Security & Data Protection

All data is encrypted in transit using TLS 1.2 or higher — the same standard used by banks. Your browser or phone connects to our servers over an encrypted channel, so no one can read your records while they travel across the internet.

All data is encrypted at rest using AES-256 — the same standard used by government agencies. Your records are unreadable on disk even if storage hardware were ever physically accessed.

MusterMate is hosted on Supabase in the ap-southeast-2 (Sydney, Australia) region. Your farm records never leave Australian data centres during normal operation.

The only exceptions are when you access the app from a browser — static app files (HTML, CSS, JavaScript) are served via Vercel's global CDN for speed. These files contain no farm data; they are the same code every user downloads.

Every database query is protected by Row Level Security (RLS) — a database-level rule that ensures you can only ever read or write your own farm's data. Even if there were a bug in the application code, RLS would prevent one farm from seeing another's records.

Farm members you invite via Settings → Farm Members are granted access only to your farm. They cannot see any other farm's data on the platform.

Passwords are hashed with bcrypt and never stored in plain text. We do not have access to your password.

MusterMate works offline by storing a local copy of your records in your browser's built-in database (IndexedDB) on your device. This copy is only accessible to the MusterMate app on that device — other apps cannot read it.

When your device reconnects to the internet, changes are automatically synced to the cloud. Your records are safe even without internet access.

You own your farm records. We do not sell, share, or use your data for advertising. You can export everything at any time from Settings → Your data as a CSV bundle or full JSON backup. No lock-in.

If you close your account, your data is soft-deleted for 30 days (allowing recovery), then permanently and irreversibly deleted from all systems including backups.

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Request deletion of your personal information
• Complain if you believe your privacy rights have been breached

Most of these actions are available directly in the app. For anything else, email privacy@mustermate.app and we will respond within 30 days.