Privacy Policy

SymbolTiles is an Australian digital service for creating, managing and sharing visual supports, learning resources and related materials.

For privacy enquiries, requests, complaints or assistance with your information, contact:

Email: hi@symboltiles.com

This Privacy Policy explains how SymbolTiles collects, uses, stores, processes and discloses personal information when you use the SymbolTiles website, mobile application and related services.

The information we collect depends on how you use SymbolTiles.

Account information

When you create or use an account, we may collect:

• your email address;
• your name or display name where provided;
• your account identifier;
• account role and preferences;
• authentication information handled through Base44;
• membership or subscription status;
• AI disclosure acceptance status, version and date; and
• other information necessary to operate your SymbolTiles account.

Passwords and authentication credentials are handled through Base44 authentication infrastructure and are not stored in the ordinary SymbolTiles application database in readable form.

SymbolTiles accounts are intended for people aged 18 years or older. New users are required to confirm that they are at least 18 before creating an account.

Content you create

SymbolTiles allows users to create and store content including:

• visual supports and learning materials;
• text, prompts, instructions and descriptions;
• goals, plans and notes;
• templates, folders, projects and resources;
• images and photographs;
• drawings;
• voice recordings;
• uploaded files;
• ratings and interactions with resources;
• characters, symbols and visual assets; and
• resources submitted to the Community Library.

Most user-created content is private unless you deliberately publish, share or otherwise make it available to others.

Client and learner information

SymbolTiles may be used by psychologists, allied-health practitioners, educators, carers, families and other professionals or support people.

Depending on how SymbolTiles is used, users may enter information about another person, including:

• a learner or client name, alias or identifier;
• interests and preferences;
• goals and progress information;
• session or support notes;
• behaviour support information;
• communication information;
• emotional check-in information;
• accessibility or support settings;
• photographs;
• drawings;
• voice recordings; and
• other information chosen by the user.

Some of this information may constitute sensitive information or health information under Australian privacy law.

Users must only enter information about another person where they have an appropriate legal, professional or other authority to do so.

Users should collect and enter only information reasonably necessary for the intended purpose. Where practical, identifying information should be minimised and aliases, initials or de-identified information should be used.

Support and bug-report information

If you contact SymbolTiles or submit a bug report, we may collect:

• your email address;
• the information contained in your report;
• page or feature information;
• browser or device information; and
• screenshots or files you choose to provide.

Bug-report screenshots may contain information visible on screen. Users should avoid including unnecessary sensitive information in support requests.

Technical information

SymbolTiles and its service providers may receive technical information necessary to operate, secure and maintain the service, including:

• IP addresses;
• browser and device information;
• request and server logs;
• authentication information;
• diagnostic information; and
• platform-level usage and analytics information.

SymbolTiles does not currently implement custom application analytics events or third-party advertising analytics SDKs. Base44 provides platform-level analytics as part of its hosting service.

Local browser or device storage is also used for authentication, navigation, interface and preference functions.

We do not sell personal information.

We do not use advertising networks within SymbolTiles.

We may use information to:

• create and maintain accounts;
• authenticate users;
• provide SymbolTiles functionality;
• create, save and retrieve resources;
• provide AI-assisted features requested by users;
• provide Community Library and resource-sharing functionality;
• recognise account permissions and membership status;
• provide technical and customer support;
• send user-initiated transactional communications;
• diagnose faults and maintain the service;
• protect SymbolTiles from misuse, fraud or security threats;
• comply with legal obligations; and
• maintain and improve the reliability of the service.

We do not use client or learner information for advertising.

We do not currently send marketing or promotional email campaigns using SymbolTiles account information.

SymbolTiles is a resource-creation and support tool. It is not designed or represented as an authoritative clinical record, medical record, diagnostic system or regulated health-record system.

Where SymbolTiles is used by a psychologist, health practitioner or other professional, that professional remains responsible for complying with their own legal, ethical, confidentiality, informed-consent and record-keeping obligations.

