Who this policy is from

This policy is issued by Morgan Hughes, a sole trader in Queensland, Australia, ABN 13 299 011 756, operating under the name Sly Realms (“I”, “me”, “my”).

It covers:

• this website and everything published on it; and
• the Android applications listed below (Vape Tracker, Soda Tracker, Fast Food Tracker), together “the apps”.

It does not cover anything else you reach from here. Google Play, YouTube, TikTok, Instagram and Facebook each run under their own policies, and following a link off this site puts you under theirs.

What the apps keep on your device

Each app writes its records to local storage on your phone, inside the app's own private storage area. That data is not uploaded to me, is not backed up to any server I control, and is not readable by other apps. It goes when the app goes.

If your phone has Android's automatic backup enabled, Android may include app data in the backup it stores in your own Google account. That backup belongs to you and to Google, not to me — you can turn it off in your device settings under Google backup.

What the apps send off your device

Only two things leave your phone, and both are listed here in full.

1. Advertising

The apps display ads through Google AdMob. To do that, Google's Mobile Ads SDK collects information directly — it does not pass through me. Google has described this as including:

• your device's advertising ID (a resettable identifier, not your name);
• your IP address, and coarse location derived from it;
• device and app information such as model, operating system version and app version; and
• which ads were shown, viewed or tapped.

Ads are personalised only where you have consented to that or where personalisation is otherwise permitted in your region; where it is not, Google serves non-personalised ads instead. Google's handling of this data is governed by the Google Privacy Policy and by how Google uses information from sites or apps that use its services.

You can reset or delete your advertising ID at any time on Android under Settings → Privacy → Ads. Deleting it stops apps, including mine, from receiving one.

2. Product lookups in Soda Tracker

When you scan a barcode or search for a drink in Soda Tracker, the app queries the Open Food Facts database so it can return the product's name, brand and nutrition panel. The request contains the barcode or the search term and nothing else — no account, no log history, no advertising ID. As with any internet request, Open Food Facts will see the IP address it came from.

Open Food Facts is a not-for-profit, collaborative food database. Their handling of requests is governed by their own terms of use. Licence and attribution details are set out on the Attributions & Licences page.

Vape Tracker and Fast Food Tracker make no such requests. Apart from serving ads, they work entirely offline.

Health-related information

What you record in these apps — particularly nicotine use in Vape Tracker — can reasonably be described as sensitive information about your health under Australian privacy law. That is exactly why the apps are built to keep it on your device. I do not collect it, cannot access it, and have never sold, shared or disclosed it, because there is nothing for me to sell, share or disclose.

This website

When you visit Sly Realms, three things collect information.

• Google Analytics. This site uses Google Analytics 4 to count visits and see which pages get read. It sets cookies and records a truncated IP address, the pages you view, approximate location, and general device and browser details. It does not tell me who you are. You can block it with the Google Analytics opt-out add-on or with any standard content blocker.
• Hosting logs. The site runs on Google Cloud Run. Standard server logs record IP addresses, timestamps and requested URLs, and are kept only for security and troubleshooting.
• Embedded media. Pages that embed a YouTube or TikTok video load that player from the provider, which lets them set their own cookies and see your IP address. Google Fonts are served from Google's font servers on every page.

There are no visitor accounts, no comment system, no newsletter and no contact form on this site. The only login is my own, for publishing. If you email me, I keep that email so I can reply.

What I never do

• I do not sell, rent or trade personal information to anyone, for any purpose.
• I do not build profiles of individual users, or attempt to identify visitors.
• I do not collect names, addresses, phone numbers or payment details — nothing here charges money.
• I do not request contacts, photos, microphone or precise location permissions. Soda Tracker asks for the camera only if you choose to scan a barcode, and the image is processed on your device and not stored or transmitted.

How long anything is kept

• App data: on your device until you delete it or uninstall the app. There is no server copy.
• Analytics: retained by Google under the retention period set for this property, then deleted by Google.
• Server logs: retained by Google Cloud under its default log retention, typically 30 days.
• Emails you send me: kept while the matter is open and for a reasonable period afterwards.

Your choices and your rights

Australian privacy law gives you the right to ask what personal information an organisation holds about you, to have errors corrected, and to complain about how it has been handled. In practice, for the apps, the honest answer is that I hold nothing — but you are still entitled to ask, and I will answer.

• Delete your app data: clear the app's storage in Android settings, or uninstall it. Both are immediate and complete.
• Stop ad personalisation: reset or delete your advertising ID in Android settings.
• Stop analytics on this site: use the opt-out add-on or a content blocker.
• Ask a question or make a request: email me at the address below. I aim to reply within 30 days.

As a small-business sole trader I sit below the turnover threshold at which the Privacy Act 1988 (Cth) automatically applies. I have chosen to handle personal information in line with the Australian Privacy Principles regardless. If you are unhappy with my response, you can raise it with the Office of the Australian Information Commissioner.

Children

None of the apps are directed at children, and they are not listed in a children's category on Google Play. Vape Tracker is for adults aged 18 and over only. I do not knowingly collect personal information from a child. Since the apps hold data only on the device and send me nothing, there is no record for a parent or guardian to ask me to delete — but if you believe a child's information has reached me some other way, email me and I will remove it.

Overseas disclosure

I am based in Queensland, Australia. The third parties described above operate internationally: Google processes advertising, analytics and hosting data on servers in the United States and elsewhere, and Open Food Facts is based in France with servers in the European Union. Using this site or the apps involves those transfers.

Security

This site is served over HTTPS. The admin area is password-protected and CSRF-protected, and the session cookie is restricted to HTTPS. App data sits inside Android's per-app sandbox, protected by your device's own security. No system is perfect, and I cannot guarantee absolute security — but keeping data on your device rather than on a server of mine removes most of what could go wrong.

Changes to this policy

If an app starts collecting something new, or a new third party is added, I will update this page and change the date at the top before that change ships — not after. It is worth re-reading after a major app update.

Contact

Questions, corrections, privacy requests or takedown notices go to slyrealms@gmail.com.

Morgan Hughes, sole trader — ABN 13 299 011 756, Queensland, Australia.