Numbat by AI4WA
Ask Numbat

Privacy

Last updated:

This page describes what Numbat actually does with your information: what it collects, why, who it is shared with, where it is kept, how long it is kept and how you can remove it.

Who runs Numbat

Numbat is an independent project by AI4WA. It is not a government service. You can contact AI4WA at [email protected].

What Numbat keeps on its server, and why

Apart from short-lived use of your IP address and the server's technical logs (both below), Numbat's server keeps information about you only when you ask for a sign-in code or sign in:

  • Your email address. When you ask for a sign-in code, Numbat stores your email address with a scrambled (hashed) copy of the code, so it can check the code you type. When you enter the code, Numbat creates your account, which holds your email address. It is used to sign you in and to send you the sign-in code. Numbat does not send you other email.
  • Your chats. While you are signed in, each conversation (your messages, Numbat's answers, the sources shown and the council in use) is saved to your account so you can come back to it.
  • Your saved location, if you add one. While you are signed in, the suburb, or the street address and suburb, that you choose in the location box is saved to your account, so answers can use it in later chats.
  • Your children, only if you choose. If you tick “Save children to my account”, each child's birthday and any name or nickname you entered are saved to your account so they are on your other devices. The due date is never saved to your account, and this account copy is never sent to the AI model.
  • Your IP address, briefly. Your IP address is used to limit how many questions and sign-in attempts can be made. It is kept as a counter that expires after one minute or one day (one hour for the site administrator sign-in page), and the nightly clean-up deletes expired counters. A sign-in code request also stores a scrambled (hashed) form of your IP address, used to limit how many codes are requested.
  • Technical logs. Numbat's server programs write logs of their activity. The log of requests records the time and web address of each request, which for a map of nearby places includes the suburb. It does not record your IP address or what you type into a chat. Database error messages in the logs can occasionally include an email address.

If you do not sign in, Numbat's server does not save your questions, chats, location or family details, except that a suburb used for a map appears in the request log. It uses them to answer you and then discards them.

What stays in your browser

Some information is saved only in your web browser, on the device you are using (in its local storage). Numbat's server cannot see it there:

  • ai4wa.chats.v1: your chats when you are not signed in.
  • ai4wa.kids.v2: your family details: your due date, your children's birthdays and any names or nicknames.
  • ai4wa.location.v1: your chosen suburb or address when you are not signed in.
  • numbat.tour.v1: whether you have finished or skipped the quick tour.

Clearing this site's data in your browser removes all of them.

Cookies

Numbat sets two cookies, both its own and both needed for the site to work:

  • aiwa_csrftoken: protects your account from requests sent by other websites.
  • aiwa_sessionid: keeps you signed in. It is set when you ask for a sign-in code and lasts up to two weeks, or until you sign out.

Numbat has no analytics, advertising or tracking cookies, and loads no third-party scripts or fonts in your browser.

Who Numbat shares information with

  • OpenRouter (AI answers). To answer a question, Numbat's server sends OpenRouter, a US-based service, your question, up to the last 12 messages of the conversation, your chosen suburb (not your saved street address, unless you type it into a message) and, if you added family details, each child's approximate age in months and the pregnancy week. OpenRouter passes it to the AI model that writes the answer; the model currently configured is Google's Gemini 3.1 Flash Lite. Names, birthdays, your due date and your email address are not sent. Some supported questions are answered from reviewed records without any call to the AI model.
  • Geoapify (addresses and maps). If you tap the button to use your current location, your browser asks your permission and then your device's coordinates are sent to Geoapify to suggest a nearby address. If you ask about bin collection with a City of Stirling street address, that address is sent to Geoapify to find the property. Maps of nearby places are drawn by Geoapify from your suburb's centre point and the official places listed, not from your address. Numbat does not store the coordinates or Geoapify's full responses; it keeps only an address you choose to save, with Geoapify's credit line.
  • City of Stirling (bin dates). For a City of Stirling bin question with a street address, the property's map coordinates are sent to the City of Stirling's public bin-collection lookup to get your next collection dates.
  • Microsoft Azure Communication Services (sign-in email). Your email address and sign-in code are passed to Azure Communication Services, which delivers the sign-in email.
  • Cloudflare (network). All traffic to numbat.ai4wa.com passes through Cloudflare, which connects the website to Numbat's server. Cloudflare passes your IP address on to Numbat for the limits above.

Each of these services handles the information under its own terms.

Where it is stored

Your account, chats, saved location and any saved children are kept in Numbat's database, on a server run by AI4WA that Cloudflare connects to the internet. The database is copied every night to backups on that server and on a separate network storage device run by AI4WA.

How long it is kept

Your account, saved location and any saved children are kept until you delete them, or until AI4WA deletes them at your request. They are never deleted automatically.

Chats saved to your account are kept until you delete them, until AI4WA deletes them at your request, or until you have not opened or changed them for more than one year (365 days), when the nightly clean-up described below deletes them. When you come back to Numbat it opens your most recent chat, and that counts as opening it. Chats saved only in this browser are not deleted automatically. You can keep up to 200 chats.

The following are deleted automatically by a clean-up that runs every night, just before the nightly backup:

  • Sign-in code requests (your email address, the hashed code and the hashed IP address) are deleted once they are more than one year (365 days) old. Usually they go much sooner: any request more than a day old is deleted the next time anyone asks for a code. Each code itself stops working after 10 minutes.
  • The server's record of a sign-in session is deleted the first night after the session expires. Signing out deletes it straight away.
  • The IP-address counters used for the limits are deleted the first night after they expire.
  • Chats saved to your account are deleted once more than one year (365 days) has passed since you last opened or changed them.
  • The site administrator's log of changes made in the admin area, which can name an account that was changed, is deleted once an entry is more than one year old.

Technical logs are not kept for a set time. Each part of the server (the website, the answering service and the database) keeps at most five log files of 10 MB each; when that limit is reached, the oldest file is deleted.

Nightly backups are kept for 14 days, and one backup a week is kept for 8 weeks. Something that you delete, or that the clean-up deletes, can therefore remain in a backup for up to about 8 weeks.

Your choices

  • You can read official information and the family journey without an account. Asking questions needs you to sign in with your email.
  • Delete a saved chat from Chats, using its Delete button. This removes it from your account or from this browser.
  • Remove your location in the location box with Remove location.
  • Remove your children's account copy with Remove from account in the family box, and forget the browser copy with Forget family details in this browser.
  • Don't add family details or a location if you don't want them used in answers; Numbat still answers without them.
  • To delete your whole account, including your email address, email [email protected] from the address you sign in with. There is no button for this on the site yet.

Contact

For a question about this page, or to ask what Numbat holds about you or to have it deleted, email [email protected]. See also the Numbat FAQ.