Psychologists are subject to professional requirements concerning privacy, confidentiality and the handling and transmission of client information. The Psychology Board of Australia states that psychologists must ensure clients understand how their information will be recorded, stored and used, and requires written and informed consent before disclosing, transmitting, sharing, reproducing or posting a person’s information or images, including where the person is not directly identified.

Accordingly, professional users should:

• obtain any required informed and written consent before entering, transmitting or sharing client information;
• explain relevant uses of technology and AI to clients;
• minimise identifying information;
• use de-identified information where practical;
• review AI-generated outputs using their own professional judgement; and
• retain any clinical or professional records they are independently required to maintain.

Deleting information from SymbolTiles does not remove a professional user’s independent legal or professional obligations to retain records elsewhere where required.

Some SymbolTiles features use artificial intelligence to generate or transform text, images or resources.

Before an account first uses an AI feature, SymbolTiles presents an AI privacy disclosure and requires an affirmative agreement before processing continues.

When an AI feature is used, information required to complete the request may be transmitted through Base44 infrastructure to third-party AI providers.

Depending on the feature, this may include:

• prompts and instructions;
• resource descriptions;
• learner or audience information;
• interests or goals;
• text contained in resources;
• reference information;
• images or image references; and
• other information intentionally provided to the AI feature.

Base44 currently uses external AI service providers that may include OpenAI, Anthropic and Google.

Processing may occur outside Australia, including in the United States.

SymbolTiles does not independently control which downstream AI model or provider Base44 selects for each request.

Base44 has not provided sufficiently specific public information for SymbolTiles to guarantee a particular retention period for every AI request or to make a blanket zero-retention representation.

Users should therefore avoid entering information that is not reasonably necessary for the task.

Where practical, identifying and sensitive information should be removed or minimised before using AI features.

Health practitioners using AI remain responsible for appropriate transparency, informed consent and professional oversight. Ahpra advises practitioners to understand how AI tools collect, store, use and disclose patient information, to inform clients about AI use and to obtain informed consent where personal patient data is required.

AI-generated content may be inaccurate, incomplete or inappropriate. It should be reviewed by the user before being relied upon or used with another person.

SymbolTiles does not currently use AI to make diagnoses, calculate clinical risk scores, make treatment decisions or make other significant automated clinical decisions about individuals.

SymbolTiles is built and hosted using Base44 infrastructure.

Base44 states that its default infrastructure and workspace storage are located in the United States. Some Base44 plans may provide additional data-residency options, but information may still be processed by service providers in other countries.

Accordingly, information entered into SymbolTiles may be stored or processed outside Australia.

Third-party service providers may also process information outside Australia.

Where applicable, Australian Privacy Principle 8 imposes obligations concerning disclosure of personal information to overseas recipients.

Users handling sensitive or professional information should consider these overseas-processing arrangements when determining whether SymbolTiles is appropriate for their use.

SymbolTiles relies on third-party providers to operate the service.

These may include providers for:

• hosting and databases;
• authentication;
• file and media storage;
• artificial-intelligence processing;
• email delivery;
• web-payment processing;
• logging and diagnostics; and
• technical infrastructure.

Base44 acts as the primary application-platform provider and uses subprocessors to provide its service.

Information is disclosed to service providers only where necessary for the relevant service or functionality, subject to applicable contractual and legal arrangements.

Email delivery

SymbolTiles uses email services for transactional and support communications.

Information transmitted through email services may include:

• recipient email addresses;
• resource titles;
• user-written email messages;
• share links;
• attached images or resources; and
• bug-report information.

Users should avoid including unnecessary sensitive information in emailed shares or support messages.

Symbol search

SymbolTiles may send individual search terms to external symbol-search services where required to return symbol results.

No SymbolTiles account identifier is intentionally included with those search requests.

Users should avoid placing identifying or sensitive information into symbol-search terms.

