What Deets does with your information

Deets is a free New Zealand life-admin app — it tracks household deadlines like WOF, rego, passports and insurance, and stores the household details (ID numbers, vehicle info, pet details and so on) that go with them. This page explains, as plainly as we can, what information Deets collects, why, who else ever sees it, how long it's kept, and how you can see, correct or delete it. Everything below is checked against the actual code, not copied from a template.

This policy is written with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs) in mind. Deets is built for use in New Zealand, by people in New Zealand — see "Where Deets operates" below.

Who this policy covers

Deets is operated by Lika Limited, of 41b Arawa Street, Matamata, New Zealand (NZBN 9429030390164). You can reach us at hello@deets.co.nz for anything in this policy, including a privacy question, an access request, or a complaint.

What Deets collects, and why

Deets starts empty. Nothing is collected until you type it in. What you can add, and why we ask for it:

• Account details — your name, email address and a password, if you create a free account. The password itself is never stored in a form we can read: it's hashed before it's kept.
• Household deadlines — titles, due dates, categories and notes for whatever you're tracking (WOF, rego, passport renewal, insurance, and so on), so Deets can tell you what's coming up and what missing it would cost.
• ID numbers — for a driver licence, passport, IRD number or similar: just the number, its expiry date and who issued it. We ask for this because that's the information you actually need on hand when a form asks for it — see "What we deliberately don't collect" below.
• Vehicles — name, type, plate and year, so WOF/rego/service reminders can be tied to the right car.
• Pets — name, species, breed, date of birth and microchip number, plus vet details and care schedules you choose to add.
• Home and property details — your address, and (if you use it) the address of a second property like a bach or rental. From an address we also work out your council/territorial authority and region automatically, so we can point you at the right rates and bin-day information.
• Moving details — if you use the moving pack, the address you're moving from and to, the move date, and which checklist steps you've ticked off.
• Household members — the name of another adult (or anyone you're tracking deadlines for) that you choose to add, and optionally their birthday, if you want a birthday reminder.
• Children — a nickname and, optionally, an age. Deets deliberately never asks for a child's full name or date of birth — see "Children's information" below.
• Provider/account numbers — the customer or account number a utility, insurer, council or similar provider has given you, if you choose to save it.
• Receipts — what you bought, from where, when, and for how much, if you want Deets to track a warranty.
• Anything you type into the address lookup — see "Address lookup" under "Who else handles your information" below.

What we deliberately don't collect

There is no upload button and no document vault in Deets today. We store the useful fields instead of a document — the number, the expiry, who issued it — not a scan or photo of your licence, passport or anything else. As of this policy's last-updated date, Deets doesn't take or store any image or document at all, so there's no image on our servers to leak. (An opt-in receipts vault — somewhere to keep a photo of an actual receipt for a warranty claim — is a possible future feature; if it's ever built, it will be opt-in, and this page will say so before it collects anything.) Deets also has no payment flow today — it's free, so it doesn't ask for card or bank details.

What stays on your device, and what an account syncs

Deets works without an account. Everything you add is saved straight to your own device (browser local storage), and in that mode nothing you type reaches our servers at all.

That said, Deets actively encourages you to create a free account — you'll see a prompt after your first saved item, and again at your 5th and 15th if you haven't taken it up, each one dismissible on its own without ever being permanently hidden. The reason is concrete, not just growth tactics: without an account, your data lives on one device only and there's nowhere for Deets to send a reminder — see "Reminder emails" below.

If you create a free account, the same information is copied to Deets' database (see "Who else handles your information" below) so it's backed up, available if you open Deets on another device, and has a real mailbox behind it for reminders. That's the trade the account makes explicit: your data becomes readable on our servers, on purpose, so it's waiting for you next time — the same thing this product has said in its Security section from the start.

Once you have an account, your household's data is protected by database-level access rules (not just app code) so that only people in your household can read or write it — see "Who can see your data" below.

Who can see your data

Your household's data belongs to your household — anyone genuinely in your household, not only the person who first created the account, can see it. Sharing only ever happens by invitation, and only the household's owner can send one; nobody is ever added silently or automatically.

Joining a household is a two-step, explicit process, and both steps are recorded so there's a real answer if anyone ever asks "did I actually agree to that?". First, before an invite is even created, the person sending it is shown exactly what they're about to share — the same data categories listed above, plus the access level being granted — and has to confirm that in so many words; nothing is sent until they do. Second, the person being invited sees, before they can join anything, who invited them, which household they'd be joining, that same list of data categories, and what their role would let them do. None of that household's data is shared with them until they explicitly choose to join — there's no pre-ticked box and no way to be added as a side effect of something else. Both confirmations are logged, and that log is kept even if the household itself is later deleted.

If you join a household that's new to you while you already have your own Deets data, there's a third confirmation before that data is added in — what it includes, who can see it, and what stays untouched — the same disclose-then-confirm pattern as joining itself. All three moments (confirming an invite, accepting one, and confirming a data merge) are logged the same way.

Once someone has joined, Deets has two roles: an editor can add and change the household's data, the same as the person who invited them; a viewer can see all of it but can't add or change anything. The household's owner can change a member's role or remove them at any time, and that takes effect immediately — a removed member loses access straight away. If you want out of a household, you can remove yourself at any time from Household → Members — the one exception is the household's owner, who needs to hand the household to someone else first (Household → Members → Make owner) or delete their own account instead. Coming back later needs a new invite, the same as anyone else joining for the first time. Deets doesn't currently offer a way to hide an individual record from other household members; if that changes, this policy will say so before it matters.

Nobody outside your household — including us — can browse your data through the app. Access to the underlying database is restricted to the small number of people who administer Deets' infrastructure, for support and maintenance only.

Reminder emails

Since 1 August 2026, Deets can email you about deadlines if you have an account. This is on by default for anyone with an account — reminders are the actual reason to have one, and defaulting them off would mean most people never turn them on and the account looks pointless. Two kinds of email:

• A weekly digest — one "here's what's coming up" email, covering everything due within its lead window. A household with 25 items due gets one email, not 25.
• Urgent singles — a separate email only for something genuinely due soon (or, if several things are urgent at once, one combined email rather than several).

We treat these as service messages for the deadline-tracking service you signed up for, not marketing — that's the basis for sending them without asking first, under the Unsolicited Electronic Messages Act 2007. That basis only holds up because the unsubscribe is real, not a formality: every reminder email carries a working one-click unsubscribe link that needs no sign-in. Clicking it turns off reminders for your whole household immediately. That link's page is deliberately locked down — it never sends the unsubscribe token to Google Analytics or leaks it via a Referer header to another site, because the token in the link is enough on its own to control your household's reminders.

A short record of each send attempt (when, which template, whether it succeeded) is kept in Deets' database for support and abuse-prevention — see "How long we keep your information" below for how long. Email is the only reminder channel that exists today: there's no push notification (that's expected to arrive alongside a future iOS app, not promised on any date).

We don't sell your information, and we don't hand it to advertisers. A small number of service providers process it on our behalf, to make Deets work:

• Supabase — runs Deets' account sign-in and database, hosted in the Sydney (Australia) region. This is where your synced household data actually lives once you have an account. Because this is hosted in Australia, your information is processed outside New Zealand as part of this hosting arrangement — Supabase's access controls and the database-level rules described above are what keep it restricted to your household.
• Vercel — hosts the Deets website and app files (the code your browser loads), and provides basic, aggregated web analytics (page views) that isn't tied to your name or account.
• Resend — sends every email Deets sends: your sign-up confirmation and password-reset emails, a confirmation email when you delete your account, and — since 1 August 2026 — reminder emails (see "Reminder emails" above). Resend is used only for these account-related purposes, never for marketing.
• Google Analytics (GA4) — measures how the marketing site and app are used (page views and generic events like "an item was added"). Deets' analytics code is deliberately written to send no personal information in these events — no names, email addresses, physical addresses or bin days, just anonymous counts and category labels. Analytics is switched off entirely for local testing/development traffic.
• addy (NZ address lookup) — as you type an address into Deets, the text you've typed so far is sent to this address-lookup service so it can suggest real NZ addresses. Nothing besides the address text itself is sent. If this service is ever unavailable, Deets falls back to a small built-in sample list rather than blocking you.

Each of these providers is a genuine, currently-used part of how Deets runs — this list isn't boilerplate, and we've deliberately left out anything (ad networks, data brokers, marketing platforms) that Deets doesn't actually use.

