What we hold about you, who can see it, where it is kept, and what you can ask us to do with it.
Last updated 4 October 2026.
This covers RedCurtain, the software. Each group using it decides what to record about its own members, so a group is responsible for its own records and we are responsible for the system holding them. If you want something changed about you, your group is usually the faster answer; if they cannot help, we can.
Amateur theatre has children in it, and the app has fields for a parent or guardian: a name, an email, a phone number and the relationship. If a young person is on a group’s register, the group is responsible for having the consent it needs from whoever is responsible for them, under the law of its own state.
A guardian can ask us for anything in this policy on behalf of the young person they are responsible for.
These are details about somebody who never signed up here. We use them for nothing except the purpose they were given for — someone to ring if something happens — and they are shown only to the people in the group who would need to make that call. We do not email them, add them to any list, or use them to make an account.
If you are an emergency contact and would rather not be, tell the group or tell us and we will remove you.
These are Working With Children Checks, police checks, first aid certificates, RSAs and food safety certificates — what it is, which state issued it, and when it expires. There are two separate ways one can be here, and the difference matters.
You can keep your own checks in My RedCurtain, so you enter a Working With Children Check once rather than once per group. These belong to you.
A check you add is shared with nobody until you say so. You choose group by group, and you can withdraw a group’s access at any time. There is also a standing choice to share with every group you belong to, including ones you join later — that one is consent given in advance, so it is worth being deliberate about, and you can turn it off.
A group you have not shared with cannot see that the check exists.
Separately, a committee can record a check it has sighted itself, the way it would in a folder in the office. That record belongs to the group rather than to you, because it is the group’s evidence that it did its own checking — but you can ask the group, or us, what it says about you and to correct it.
The full number is never shown and never leaves the database. Every screen, report and export shows only the last four characters, with the rest replaced by asterisks. That is not a setting somebody can turn off: the masked form is computed by the database itself, and the application has no permission to read the unmasked column at all.
We do not verify checks, and recording one here is not a substitute for a group’s own obligations under its state’s child safety laws. Those obligations differ between states and they remain the group’s.
We never see a credit card number. Payments go to Stripe directly from your browser and into the group’s own Stripe account. We record what was paid, when, and for what — never the credit card itself. We never hold a group’s takings either.
A group sees its own records and nobody else’s. One group cannot see another group’s members, money or productions, and that is enforced by the database rather than by the screens — a page that forgot to check could still not return somebody else’s data.
Inside a group, committee members are given particular permissions — the register, the books, the shop, and so on — and see only what those permissions cover. Someone running auditions does not thereby see the bank balance.
Your public listing is the small part you choose: a group’s own page shows its productions and the people it has chosen to put on it. A member’s details are not public.
Your name sits in two places, deliberately. There is the name on your own account, which is yours, and there is the name on each group’s register, which is that group’s record of who you are to them. You can change your own whenever you like, in My RedCurtain. Doing so changes no group’s register, and no group can change your account.
What it does do is tell them. Every group you are a current member of is shown that you now go by something else and asked whether to update its own records, so expect your groups to find out when you change it. That is deliberate, and it is in your interest: the alternative is a group carrying on with the old name — on a cast list on its public page, in a program, in an email to the whole company — with nobody aware there is anything to put right.
Each committee then decides, record by record, what to bring into line: its register, and your name on past productions, production teams, audition panels and committee positions. Nothing changes on its own, and a group may update all of it, some of it or none of it. If a group leaves an old name where it is, that is the group’s decision rather than ours, and the group is who to ask about it.
Names on history are held as they were at the time, which is why there is anything to decide. A cast list from 2019 keeps the name you were cast under until that committee chooses otherwise. The books do not move either way: a membership payment records who paid, as they were called on the day, because that is an accounting record and not a description of you now.
We use four other companies, and no advertisers or data brokers:
Stripe may also process some information overseas. Apart from those two, we do not disclose personal information to anyone outside Australia.
We will hand information to somebody else only where the law requires it, or to protect somebody from serious harm.
We send email because something happened in your group — a rehearsal changed, a part was offered, an invoice is due — and you can turn any of it off in My RedCurtain. Every message carries a way to unsubscribe that works without signing in. We do not sell or rent your address, and we do not send marketing on behalf of anybody else.
A group’s history is the point of it, so we keep records for as long as the group exists. A closed group’s records are kept too, in a form nobody can change, because a committee’s books and minutes outlive the committee.
We should be plain about one thing. RedCurtain does not delete a member record, because a group’s register is the record of who performed with it, and deleting somebody would take a production’s cast list with them. Instead, member records are archived: they come off the active register, stop receiving anything, and stop appearing anywhere a current member appears.
If you want your details actually removed rather than archived, here is the whole of it, named rather than promised. A blanket “delete everything” is not on offer, and we would rather say so here than have you discover it after asking.
What can be cleared: your email address and phone number, your photo, your date of birth, your address down to the postcode, your emergency contact, a guardian’s details, any check you added to your own account, and how far you are willing to travel. Most of that you can clear yourself in My RedCurtain without asking anybody. For a group’s copy of it, ask the group or ask us.
What a group keeps: your name on the productions you were in, the jobs you did on them, the audition panels you sat on and the committee positions you held — that is the group’s history of itself, and a cast list with a gap in it is a record of nothing. It keeps the dates you were a member and what you paid, because those are its accounts. And it keeps your name on its register until its committee decides otherwise, which is the choice described under Your name above. A check the committee sighted and recorded itself is the group’s evidence that it did its own checking, and it keeps that too.
If one of those is wrong for your situation, write to us and say so rather than assuming the answer is no. Somebody who needs to be hard to find is not the same case as somebody tidying up, and a group does not always have a real reason for what it is holding. We would rather hear about it.
You can see and change most of what we hold about you yourself, in My RedCurtain. For anything else, email us and we will give you a copy of what we hold about you, normally within 30 days and at no cost. If something is wrong, tell us and we will correct it.
Everything travels encrypted, the database is encrypted where it sits and backed up daily, and access to it is limited to the people who maintain the system. Who may read which records is decided by the database, not by the screens.
No system is perfectly safe and we are not going to claim otherwise. If there is a breach that is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
Email hello@redcurtain.com.au and we will come back to you within 30 days. If you are not satisfied with how we handled it, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au.
When this changes we will update the date at the top, and tell group administrators if the change matters. See also the terms of use.