FcPal ← Back to site

Privacy Policy

Last updated: 9 September 2026

This policy explains what personal information we collect, why we collect it, who we give it to, how long we keep it, and what you can do about it.

1. About this policy

FcPal is operated by Nathans Mad Pty Ltd, ABN 44 664 001 012, a company registered in Australia. In this policy, “we”, “us” and “our” mean Nathans Mad Pty Ltd, and “you” means the person using FcPal.

This policy applies to the FcPal app on iOS and Android, our websites at fcpal.com, fcpal.com.au and app.fcpal.com, and any channel you use to contact us. It does not apply to other companies’ services. If you leave FcPal through a link, or pay through Apple or Google, that company’s privacy policy applies to what it does with your information.

We are based in Australia and bound by the Privacy Act 1988 and the Australian Privacy Principles. This document is our privacy policy for the purposes of Australian Privacy Principle 1.

2. Age

You must be 18 or over to create or hold an FcPal account. We ask for your date of birth when you sign up, and you cannot create an account if you are under 18.

If we become aware that an account holder is under 18, we will close the account, remove access to it, and delete the personal information we hold about that person, unless we are required to keep records for legal, safety or law enforcement reasons.

If you believe someone under 18 is using FcPal, report the account in the app or contact us using the details in section 16.

3. Information we collect

We only collect personal information that is reasonably necessary for running FcPal.

3.1 Information you give us

Account information. Your mobile number, email address, password, username, display name, date of birth and profile photo.

Profile information. Anything else you choose to add, such as a bio, gender, interests or links. This is optional and you can remove it at any time.

Your content. Messages you send, Pick a Line posts, photos, videos, live broadcasts, comments, reactions and information attached to them, such as when they were created and who they were sent to. What we can and cannot see of your messages and calls is explained in section 12.

Purchases. A record of the Token packs you buy, your balance, and gifts you send and receive. We do not receive or store your card number. Payment details go directly to Apple or Google.

Messages to us. Anything you send when you contact support, report another user, appeal a decision, or answer a survey.

3.2 Information we collect when you use FcPal

Activity needed to run FcPal. The records that make the app work: your conversations and who they are with, what you have posted, who you follow, and what you have bought.

How you use the app. We collect a limited record of how the app is used, so we can see which parts people reach and where they run into trouble. This covers the screens you open, how long a post or story stays on your screen, how far through a video you get, whether you reacted, commented or shared, and how far you get when creating a post. We also record which app version and device you are using, and the country and city your connection appears to come from.

This record is tied to your account, so that we can count people rather than devices. It does not include what you typed, who you messaged, what you searched for, or which particular post it was — only that a post of that kind was viewed. Google provides this service for us; see sections 9 and 10.

Your device. Device model, operating system and version, app version, language, time zone, a device identifier, and your push notification token.

Network. Your IP address, and the approximate location we work out from it, usually to the level of a country or region. FcPal does not request or collect precise device location, and the app does not ask for location permission.

Diagnostics. Crash and error reports, so we can find and fix faults. These are configured not to include your IP address, screenshots, or a copy of what was on your screen, and they are only collected from released versions of the app.

3.3 Information we collect only if you allow it

We ask before we use any of these, and you can change your mind at any time in your device settings.

Turning off a permission does not delete information we have already collected, but it stops us collecting more.

3.4 Information from other people

3.5 What we do not collect

4. FC Mode and your camera

FC Mode protects a conversation while you have it open. It sits on top of the encryption described in section 12: encryption protects your messages from anyone who is not in the conversation, and FC Mode protects them from someone standing behind you.

Because FC Mode uses your camera the whole time the conversation is open, this section sets out exactly what it does with what it sees.

You choose when FC Mode runs

FC Mode is not automatic. You start a conversation in FC Mode yourself, and the first time you do, we explain what it does before it starts.

By choosing to use FC Mode, you consent to the processing described in this section happening on your device. You can withdraw that consent at any time by not using FC Mode, or by turning off camera permission in your device settings. If you turn camera permission off, FC Mode becomes unavailable and the rest of FcPal keeps working.

What FC Mode does

While a conversation is open in FC Mode, FcPal runs three checks at the same time, for as long as the conversation is open:

If a second face appears, if the person in front of the screen is no longer you, or if your phone is moved or turned suddenly, FcPal hides the conversation straight away. The face count check works even if you are still in front of the camera, so a conversation is hidden when someone leans in beside you.

To check whether the person is still you, the app converts what the camera sees into a numerical representation of the face in front of the screen, a mathematical summary rather than a picture, and compares it to the one it made when you opened the conversation. If they stop matching for several frames in a row, the app assumes someone else is looking.

This representation is a form of biometric information, so we are specific about what happens to it.

Nothing FC Mode sees ever leaves your phone

Camera images are analysed as they are captured. They are never saved to your phone’s storage and never sent to us or anyone else. The facial representation exists only in the app’s temporary memory while the conversation is open, is never written to storage, is never included in crash reports or diagnostics, and is discarded when you close the conversation. We never receive it, and we could not obtain it.

Motion sensor readings and the face count are handled the same way. The only thing FC Mode produces is a decision about whether to hide your conversation, and that decision stays on your phone. We are not told when FC Mode hides a conversation, or why. FC Mode works with no internet connection, because it does not need one.

What FC Mode does not do

FC Mode does not identify you. It compares one face to another face seen moments earlier on the same phone. It does not know who you are, does not compare you against any database, and does not build a profile that persists between conversations.

Screen recording

On Android, FcPal can detect when your screen is being recorded, so it can protect a conversation the same way. This happens entirely on your phone. Nothing about it is sent to us: we do not receive the recording, anything from your screen, or any notice that it happened.

How FC Mode differs from the checks in section 6

FC Mode only looks at what is in front of your screen while a protected conversation is open, and nothing it sees leaves your phone. That is separate from photos, videos and broadcasts you post to FcPal, which are sent to us and are checked as described in section 6.

5. How we use your information

We use your personal information to:

We will not use your personal information for any other purpose without telling you first.

6. Checking content on FcPal

We check images and videos you post to FcPal for material that breaks our Community Guidelines, such as nudity and sexual content. The check is carried out automatically by a service provider on our behalf, which analyses the image or video and returns a result to us. The provider acts only on our instructions.

We do not check the content of your private messages or calls, because they are end-to-end encrypted and we cannot read them. This is explained in section 12. If someone reports a message to us, the person reporting chooses to send us a copy from their own device. That is the only way we ever see private message content, and we only see what the person reporting has sent.

Decisions we make automatically

Some decisions about your content and your account are made by a computer program, without a person reviewing them first.

What is decided. Whether content you post breaches our Community Guidelines, whether to remove or restrict it, and whether to limit, suspend or close your account.

What information is used. The images and videos you post, the information attached to them, reports other people make about you, and the record of any previous decisions about your account.

How to contest a decision. Contact us using the details in section 16. A person will review the decision and we will tell you the outcome.

7. Tokens and gifts

Tokens are described in full in our Terms. This section covers only what happens to your information.

Buying Tokens. We record what you bought, when, and how many Tokens you received. Apple or Google handles the payment, and we do not see your card details.

Gifts. We record gifts against both accounts.

Creator payouts are not available yet. We do not currently collect identity documents, tax details or bank account details from anyone. If we introduce payouts, we will update this policy before collecting that information.

We are required to keep financial records for seven years under section 286 of the Corporations Act 2001. We keep them even after you delete your account.

8. What other people can see

FcPal is not public. You need an account and you need to be signed in to see anything. No profile, post or broadcast is visible on the open web, and none of it is indexed by search engines.

What Who can see it
Username, display name, profile photo and bio Anyone signed in to FcPal
Posts, Pick a Line posts, comments and reactions The audience you choose for each post: everyone, your followers, people you pick, or only you
Anything on a private account Only followers you have accepted
Live broadcasts The audience you choose for each broadcast: everyone, your followers, or people you pick. Anyone in that audience can join while you are live
Private messages and calls Only the people in the conversation. Not us
Token balance and purchase history Only you and us
Date of birth, phone number and email address Only you and us

Anything you make visible to others can be screenshotted, saved or copied by anyone who sees it. We cannot prevent that.

9. Who we share information with

We do not sell your personal information and we do not share it for advertising.

Service providers

We share personal information with organisations that provide services to us. They may only use it to provide that service, and only on our instructions. They provide:

None of them can read your private messages or calls. Some of these organisations are named in section 10. You can ask us about any of the others by contacting us.

Legal and safety

We share personal information where we reasonably believe it is necessary to comply with a law, a warrant, a subpoena or other legal process; to respond to a regulator such as the eSafety Commissioner or the Office of the Australian Information Commissioner; to investigate or enforce a breach of our Terms or Community Guidelines; to prevent fraud, security problems or technical problems; or to protect the safety, rights or property of our users, the public or us.

If we are required to hand over your messages, we can only provide them in the encrypted form we hold, because we do not have the means to read them.

If our business changes

If we are involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of it. We will tell you before your information becomes subject to a different privacy policy.

