Privacy Policy

This Privacy Policy describes how Flatchat (“we”, “our”, or “us”) collects, uses, and protects personal information when you use flatchat.co.nz or the Flatchat mobile app (together, the “Services”). We are committed to protecting your privacy and complying with the New Zealand Privacy Act 2020.

This policy explains what we collect, why we use it, who processes it for us, and the choices available to you.

1. Information we collect

We collect the following types of information:

• Account information. When you create an account we collect your email address, account identifier, display name, optional university, bio, and profile image. Your email is used for authentication and account management and is not displayed publicly.
• Property and household information. We collect current and past flat or property details you add, including addresses, tenancy dates, household membership, rent, shared expenses, splits, settlements, and cleaning information.
• Content and communications. We collect reviews, ratings, forum posts, comments, uploaded images, reports, flat and direct chat messages, and support messages. Content intended for public areas is published with the attribution shown when you post it.
• Location. If you choose the locate-me feature, the app uses your precise device location to centre and search the property map. Location access is optional and can be changed in device settings.
• Search and interaction data. We collect recent searches, saved properties, product interactions, notification preferences, and first-party feature events so the Services work and we can understand how they are used.
• Device and diagnostics. We collect push notification tokens, app and OS details, crash reports, performance diagnostics, and basic request or server-log data.
• We treat technical and usage data as personal information where it could reasonably be combined with other information we hold to identify you. We do not use your information for third-party advertising or cross-app tracking.

2. How we use your information

• To create and manage your account and authenticate access to the Services.
• To provide property search, reviews, forum, chat, household, finance, and cleaning features.
• To send notifications you enable and remember your settings and saved items.
• To respond to questions or support requests you send to us.
• To monitor, maintain, diagnose, and improve the Services.
• To detect and prevent fraud, abuse, or illegal activity.
• To comply with applicable legal obligations.

We will not use your personal information for purposes other than those described in this policy without first notifying you and obtaining your consent.

3. Third-party services

We use service providers to operate the Services. They process your information only as necessary to deliver their services to us and are not permitted to use it for other purposes.

• Supabase. Authentication, database, file storage, and realtime delivery.
• Vercel. Website and API hosting, request logs, analytics, and performance signals.
• Expo. Mobile build and update infrastructure and push-notification delivery.
• Sentry. Crash reporting and technical performance diagnostics.
• Apple and Google. Sign-in where selected, mobile platform services, maps, geocoding, or Street View features. These providers also process information under their own privacy policies when you interact directly with their services.
• MapLibre and OpenStreetMap contributors. Map rendering and map data.
• Cross-border processing. Some providers process or store data outside New Zealand. Under the Privacy Act 2020, where a service provider holds personal information solely to process it on our behalf, the information remains our responsibility under the Act and is not treated as an overseas disclosure. These providers act as our agents; we do not authorise them to use your personal information for their own purposes. If we ever need to disclose your personal information to an overseas recipient for a purpose of their own, we will do so only where permitted by IPP12 of the Privacy Act 2020.

4. Public information

Reviews, forum posts, comments, profile information, and images you choose to post publicly can be viewed by other people and may be indexed by search engines. Flat and direct chats, household finances, cleaning data, and household membership are shared only with the participants authorised for those areas. Please do not post personal information that you do not want the relevant audience to see.

5. Sharing your information

We do not sell or rent your personal information to third parties. We may share your information in the following limited circumstances:

• With third-party service providers as described in section 3 above.
• If we are required to do so by law, court order, or a request from a regulatory authority.
• To protect the rights, property, or safety of Flatchat, our users, or the public.
• In connection with a merger, acquisition, or sale of all or part of our business, in which case we will notify you before your information is transferred and subject to a different privacy policy.

6. Data retention

We retain personal information only for as long as we need it. Our current retention practice is:

• Account and profile information. Retained while your account is active. You can initiate deletion in the mobile app under Account settings, or contact legal@flatchat.co.nz for help.
• Account deletion. Deletion removes your profile identifiers, public reviews, forum posts and comments, uploaded images, saved items, searches, notifications, device tokens, and similar private activity. Chat rows remain in their conversations so other participants retain the timeline, but their text and attachments are removed and the sender is shown as “Deleted user”. Sign in with Apple authorisation is revoked for Apple accounts, and the Supabase authentication identity is deleted.
• Shared household history. Tenancy, expense, split, settlement, cleaning, and related history may remain where other flatmates depend on it. It is retained without your profile details and displays a neutral deleted-user label.
• Diagnostics and logs. Operational logs, crash reports, and backups may persist for a limited period under provider retention cycles before being overwritten or deleted. We retain them only as needed for security, reliability, and legal obligations.

Where we are required to retain information by law, or to preserve it for a complaint, investigation, or legal process, we do so for as long as the legal obligation applies.

7. Security

We implement reasonable administrative and technical measures to protect your personal information from unauthorised access, disclosure, alteration, or destruction. However, no internet transmission is completely secure. While we do our best to protect your information, you acknowledge that you provide it at your own risk and we cannot guarantee absolute security.

You are responsible for keeping your account credentials confidential and for any activity that occurs under your account.

8. Your rights

Under the New Zealand Privacy Act 2020 you have the right to:

• Access (IPP6). Ask whether we hold personal information about you and request access to it.
• Correction (IPP7). Request that we correct any personal information we hold about you that is inaccurate, incomplete, or out of date.
• Statement of correction (section 64). If we decline to correct information on request, ask us to attach a statement of the requested correction so that it is read alongside the disputed information.
• Make a complaint to the Office of the Privacy Commissioner at www.privacy.org.nz if you believe we have breached the Act.

To request access to information we hold about you, or to request correction, email legal@flatchat.co.nz. We will respond within 20 working days as required by the Privacy Act 2020.

Our designated Privacy Officer is Ryan Cole, contactable at legal@flatchat.co.nz.

9. Children’s privacy

Flatchat is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we become aware that a person under 18 has provided us with personal information, we will delete it as soon as reasonably practicable.

10. External links

The Services may contain links to third-party websites. We are not responsible for the privacy practices of those sites and recommend you review their privacy policies before providing any personal information.

11. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. Your continued use of the Site after changes are posted constitutes your acceptance of the updated policy.

12. Contact us

If you have any questions or concerns about this Privacy Policy or how we handle your personal information, email legal@flatchat.co.nz.

13. Cookies and analytics

We use a small number of cookies and similar technologies to operate the website. The mobile app uses secure local storage and device tokens for equivalent operational purposes. These currently include:

• Authentication cookies set by our authentication provider (Supabase) to keep you signed in and secure session data.
• Hosting and performance signals set by our hosting provider (Vercel), including any Vercel Analytics or Speed Insights data where enabled, to measure page performance.

We do not currently run advertising cookies or third-party behavioural-tracking pixels. If this changes in the future, we will update this section and the “Last updated” date above.