Stripe

Web-based SymbolTiles memberships are processed using Stripe.

Stripe may receive:

• account email address;
• SymbolTiles user identifier;
• subscription or transaction information; and
• payment information entered directly into Stripe-hosted services.

SymbolTiles does not receive or store full payment-card numbers entered through Stripe.

Stripe may retain transaction information independently where required by law, fraud-prevention requirements or its own applicable privacy obligations.

The iOS version of SymbolTiles does not process purchases within the app.

Users can deliberately publish certain content.

Community Library

Resources published to the Community Library may make information visible to other users, including:

• title;
• description;
• labels and resource content;
• images;
• tags;
• public creator information; and
• aggregated ratings.

Users must not publish confidential, identifying or sensitive client or learner information unless they have appropriate authority to make it public.

Creator profiles

A creator profile can be made public where the user chooses to do so.

A public creator profile may include information such as:

• chosen display name;
• avatar;
• profession;
• biography;
• interests; and
• broad location.

Public share links

Some resources can be made accessible through public or token-based share links.

Anyone who receives a valid link may be able to view the associated resource.

Users are responsible for deciding who receives those links and for ensuring they have authority to disclose information contained in the resource.

Published symbols

Users may contribute artwork to the shared SymbolTiles symbol library.

Shared symbol artwork may remain available after the contributing account is deleted where other users’ resources depend on that artwork.

SymbolTiles does not retain the account holder’s legal name by default in these shared records. Public creator attribution is retained only where the user has explicitly chosen a public creator identity.

Raw user-entered contextual prompts are not stored in shared SymbolAsset records. Shared symbol prompt metadata is limited to non-personal image-generation descriptions or is left blank.

On account deletion, retained shared-symbol attribution and prompt metadata are sanitised unless the user explicitly elected to retain public attribution.

Some SymbolTiles features may allow participation using a room or access code without requiring the participant to create a SymbolTiles account.

Information made available through these features is limited to the information intentionally included in the relevant activity or resource.

The account holder creating the activity remains responsible for ensuring that information shared through the activity is appropriate and authorised.

Older versions of SymbolTiles stored some uploaded files using permanent public media URLs.

This affected certain historical uploads such as:

• learner photographs;
• drawings;
• voice recordings;
• activity images; and
• bug-report screenshots.

New uploads in sensitive areas now use Base44 private storage and temporary signed URLs where supported.

However, Base44 currently does not provide SymbolTiles with an API to revoke or delete historical public storage objects.

As a result, an old public media URL may remain accessible to a person who already possesses that exact URL even after the associated SymbolTiles application record is removed.

These historical URLs are not intentionally indexed or distributed by SymbolTiles, but users should be aware of this technical limitation.

For assistance regarding historical uploaded information, contact:

Email: hi@symboltiles.com

Application records generally remain while the account or relevant resource remains active.

Base44 currently documents a recovery period for deleted entity records before permanent removal. Infrastructure backups, logs and file-storage objects may be subject to separate platform retention periods.

Base44 does not publicly document exact retention periods for every category of application logs or stored file object.

For that reason, SymbolTiles does not represent that every infrastructure copy is erased immediately when a user deletes information.

We retain or permit our service providers to retain information only for as long as reasonably necessary to:

• operate the service;
• complete requested functions;
• maintain security and reliability;
• meet legal or regulatory requirements;
• prevent fraud;
• resolve disputes; or
• satisfy legitimate record-retention requirements.

Payment providers may independently retain transaction information as required by law.

SymbolTiles provides an in-app account deletion function.

A user must deliberately confirm permanent account deletion.

The deletion process is designed to remove user-owned application information including:

• the SymbolTiles account;
• client and learner records;
• goals and sessions;
• behaviour plans and check-ins;
• user-created materials;
• templates, folders, projects, canvases and related resources;
• Community Library content owned by that account;
• creator profile information;
• ratings and account-linked records;
• share links associated with deleted resources; and
• other user-owned application records.

