Privacy
What these websites collect.
Almost nothing. There is no analytics on any of these pages, no cookies, no tracking pixels, no advertising tags and no forms. The fonts are served from our own server rather than a font network, so loading a page here does not tell anyone else that you did. The products are a separate matter, and this page says where each one is documented.
The websites
These pages are static HTML. Nothing on them runs against a database, and nothing you do on them is recorded by us. The two interactive pieces, the rail simulator and the record cards on the Proof page, run entirely in your browser on figures written into the page. They send nothing anywhere.
- Cookies
- None. No consent banner either, because there is nothing to consent to.
- Analytics
- None. We do not know how many people visit, which pages they read or where they came from.
- Fonts and images
- Served from justsupply.org. No content delivery network, no font network, no embedded video or maps.
- Server logs
- Our web host keeps ordinary access logs, which include your IP address, the page requested and your browser's user agent string. That is standard hosting behaviour rather than anything we have set up, we do not analyse those logs, and we do not join them to anything else.
If you email us
Every contact link on this site opens an email to hello@justsupply.org. If you write to us we keep your message and your address so we can reply and carry on the conversation, and for no other purpose. We do not add you to a mailing list, and we do not pass your details to anyone outside the three organisations named on the who page.
Ask us to delete your correspondence and we will.
The products are documented separately
Counted, Heard and Proof handle worker data, and how they do it is the substance of the design rather than a footnote to it. Each product page sets out its own architecture in full, including what is never stored and why.
- Counted
- No worker account, no name, no phone number. Responses are not linked to any individual. Location is checked once to confirm on site presence, then discarded.
- Heard
- No account and no device identifier stored with a case. The four word reference is shown once and never stored, only a keyed hash of it. Case bodies are encrypted at rest and files are stripped of hidden location and author data.
- Proof
- Runs inside the deploying organisation's own environment. Records are read where they already sit, and nothing is shipped to us or to a third party.
Counted and Heard run on separate data stores by design. A census answer cannot be joined to a grievance, which is what lets a worker be candid in one without being identifiable in the other.
Where an organisation deploys one of these products, that organisation is the data controller for its own workers' data and its own privacy notice governs. We are the software provider. The deployment agreement sets out who holds what.
Who we are
Just Supply is a project of Catalyst Innovations Foundation, ABN 45 797 965 447, in Victoria, Australia. Questions about this page, or about anything above, go to hello@justsupply.org.
If we change how any of this works, we will change this page and move the date below.
Last updated 12 August 2026.