10. Where your information is stored

FcPal runs on Amazon Web Services. Our application servers are in Sydney, Australia. Some information is processed in other regions: live streaming in Tokyo, Japan, and video processing in the United States. Push notifications and usage analytics are handled by Google, and error monitoring by a third party provider. These may process information in the United States and in Europe.

This means your personal information may be stored or processed in Australia, Japan, the United States, and countries in Europe.

Before we disclose personal information overseas we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles, as required by Australian Privacy Principle 8.

11. How long we keep information

Information How long we keep it
Account information Until you delete your account, then 30 days, then erased. During those 30 days the deletion can be cancelled, as described below
Messages Held on our servers in encrypted form so your devices can sync your history. We cannot read them. Deleting your account deletes them
Posts, photos, videos and recorded broadcasts Until you delete them, or 30 days after you delete your account
Anything FC Mode sees Never stored. Analysed on your phone and discarded
Content check results 12 months, so decisions can be appealed and reviewed
Crash reports and error logs 90 days
Usage analytics 14 months
Server and website access logs 30 days
Backups 30 days, then overwritten
Purchase records Seven years, as required by the Corporations Act 2001

When we no longer need personal information, and we are not required by law to keep it, we destroy it or de-identify it.

Where we are required by law to keep something, or where an account is being investigated, we keep it for as long as that lasts.

Deleting your account

You can delete your account from inside the app. We ask you to confirm your password first, so that nobody else can delete it for you.

Deletion is scheduled rather than immediate. Your account is closed straight away and stops being visible to other people, and everything we hold about you is erased 30 days later. During those 30 days the deletion can be undone: if you sign in again, we will offer to restore your account, and doing so cancels the erasure. After the 30 days it cannot be undone.

The grace period exists so that an accidental or impulsive deletion can be recovered. If you would rather your information were erased without waiting, contact us using the details in section 16.

12. How we protect your information

Your messages and calls are end-to-end encrypted

Private messages on FcPal are end-to-end encrypted, in one to one conversations and in group conversations. Your message is encrypted on your device before it is sent, and it can only be decrypted by the people in the conversation. We cannot read it. Nobody who obtained it from our servers could read it either.

This covers photos, videos and files you send in a conversation as well as text. They are encrypted on your device before they are uploaded, so what we store is unreadable to us. Voice and video calls are end-to-end encrypted in the same way.

The keys that decrypt your messages are generated on your device and kept in your device’s secure storage. We never receive them and could not obtain them. The practical limit of that is your device itself: anyone who can use it while it is unlocked, or who can restore its backups, may be able to read your messages.

This is why we do not check private messages for content, why we cannot use them for any purpose, and why we could not hand over their contents even if we were legally required to. Push notifications about a message carry the encrypted content and a generic label such as “New message”. Your device decrypts it, not our servers.

End-to-end encryption protects what you say. It does not hide everything:

Other protections

We also:

No system is completely secure. If a data breach happens that is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme.

13. Your choices and your rights

In the app

Your rights

Under the Privacy Act 1988 you can ask us for a copy of the personal information we hold about you, ask us to correct it if it is wrong, and ask us to delete it, subject to the records we are required to keep under section 11. You can withdraw consent where we relied on it, and you can complain if you think we have mishandled your information.

If you ask for a copy of your information, we cannot include the content of your private messages, because we cannot read them.

You can deal with us anonymously or using a pseudonym where that is lawful and practical, although this is not possible for an FcPal account because we have to confirm your age. You can read our website without telling us who you are.

To make a request, delete your account in the app, or contact our Privacy Officer using the details in section 16, including if you can no longer access the app. We will ask you to confirm your identity so that we do not give your information to someone else. We will respond within 30 days and we do not charge for these requests.

Complaints

Contact our Privacy Officer first and we will investigate. We will acknowledge your complaint and respond within 30 days.

If you are not happy with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

14. Our website

Our website does not set cookies and carries no advertising or social media tracking. When you visit, our hosting provider records standard access information: the pages you view and when, your IP address, and your browser and device type.

Our pages load fonts from Google Fonts and animation code from a public code delivery network. Those providers receive your IP address as part of serving the files. They do not set cookies for us and we do not receive anything from them about you.

The FcPal app does not use cookies, although it does use the device identifiers described in section 3.2.

15. Changes to this policy

We may update this policy. If we do, we will change the date at the top. If a change materially affects how we handle your personal information, we will tell you in the app or by email before it takes effect.

16. Contact us

Nathans Mad Pty Ltd, ABN 44 664 001 012

Our Privacy Officer is responsible for how we handle personal information, and for privacy questions, requests and complaints.