Privacy Policy
Last updated 28 September 2026
1. About this policy
This policy explains how BibSwap handles personal information on the website (bibswap.com.au) and in the BibSwap app. BibSwap is operated by BibSwap (ABN 28 369 872 983), based in Sydney, New South Wales, Australia, and handles personal information in line with the Australian Privacy Principles and, for members in New Zealand, the New Zealand Privacy Act 2020. Questions: hello@bibswap.com.au.
2. What we collect
Account: your email address. You sign in with a link or code sent to it; we do not store a password.
Profile: your handle, the name you give when you list an entry, the month you joined, your completed swaps and your level.
Listings: the race, price, notes, and the contact email and phone number you give for the listing. Contact details are encrypted before they are stored.
Proof of entry: if you link a Race Roster confirmation, we read that page and keep the event name, distance, entrant name and the last four digits of the confirmation number. The link and the full confirmation number are stored only as one-way hashes, to detect the same entry being listed twice. If you upload a screenshot, we store the image privately; only BibSwap staff reviewing it can see it.
Enquiries and messages: an enquiry's first message and the buyer's email address (encrypted). Later messages pass through our email relay and are held by our email provider. Messages are scanned automatically for blocked payment methods.
Swaps: each member's answers as a swap progresses, and any feedback if it goes wrong. When a buyer confirms they are ready, the first name and surname they give are stored against that swap.
Bib alerts: your email address (encrypted) and a one-way hash of it, used to recognise a repeat request.
Mobile verification (optional): the last three digits of the number and a one-way hash of it. The full number is not stored.
Reports and blocks: reports you make, with your account, and the members you block.
Newsletter and contact form: your email address if you subscribe; your name, email and message if you use the contact form.
App: your device's notification token, if you turn notifications on.
Technical: our sign-in provider records the IP address, browser or device and time of each sign-in. Our hosting keeps server logs. Rate-limit counters use hashed keys, not raw addresses.
3. How we use it
to run your account, publish listings and relay messages between members;
to check proof of entry and verified mobiles, and to show the related badges;
to send the emails and notifications a swap needs, and bib alerts you asked for;
to prevent and investigate fraud and abuse, including duplicate accounts, and to act on reports;
to understand how the website is used (see section 7);
to meet legal obligations.
We do not sell personal information or use it for advertising.
4. What other members can see
On listings: your handle, the month you joined, your completed swaps, your level, any badges (entry checked, mobile verified), the price and your listing notes. Your name, email and phone number are not shown.
In a swap: a buyer who enquires about your entry and is asked to confirm they are ready is told your first name. When a buyer confirms they are ready, the seller receives the buyer's first name, surname and email address, to complete the event's transfer process. A seller's email address is never given to a buyer.
Messages: the other member reads the messages you send them.
5. Who we share it with
We use these suppliers to run BibSwap. Each receives only what its job needs.
Supabase: database, sign-in and file storage. Holds all of the above.
Resend: sends our emails and runs the message relay.
Vercel: hosts the website.
Google Analytics: website usage statistics (website only).
Twilio: checks the number type and sends the code, if you verify your mobile.
Expo and Apple: deliver app notifications, if you turn them on.
Race Roster: we request the confirmation page you link to. We send Race Roster nothing else.
These suppliers store and process information outside Australia and New Zealand, including in the United States. We do not give your details to race organisers; you deal with the organiser directly when you transfer an entry. We will disclose information where the law requires it.
6. Automated checks
Some decisions are made automatically. A Race Roster confirmation that matches the listing is approved without review; one that doesn't is held for a person to check. Messages naming a blocked payment method are not delivered, and the sender is told why. If a buyer doesn't answer the question "did the entry arrive?" within 5 days (and at least 2 days after a reminder), the swap is recorded as completed. You can ask us to review any of these by emailing hello@bibswap.com.au.
7. Cookies and analytics
The website uses cookies to keep you signed in. It also uses Google Analytics, which sets cookies and receives your approximate location, browser and the pages you view; we do not send it your name or email. You can block cookies in your browser or use Google's opt-out add-on. The app does not use analytics or advertising tracking.
8. How long we keep it
We keep your information while your account is open. Listings that expire or are withdrawn stay in your account history.
Deleting your account removes your account, profile, listings, enquiries, swap records, bib alerts, proof of entry (including screenshots), mobile verification and notification tokens. Bib alerts made without an account can be cancelled from the link in any alert email. Copies of emails held by our email provider are deleted under that provider's retention schedule.
9. Security
Contact details, buyer email addresses and alert email addresses are encrypted before storage. Database access is restricted per member by the database itself. We do not store passwords. No system is completely secure; if a data breach is likely to cause you serious harm, we will notify you and the regulator as the law requires.
10. Your rights
You can delete your account from My Account, on the website or in the app.
You can ask for a copy of the information we hold about you, or ask us to correct it, at hello@bibswap.com.au.
Every alert and newsletter email has an unsubscribe link that works without signing in.
You can remove a verified mobile from My Account at any time.
11. Children
BibSwap is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe we have, email hello@bibswap.com.au and we will delete it.
12. Changes to this policy
The date at the top shows when this policy last changed. We will email you about significant changes.
13. Contact and complaints
Privacy questions and complaints: hello@bibswap.com.au. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz).