Privacy Policy
This policy explains how AdventureMatch collects, uses, shares, protects and retains personal information under New Zealand’s Privacy Act 2020.
1. Who we are
AdventureMatch is a New Zealand-based adventure discovery service. We are responsible for the personal information described here. Contact us at hello@adventurematch.app to ask a privacy question or exercise your rights.
2. Information we collect
- Account: Firebase user identifier, name, email, authentication provider and account dates.
- Travel profile: selected persona, Adventure DNA answers and results, preferences and saved adventures.
- Contributions: suggested adventures, descriptions, operator details, photographs, rights confirmations and moderation history.
- Enquiries: name, email, selected operator, adventure, preferred date, group size and optional message.
- Reports: category, description, contact details, declarations, referenced content and moderation outcome.
- Location: current device location may be used with permission to show nearby content. AdventureMatch does not intentionally store your precise live device location in your account.
- Technical and security data: authentication, App Check, request, delivery and limited diagnostic information needed to secure and operate the service.
3. Why we use it
We use personal information to authenticate accounts; personalise discovery and matching; save preferences; review and publish contributions; send enquiries at your request; answer support and rights requests; moderate content; prevent fraud and abuse; maintain security; comply with law; and improve reliable operation. Where providing information is optional, the relevant feature may not work without it.
4. Who receives it
We use service providers including Google Firebase for authentication and profile data, Supabase for catalogue and operational records, Cloudflare R2 and Pages for media and web delivery, Resend for transactional email, and Apple or Google when you choose their sign-in services. These providers process data under their own infrastructure and contractual terms and may process it outside New Zealand.
When you send an operator enquiry, we share the enquiry details with the operator you selected. We may also disclose information where required by law, to protect safety or rights, or in connection with a properly managed business transfer. We do not sell personal information or authorise its use for third-party advertising.
5. Storage and security
We use access controls, authenticated APIs, least-privilege credentials, encryption in transit and administrative controls appropriate to the service. No system is completely secure. If a privacy breach is likely to cause serious harm, we will notify affected people and New Zealand’s Privacy Commissioner as required.
6. Retention
- Operator enquiries are kept for no more than 24 months and are deleted earlier when the account is deleted.
- Rejected or withdrawn submission media is scheduled for deletion after 30 days unless needed for an active dispute.
- Published catalogue contributions may remain after account deletion, with contributor identifiers removed.
- Closed reports are normally retained for three years.
- Acceptance evidence is retained for the account lifetime and may be retained for six years afterward.
- Security logs are kept for the shortest practical provider-supported period. Rotating backups expire through normal provider cycles.
A legal hold or active dispute may require us to keep specific records longer.
7. Your rights and choices
You may ask for access to or correction of personal information we hold by emailing us. You may withdraw pending suggestions in the app and delete your account from Profile. You can decline location permission in system settings. We may need to verify your identity before fulfilling a request.
8. Account deletion
In-app deletion removes the Firebase authentication account, profile, saved adventures and private enquiry records. Submission identity fields are removed while approved public catalogue information may remain. Closed moderation or legal records may be retained for the periods above. Temporary copies may remain in rotating backups until they expire.
9. Young users
AdventureMatch is for people aged 16 or older. We do not knowingly create accounts for children under 16. Contact us if you believe we hold information about a younger child.
10. Changes and complaints
Material policy changes will be presented for renewed acceptance. If you are dissatisfied with our response to a privacy concern, you may complain to the Office of the Privacy Commissioner at privacy.org.nz.
11. TestFlight early access
When you request early access, we collect your name, email address, country or region, consent, and limited anti-abuse information. We use these details only to assess your request and contact you about TestFlight and launch access. Cloudflare helps verify that the form is submitted by a person, and Resend delivers the request to our email account. We do not sell this information or use it for third-party advertising.
Early-access requests are normally retained in our email account until the TestFlight programme ends plus 12 months, unless you ask us to delete yours earlier. Applying does not guarantee an invitation. You can request access, correction or deletion by emailing hello@adventurematch.app.