Privacy Policy

Last updated: 18 October 2026
Jurisdiction: Victoria, Australia

Welcome to NICKD ("we", "us", or "our"). NICKD is a community network for finding stolen vehicles. People report a stolen or suspicious vehicle. Other people ("spotters") use the NICKD Android app to read number plates while they drive. When a plate matches a vehicle reported to NICKD, we record that sighting and alert the owner.

This policy covers the NICKD Android app (au.com.nickd.app) and the website at nickd.com.au. It explains what we collect, what we do not keep, why we use it, who we share it with, how long we keep it, and how to ask us to delete your account.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). NICKD is operated from Victoria, Australia. Victorian law also affects how the camera may be used. Those rules are in our Terms & Conditions, including the Surveillance Devices Act 1999 (Vic).

1. Information we collect

A. Account

The app requires an account. You can register with an email address and password, or sign in with Google.

• Email registration: first name, last name, email address, and password. The password is held by Firebase Authentication. We do not store the password in our own database.
• Google sign-in: the name, email address, and account id Google gives us for that sign-in.
• Account record: a Firebase user id, the name and email above, when you joined, when you last signed in, and when the app was last open.

The Android app does not offer a guest or anonymous account. You cannot scan until you are signed in.

B. Location

The app asks for precise location (GPS). It uses that permission in two different ways, and only some of those readings leave the phone.

• While you are scanning: if the scanner screen is open, or you have tapped START SHIFT SCAN, the app reads precise location about every five seconds. On a shift it can update as often as every two seconds. It uses the latest reading to show your speed on screen, to slow the shift scan when you are under about 5 km/h, and to have a fix ready if a stolen plate matches. The direction shown on the scanner (bearing) stays on the phone. We do not upload bearing.
• What we store from a scan: when we upload a sighting (section 1.D) we include latitude, longitude, and speed. We do not upload a track of the whole drive.
• Nearby-alert area, if you opt in: on your profile you can choose to be alerted about stolen cars near you. If you turn that on, then while the scanner screen is open we save your latest latitude, longitude, and suburb to your account about every ten minutes, so we know which alerts are relevant. You can also tap USE MY CURRENT LOCATION to save a home area (latitude, longitude, and the suburb we read from that point) and a radius. If you leave nearby alerts off, we do not write this rolling location to your account.
• Shift scan with the screen off: a shift scan keeps running, with a notification, when you leave the app or the screen turns off. Location during that shift is part of the same foreground task. The app does not use Android's background-location permission.

C. Number plates, and what we do not keep

The camera feed is read on the phone with Google ML Kit. We do not record video, and we do not upload the camera feed.

That is the server rule. On the phone itself, be precise about what "discarded" means:

• Scanner screen: the latest plate is shown on screen. A plate that matches neither list is not written to storage and is not sent to us. It is replaced when the next plate is read.
• Shift scan: each plate the shift accepts is also held in memory so the notification can show a count ("N plates read"). That list includes plates that did not match. It is not uploaded, it is not written to a file, and it is dropped when the shift stops.
• Police-list-only, automatic scan: if the plate is on the public police list but not on a NICKD stolen report, the phone alerts you. The automatic scanner does not upload that plate, a location, or a photo.
• CHECK IF STOLEN: if you type a plate or photograph one and it matches either NICKD's list or the police list, the app does upload a sighting. A plate that matches neither list is not uploaded.

D. Sightings and photos of a matched vehicle

A sighting is the record we keep when a plate matches. It contains the plate, the time, latitude, longitude, speed, your account id, and a photo link when we have a photo.

• Automatic match on NICKD's stolen list: the scanner or the shift scan uploads a sighting. It also uploads one JPEG of the camera frame from that moment (the vehicle and plate in view, not a video). On a shift, the same plate is not uploaded again for 10 minutes, and any two uploads are at least 10 seconds apart. On the scanner screen, captures are at least 10 seconds apart. If the photo fails, we still store the sighting without a photo.
• That photo is the whole frame. It is there to show the vehicle. We do not crop it to the plate, and we do not run face detection. Anything else in the frame at that moment can be in the photo. We do not deliberately photograph people, and we do not use the photo to identify a person.
• CHECK IF STOLEN: a match on either list asks whether you want to add a photo. You can skip it. The sighting still includes your current location.
• Hotlist "seen it": from the stolen-car list you can log that you saw a listed car. A photo is optional. The sighting includes your current location.
• Extra photo later: from a stolen-vehicle alert you can add another photo. That upload is tied to your account and the plate. It does not include a fresh GPS fix.

E. Reports you choose to submit

• Stolen vehicle / proof of ownership (app): plate, make, model, body type, colour, and a photo of your proof (registration, a police report, or similar). We store your account id, name, and email with that request.
• Suspicious vehicle (app): plate (or a note that there is no plate), make, model, body, colour, a note, the photo if you attach one, and the GPS point at the time you submit.

F. Device information and notifications

• Push token: we store a Firebase Cloud Messaging token on your account so we can send stolen-vehicle alerts, nearby alerts you opted into, and service messages. We do not use a separate analytics product, and the app does not collect an advertising id.
• Last active: while the scanner screen is open we update a "last active" time on your account.
• Left on the phone: battery level, whether the phone is charging, and phone temperature are read only to slow or pause a shift scan. They are not uploaded. Points, sighting counts, and badges are scores we calculate, not data from the device.

