Privacy

Privacy policy

Last updated 19 October 2026 · Whetū Labs, Canterbury, New Zealand · hello@whetulabs.nz

This policy covers this website and every Whetū Labs app. Where an app has its own privacy page, that page adds the details for that app and takes priority for it.

The short version

No ads, no tracking cookies and no selling or sharing of your information. We only count visits, anonymously (see below).
Most of our apps keep everything you enter on your own device. We can't see it.
If you sign in, buy something or turn on syncing, we keep only what that feature needs.

What stays on your device

Our apps save what you enter – lists, scores, entries, settings – in your browser's storage on that device. It isn't sent to us. Clearing the site's data or uninstalling the app deletes it, and we have no copy to restore.

Accounts and purchases (Whetū Pass)

Paid features use a simple email sign-in. When you sign in we store your email address, what you've bought and when. Accounts are kept in Supabase, a hosted database service, so your information may be stored outside New Zealand. Payments are handled by Stripe – we never see or store your card details. Stripe keeps its own records of payments and sends your receipts.

Syncing and shared features

Some apps let you sync across devices or work as a team – for example a shared plan, a venue's staff app, or a live darts scoreboard on a TV. When you turn one of these on, the information you choose to sync is stored in Supabase so your other devices, or the people you share with, can see it. It's only visible to accounts you've given access to. Turning it off stops the syncing.

Services some apps look things up with

Some features need an outside service. When you use one, the app sends only what that feature needs – usually your search words, or a photo you choose – and that service's own privacy policy applies. For example:

Music and video (Waiata Tide, Throwline, Spotter): Audius, Openverse, Deezer, MusicBrainz and YouTube receive your searches.
Plant identification (FernLife): the photo you choose is sent to Pl@ntNet; place names come from OpenStreetMap; plant notes may be written by an AI service (Anthropic). Locations of your finds stay on your device unless you sync them.
Online play (Throwline): playing mates online links your devices directly; a relay service is only used when a direct link isn't possible.

Camera, microphone and location

Apps only ask for these when you use a feature that needs them, and your browser asks your permission first. Photos, recordings and locations stay on your device unless the feature you're using says it sends them.

This website

Visitor counter. To see how many people visit, the site – and the Throwline, Kai Pai, Flux Pro and Kāri Club apps, each time they're opened – counts page views and visitors without cookies and without storing anything on your device. To count a visitor only once a day, our host works out a one-way code from your connection and browser mixed with a random value that changes every day; the code can't be turned back into who you are, and both are deleted after two days. We keep only totals: pages viewed, the website that linked to us and the country of the visit. The visitor total is shown in the footer.

The site doesn't ask for your name and uses no cookies for tracking. If you tick “Skip intro next time”, your browser remembers that choice. If you send the contact form or a merch “Tell me when it's ready” list, we receive your name, email, town and message through our host, Netlify, and use them only to reply. We don't add you to a mailing list unless you ask.

Children

Our apps aren't designed for children to sign in or make purchases. If you're under 16, ask a parent or caregiver first.

How long we keep things

Account and purchase records are kept while your account is active and as long as the law requires for tax records. Synced data is kept until you delete it or close your account. Emails are kept only as long as we need to help you.

Your rights

Under the New Zealand Privacy Act 2020 you can ask to see the information we hold about you, have it corrected, or have it deleted. Email hello@whetulabs.nz. If you're unhappy with how we've handled your information, you can contact the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.

If you join The Whetū Drop, our monthly email, we keep your email address and the page you signed up on, only to send it. You can unsubscribe at any time with the link in each email or by emailing hello@whetulabs.nz.

We follow the UK and EU General Data Protection Regulation (GDPR) as well as New Zealand law. Whetū Labs, Canterbury, New Zealand, is responsible for your information – contact hello@whetulabs.nz.

Why we use your information: to provide an app, account or purchase you ask for (contract); to reply to your messages and to keep the website and apps working and secure, including the anonymous visitor counter (legitimate interests); to send the newsletter (your consent, which you can withdraw at any time); and to keep tax records (legal obligation).
Your rights: you can ask for a copy of your information, have it corrected or deleted, restrict or object to how we use it, receive it in a portable format, and withdraw consent. Email us and we'll reply within one month.
Where it's stored: our providers (Netlify, Supabase and Stripe) may store information outside your country, including in the United States, under their own safeguards for international transfers. New Zealand is recognised by the EU and the UK as giving adequate protection.
Complaints: you can complain to your local data protection authority (in the UK, the Information Commissioner's Office) or to the New Zealand Privacy Commissioner.

Changes

If this policy changes we'll update this page and the date at the top.