSW 2001
Telephone 1300 363 992
oaic.gov.au
16. Changes to this policy
16.1 We may update this policy from time to time. The current version is always at vellaapp.com.au/privacy-policy and in the App, and the date at the top shows when it last changed. If a change is significant we will tell you in the App or by email before it takes effect.
17. Contact us
Vella Labs Pty Ltd (ABN 20 701 816 202)
C/- MOR Accountants, 406 Dana Street, Ballarat VIC 3350, Australia
Privacy questions, access and correction requests, and complaints: support@vellaapp.com.au
Legal notices: legal@vellaapp.com.au