Privacy policy

What we receive and how we use it

When you ask a question, our server receives your text, chosen state or territory, answer language and up to three previous question-and-answer turns. This context helps interpret follow-up questions. We select relevant official pages and send your question, context and page excerpts to a third-party AI service to generate an answer.

Before sending content to the AI provider, the app attempts to redact common email, phone and long-number patterns. This is not complete anonymisation: names, circumstances and other identifying details can remain. Your original input still reaches our server.

We use this information to provide answers, link to relevant services and protect the service from abuse. We do not sell your questions or use our analytics for targeted advertising. Ask Australia does not submit applications, access government accounts or make eligibility decisions.

AI providers and overseas processing

AI answers use a third-party AI service. Hosting and content delivery use OpenAI Sites and Cloudflare infrastructure. These providers process the information needed to deliver their services and may handle technical logs or request data under their applicable terms.

Information may be processed outside Australia, including in China for AI processing. We cannot promise Australian-only storage, zero provider retention or that all provider-held data is excluded from model improvement. Avoid submitting information you would not want processed by these services.

This policy explains how we handle information submitted through Ask Australia. To ask about service providers or make a request involving provider-held information, use the privacy contact below. Hosting provider information is available in the Cloudflare privacy policy.

Conversations and retention

The app does not save question or answer text to its database or persistent browser storage. Conversations stay in the current tab until you refresh, close it or start a new conversation. A follow-up question continues the conversation.

Clearing the conversation removes it from the app’s display; it does not recall information already sent to a provider. Hosting and AI providers may retain data separately. Their retention periods are not controlled by the conversation reset button.

Our analytics records currently have no scheduled automatic expiry. Cookie expiry or clearing cookies does not delete earlier analytics records. Provider-held operational and security logs have their own retention arrangements.

Analytics and cookies

We use first-party analytics to understand total visitors, recent activity, page views and whether answers complete successfully. A cookie named aa_visitor contains a random browser identifier. It lasts up to one year from its most recent update and helps recognise repeat visits.

The analytics database stores that identifier, first and recent visit times, daily visit totals, page paths, answer success or failure counts and total response timings. It does not store question or answer text, names, contact details or IP addresses. The identifier is pseudonymous, not proof that a visitor is anonymous. The analytics dashboard is restricted to the site owner.

We respect browser Do Not Track and Global Privacy Control signals by excluding those requests from our first-party analytics. You can also block or clear cookies in your browser. This can affect visitor recognition and does not erase previously recorded information. Essential request handling and provider security logs may still occur. The site does not use advertising pixels. Hosting providers may also set security cookies, such as Cloudflare’s __cf_bm cookie, to detect automated abuse. These are separate from our analytics cookie and are not disabled by the analytics privacy signals.

Prepared answers to common questions

We store source-backed answers to a small, predefined set of general questions so these can be delivered more quickly. These records contain the prepared answer, official source references and freshness information. They do not contain visitor identifiers, your submitted wording, personal circumstances or conversation history. We check the source content before reusing a prepared answer; other questions use the normal AI process.

Technical information and security

To deliver pages and prevent abuse, our infrastructure processes technical information such as IP addresses, browser headers, request times and response status. The service uses IP addresses for abuse prevention. Shared security limits store a keyed hash of the address, request counters and short-lived capacity reservations, separately from analytics. Expired limit records are removed during subsequent requests. Raw IP addresses and question text are not stored in these security tables. Hosting providers may keep technical and security logs.

We use HTTPS, a secure browser identifier cookie and owner-restricted access to the analytics dashboard. No online service can guarantee absolute security. Do not use the question box to send confidential documents or account credentials.

Official websites and copying answers

Reading official sources to prepare an answer does not lodge a government application. When you open a source or action link, the destination website handles your visit under its own privacy policy. Enter personal details only on the appropriate official service.

If you choose Copy, the answer is placed on your device’s clipboard. You control where you paste or share it.

Your choices and privacy requests

You can browse without asking AI, keep personal details out of questions, enable supported browser privacy signals and clear the displayed conversation. If you want to ask about information we hold, request access, correction or deletion, or make a privacy complaint, contact Ahsan Hashmi on LinkedIn.

Describe the issue and approximate date first. Do not send identity documents or sensitive information in your initial message; we can arrange a suitable way to discuss the request. We can only locate records we hold and can reasonably associate with you. We may be unable to retrieve a past chat because the app does not keep conversation records. Requests involving provider-held data may require that provider’s assistance.

We aim to respond to privacy requests within 30 days and explain if more time is needed. If your concern remains unresolved, the Office of the Australian Information Commissioner explains complaint options and when it can consider a matter.

Changes to this policy

We will update this page when our data handling changes. The date above identifies the latest revision. Check this policy before submitting information if you have concerns about how it is processed.