Privacy
What these websites collect.
Almost nothing. There is no analytics on any of these pages, no cookies, no tracking pixels, no advertising tags and no forms. The fonts are served from our own server rather than a font network, so loading a page here does not tell anyone else that you did. The products are a separate matter, and this page says where each one is documented.
The websites
These pages are static HTML. Nothing on them runs against a database, and nothing you do on them is recorded by us. The interactive pieces, the rail simulator, the record rows on the Proof page and the answer check on the Declared page, run entirely in your browser on figures written into the page. They send nothing anywhere.
- Cookies
- None. No consent banner either, because there is nothing to consent to. The theme button at the foot of each page keeps your light or dark choice in your own browser and sends it nowhere.
- Analytics
- None. We do not know how many people visit, which pages they read or where they came from.
- Fonts and images
- Served from justsupply.org. No content delivery network, no font network, no embedded video or maps.
- Server logs
- Our web host keeps ordinary access logs, which include your IP address, the page requested and your browser's user agent string. That is standard hosting behaviour rather than anything we have set up, we do not analyse those logs, and we do not join them to anything else.
If you email us
Every contact link on this site opens an email to hello@justsupply.org. If you write to us we keep your message and your address so we can reply and carry on the conversation, and for no other purpose. We do not add you to a mailing list, and we do not pass your details to anyone outside the three organisations named on the who page.
Ask us to delete your correspondence and we will.
The products are documented separately
Counted, Heard and Proof handle worker data, and how they do it is the substance of the design rather than a footnote to it. Each product page sets out its own architecture in full, including what is never stored and why.
- Counted
- No worker account, no name, no phone number. Responses are not linked to any individual. The phone reads its location once, when the worker starts; it is checked with the answers on submit to confirm the worker is on site, then discarded. Just Supply collects the answers directly from workers and holds them, so Just Supply is responsible for that data and handles it in line with the Australian Privacy Principles. The employer receives group totals only, never a worker's answers. The worker-facing detail is on Counted's own privacy page, linked from its consent screen.
- Heard
- No account and no device identifier stored with a case. The three word case code is shown once and never stored, only a keyed hash of it. Case bodies are encrypted at rest and files are stripped of hidden location and author data.
- Proof
- Stored and processed in Sydney on AWS, with each organisation reading only its own records. A dedicated instance runs wherever a client asks.
Counted, Heard and Proof store and process their data in Sydney on AWS. Counted and Heard run on separate data stores by design. A census answer cannot be joined to a grievance, which is what lets a worker be candid in one without being identifiable in the other.
Where an organisation deploys Heard or Proof, that organisation is the data controller for its own workers' data and its own privacy notice governs. We are the software provider. The deployment agreement sets out who holds what.
Who we are
Just Supply is a project of Catalyst Innovations Foundation, ABN 45 797 965 447, in Victoria, Australia. Questions about this page, or about anything above, go to hello@justsupply.org.
If we change how any of this works, we will change this page and move the date below.
Last updated 15 October 2026.