Privacy policy

1. Who we are

XY:Ref is operated by MONOPROXY PTY LTD (ABN 54 701 178 501), New South Wales, Australia. Questions about this policy or your information go to [email protected].

2. What we never collect

Your templates and documents. Templates you fill are processed entirely in your browser. They are never uploaded to us, so we neither store nor log their contents.

Tracking. The site runs no advertising trackers and no third-party analytics. We do not sell or share personal information.

3. What we collect

Account. Your email address and password — the password stored only as a one-way hash — your API key, plan and credit balance.

Payments. Card payments are handled by Stripe. We never see or store your full card number; we keep the card brand and last four digits to show on your billing page.

Saved addresses. Addresses you save to your map, with their coordinates and any note you add.

Billing usage. When you are signed in, each address counted against your plan is recorded once per billing month, so the plan cap and any charge can be worked out.

Waitlist. If you join a waitlist: your email and which plan you joined it for.

Server logs. Our web server logs the IP address, time, page or endpoint requested and browser type of each request, for security and to understand how the site is used. Query strings, where search text is carried, are not recorded.

Your browser. Local storage in your browser keeps you signed in and remembers display settings such as theme. It stays on your device.

4. Lookups

Most register reads go straight from your browser to the government service named on each value, so that service sees the request as it would any visit to its website. A few services are reached through our relay because they need a server-side key or do not allow browser requests; the relay forwards the request and the response and does not store the result.

5. Who processes it

DigitalOcean hosts the site and the account database in its Sydney region. Cloudflare delivers the site. Stripe processes payments and Resend sends account emails such as verification and password reset; these providers may process data outside Australia under their own privacy terms.

6. Keeping and deleting it

Saved addresses are deleted when you delete them. To close your account, email [email protected] and we will delete your account, saved addresses and usage records, keeping only the payment records the law requires. Server logs are kept for a limited period and then deleted.

7. Access and correction

You can ask to see or correct the personal information we hold about you by emailing [email protected]. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

8. Changes

We may update this policy; material changes will be notified by email to your account address before they take effect.