Privacy Policy

Kerb Side is a free community giveaway platform operating in New Zealand. This policy is written to meet our obligations under the Privacy Act 2020, including the thirteen Information Privacy Principles.

Account information. Your email address, a display name you choose, and optionally your region. If you sign in with Google or Apple we receive your email address and name from them.

Collection addresses. When you post an item you give us the address it can be collected from, and the coordinates for that address.

Location. If you allow it, your device location is used to work out which listings are near you. This is used to calculate distances and is not stored against your account.

Listings and activity. Photos, descriptions, categories, claims, reports, and ratings.

Technical information. Standard server logs. IP addresses are stored only as a one-way hash, so we can detect abuse without holding a record of where you connect from.

Phone numbers. Only if you choose to verify one. We store a one-way hash, never the number itself.

This is the part that matters most, so it is spelled out in full:

• Your exact address and coordinates are encrypted with AES-256-GCM before being stored, and are kept in a separate database table from the public listing.
• Public listings show only an approximate distance ("about 1.8 km away") and a rough locality ("near Tauranga South").
• Map pins are offset by a random distance between 150 and 500 metres, generated once when you post and never recalculated — so repeated viewing cannot narrow down the real position.
• Location data is stripped from every photo you upload before it is published.
• The address is revealed only to the single person holding an active claim on your item.
• Every single access to an address is logged, including by our own moderators, who must record a written reason.
• When you mark an item as gone, or the listing expires, the stored address is deleted outright.
• Addresses never appear in public APIs, search engines, map pages, listing previews, social sharing, or page metadata.

Other members see your display name, the month you joined, how many items you have given away and collected, and your average rating once you have at least three. They never see your email address, your phone number, your exact address, or any record of missed collections.

• Collection addresses: deleted as soon as the listing reaches a final state (gone, expired or removed).
• Listings: retained while active, then kept in a de-identified form for platform statistics.
• Account information: kept while your account is open.
• Address access logs: 12 months, so a suspected misuse can be investigated.
• Server logs: 30 days.

Under the Privacy Act 2020 you can, at any time:

• Access everything we hold about you — use “Download my data” in your profile.
• Correct anything that is wrong, by editing your profile or contacting us.
• Delete your account. Your listings come down immediately and your stored addresses are destroyed at once; the account record is permanently removed after a 7-day grace period.
• Withdraw location permission at any time in your browser or device settings — Kerb Side still works, you simply choose a town instead.
• Complain to the Office of the Privacy Commissioner if you believe we have mishandled your information.

We do not sell your personal information, and we do not share it for advertising. Information is shared only with the infrastructure providers needed to run Kerb Side — hosting, database and image storage — and with New Zealand Police or another authority where we are legally required to, or where there is a serious threat to someone's safety.

Kerb Side's map view is drawn from our own data rather than a third-party mapping service, specifically so that listing coordinates are never sent to another company.

Kerb Side sets one cookie: a secure, httpOnly session cookie that keeps you signed in. There are no advertising or analytics cookies.

Kerb Side is not intended for people under 16. If you believe a child has created an account, please report it and we will remove it.

For any privacy question or request, contact us at kerb.side.nz@gmail.com. We aim to respond within 20 working days, as the Privacy Act requires.