If an active web membership is associated with the account, SymbolTiles attempts to cancel it before completing account deletion.

The account is not deleted if a required deletion stage fails.

If some records are removed but another required deletion stage fails, the account remains active so deletion can be retried or support can assist.

Shared symbol artwork may remain where deletion would break other users’ resources, but associated personal attribution and prompt metadata are sanitised as described above.

Underlying file bytes, infrastructure backups, service logs or independent payment-provider records may remain where SymbolTiles cannot technically delete them immediately or where retention is legally required.

Apple requires apps that support account creation to allow users to initiate deletion of the account and associated personal data.

For deletion assistance, contact:

Email: hi@symboltiles.com

Depending on applicable law, individuals may have rights to:

• access personal information held about them;
• request correction of inaccurate information;
• request deletion of information;
• withdraw consent where relevant;
• make a privacy complaint; and
• ask how their information is being handled.

Users can modify or delete many records directly within SymbolTiles.

Requests can be sent to:

Email: hi@symboltiles.com

We may need to verify the identity or authority of the person making the request.

Where the information relates to a client or learner entered by another SymbolTiles account holder, we may need to consider the account holder’s authority, the rights of the individual concerned and applicable professional or legal obligations before acting on the request.

This Privacy Policy provides general information about how SymbolTiles handles personal information.

Additional notices may be provided when particular information is collected or before particular features are used.

This is consistent with Australian Privacy Principle 5, which requires appropriate notification about collection circumstances, purposes, usual disclosures and overseas disclosures where applicable.

The AI disclosure presented before first use of AI features is one example of a feature-specific notice.

SymbolTiles accounts are intended for adults aged 18 years or older.

SymbolTiles may nevertheless contain information about children or young people where an adult user creates resources for them.

Where information about a child or young person is entered into SymbolTiles, the account holder is responsible for ensuring that collection, use and disclosure is lawful and appropriately authorised.

Professional users must also comply with professional requirements concerning consent, capacity, parents or guardians and the rights of children and young people.

Users should minimise identifying and sensitive information about children and young people.

SymbolTiles uses technical and organisational safeguards intended to protect information from unauthorised access, disclosure, alteration, loss or misuse.

Measures include:

• authenticated accounts;
• access-control rules for private application data;
• private file storage for selected sensitive uploads;
• temporary signed URLs for private files;
• service-provider security controls; and
• account-deletion controls.

No online service can guarantee absolute security.

Users should avoid storing information that is not reasonably necessary.

If you become aware of a privacy or security concern, contact:

Email: hi@symboltiles.com

If SymbolTiles becomes aware of a data breach involving personal information, we will assess and respond to the incident in accordance with applicable legal obligations.

Where the Australian Notifiable Data Breaches scheme applies and a breach is likely to result in serious harm, affected individuals and the Office of the Australian Information Commissioner may be notified as required by law.

SymbolTiles may link to external services.

Where a third party processes information independently rather than solely as a SymbolTiles service provider, its own privacy policy and terms apply.

SymbolTiles does not control independent third-party privacy practices.

We may update this Privacy Policy where:

• SymbolTiles features change;
• service providers change;
• information-handling practices change; or
• legal or regulatory requirements change.

The current version will be available at:

https://symboltiles.com/privacy

The “Last updated” date shows when this policy was most recently revised.

Where a change materially affects how personal information is handled, additional notice may be provided where appropriate.

If you believe SymbolTiles has mishandled personal information, contact:

Email: hi@symboltiles.com

Please provide enough information for us to investigate the concern without sending unnecessary sensitive information by email.

We will review privacy complaints and respond within a reasonable period.

Where applicable, individuals may also have the right to complain to the Office of the Australian Information Commissioner.

For privacy enquiries, complaints, access or correction requests, account or data deletion assistance, security concerns or other privacy matters:

SymbolTiles

Email: hi@symboltiles.com

Australia