The public leaderboard shows initials and a score, not your email. You can hide yourself from the leaderboard in the app.

G. Website reports

The stolen-vehicle and suspicious-vehicle forms on nickd.com.au sign in to Firebase anonymously so the page can upload photos. That anonymous session is not an app account and has no email inside Firebase Authentication.

The form still asks you to type your name, email, phone number, and address, and we store those with the report, plus the vehicle details, any photos, and the location you pin on the map. A police reference is stored when you enter one.

The public plate check at nickd.com.au/check.html also uses an anonymous session, only so the page can ask the server. A plate that is not listed is not stored as a sighting. Scanning a plate with the camera stays on your device and is not uploaded. We do not ask for your name. If a plate is listed and you tap Report sighting, the browser asks for your location and we store one sighting: the plate, the time, the latitude and longitude, and that anonymous session id. We do not read location while you are typing. The page shows the vehicle description only. It does not show the owner's name, phone, email, or address.

2. Why we use it

• Find stolen vehicles. Scanning, matching, and storing a sighting exist so a reported stolen car can be located.
• Tell the owner. If the plate is on a NICKD stolen report, we notify the owner and open a live view of the sightings.
• Help police. We may pass a report or a sighting to police where it will help recover a stolen vehicle, where someone is in immediate danger, or where the law requires it. The app does not automatically send each sighting into a police system. If you get a hit, the app gives you a way to call 000 yourself.
• Run the service. Accounts, push tokens, and alert areas exist so the right person gets the right alert. Proof-of-ownership documents exist so we can check that the person asking for a vehicle's location is connected to that vehicle, and so the service is not used to follow someone.
• Keep the service going. Vehicle sighting information may later be shared with partners such as insurers, as set out in section 4. That sharing is about the vehicle, not about selling your identity.

3. Who sees a sighting

• The spotter sees the plate and the vehicle description. The spotter does not see the owner's name, email, phone, or address.
• The owner of the reported vehicle receives the sighting location, time, speed, and photo when we have one. The owner is not shown the spotter's name or email.
• NICKD operators can see both sides, including owner contact details, so they can check reports and run the service.
• Other spotters who opted into nearby alerts may be told that a stolen car was reported in a suburb (plate, colour, make, model, suburb). That alert does not include the owner's contact details or the spotter's live location.

A confirmed stolen vehicle may also be posted to NICKD's Facebook page: the plate, the vehicle description, and a photo of the vehicle when we have one. Those posts do not include the owner's contact details or the spotter's name.

4. Sharing, police, and partners

Police. We may give police a stolen-vehicle report or a sighting (plate, time, location, photo, and the vehicle description) where we believe it will help recover the vehicle, prevent a serious threat, or where a warrant or other law requires it.

Service providers. Accounts, the database, photos, and push notifications are processed for us by Google Firebase. Email about a sighting or a report may be sent through our email providers. These providers handle the data so we can run NICKD. They are not the partners described above.

5. How long we keep it

• Plates that do not match: not stored on our servers. On a shift, the in-memory count of plates read is dropped when the shift ends.
• Sightings of a matched vehicle: kept while the case is open. When a vehicle is marked recovered we archive the case. The sighting record (plate, time, location, photo) may be kept after that as the record of the case.
• Account: name, email, push token, scores, and alert settings are kept while the account exists.
• Rolling alert location: overwritten about every ten minutes while you are scanning with nearby alerts on, and removed when the account is deleted.
• Proof documents and report photos: kept for as long as we need them to check the report and to keep the case record, unless you ask us to delete your account and those files are yours to delete under section 7.
• Website reports: kept as the vehicle report, including the contact details you typed, until the case is finished or you ask us to delete those details.

6. Security

Data is sent encrypted in transit (HTTPS / TLS) to Firebase Authentication, Firestore, Cloud Storage, and Cloud Messaging. Owner contact details are stored apart from the list of plates that spotters can read. The PIN for an owner's live map is stored only as a hash.

No method of storage is perfect. Do not send us anything you would not want held for a stolen-vehicle case.

7. Your rights, and deleting your account

Under the Australian Privacy Principles you can ask us for access to the personal information we hold about you, and ask us to correct it. Email admin@nickd.com.au.

You can ask us to delete your account. The app does not delete the account by itself. Use this page:

https://nickd.com.au/delete-account.html

In the app, open your profile and tap Delete account. That opens the same page. Send the request from the email on the account, with the subject "Account Deletion Request". We will delete the login, the profile (name, email, push token, alert area, scores), and the proof documents you uploaded, within 30 days of confirming it is your account. We will remove your account id from sightings you created. We may keep the vehicle facts in those sightings (plate, time, location, and the photo of the vehicle) because they are a record of the vehicle, not of your identity. We may keep a short record that we actioned the request.

If you are unhappy with how we handled your information, you can contact us first. You can also complain to the Office of the Australian Information Commissioner (OAIC).

8. Children

NICKD is not directed at children. We do not knowingly collect personal information from a child. If you believe we have, email admin@nickd.com.au and we will delete it.

9. Changes

We will post any change on this page and update the "Last updated" date. If you keep using NICKD after that date, the new policy applies.

10. Contact

Privacy questions, access and correction requests, and account deletion:

admin@nickd.com.au

NICKD, Victoria, Australia.