Referral partners

We want to be straightforward about this, because it's real money and real information: Deets earns referral commissions when you go ahead with a provider we show you, and that's disclosed on the page it applies to — see "Referral commissions" in our Terms of use. As of this policy's last-updated date, that's the whole extent of it: Deets does not share your personal information with any partner today. Clicking through to a partner (for example, a "Connect via Movinghub" link) is a plain outbound link — nothing about you travels with it. Anything you choose to share once you land on a partner's own site is between you and them, under their own privacy policy — we'd encourage you to read it.

If a future referral ever needs specific details of yours to actually work (for example, handing your name and address to a provider so they can action a switch), we'll say so plainly at that moment, before it happens — and it will be your own action that shares it, not something Deets does automatically or silently on your behalf.

How long we keep your information

• While you have an account, your data is kept for as long as you keep it — you can edit or delete individual items, pets, vehicles and so on at any time from within the app.
• Deleting your account is immediate and real, server included. The delete-account action in your Profile isn't a soft flag or a request queue — it removes your household's data from Deets' live system straight away, the same moment you confirm it.
• Backups. Deets keeps routine backups of its database for resilience. A backup copy that includes your data before deletion is kept for up to 30 days after you delete your account, then it's gone too.
• Email send records. Every email Deets sends your household — account emails, a reminder digest or urgent single, an account-deletion confirmation — leaves a short record (when, which template, whether it succeeded), kept for support and abuse-prevention purposes. If your household is deleted, that record's content isn't wiped instantly — the email address on any such leftover record is anonymised after 90 days, while it still exists at all.
• Children's records stay on your own device only, today — see "Children's information" above — so they're never held on our servers to retain in the first place; clearing your device removes them the same way it does for a signed-out household.
• If you never created an account, your data only ever lived on your own device. Deets never had a copy, so clearing your browser or app storage removes it completely, on your side.

Seeing, correcting or deleting your information

Under the Privacy Act, you have the right to ask what personal information we hold about you and to ask us to correct it. In practice, for most of what Deets holds, the fastest way to exercise that right is directly in the app:

• See and correct it yourself — every deadline, pet, vehicle, ID entry, receipt and household member has its own edit and delete controls, right where you added it.
• Export everything — Settings → Export everything downloads a copy of everything Deets holds for your household as a file you can keep or inspect.
• Delete your account — Profile → Delete my account removes your household's data from our system immediately (see "How long we keep your information" above).
• Anything you can't do yourself — email hello@deets.co.nz and we'll help. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Adding other people's information

Deets is built for a household, so a lot of what it holds is information about someone other than the account holder — a partner's driver licence, a child's birthday, a flatmate's vehicle. If you add someone else's information to Deets, you're confirming (and our Terms of use require) that you have the right to do so — their permission, or that you're their parent or legal guardian.

Children's information

Deets is designed to be operated by an adult managing a household — there's no separate sign-up flow for children, no child accounts, and Deets doesn't knowingly collect information directly from a child.

If your household includes children, you can optionally add them as a child record: a nickname (call them whatever you like — Deets never needs a real name) and, optionally, an age. Deets deliberately never asks for a full legal name or a date of birth for a child. This is an adult account-holder's own entry about a member of their household, not something collected from the child. As of this policy's last-updated date, a child's record stays on your own device only — it isn't copied to Deets' servers even if you have an account, so it never leaves your device unless you choose to export it yourself.

These limits are deliberate, not incidental. A child's record only needs to exist so you can track something like a birthday reminder or a care note for them — so Deets asks for the least it can get away with to do that: nickname only (never a legal name), age only, and optional (never a date of birth), and held on your device only, never synced to our servers. That's data minimisation applied specifically to a child's information, on top of the same principle Deets tries to apply generally — the less we hold about a child who never chose to be in our system, the better.

Security

This is worth saying the same way the app itself says it: as of this policy's last-updated date, Deets doesn't store a photo or scan of an ID document — there's no image on our servers to leak, because none is collected today. Numbers are masked in the app by default; the full value only shows when you choose to reveal it. Your data is protected in transit (HTTPS) and, once you have an account, by database-level access rules that scope every read and write to your own household.

No system is unbreakable, and we'd rather say that plainly than promise otherwise. If you believe there's a security issue with Deets, please tell us at hello@deets.co.nz.

Cookies and tracking

Deets itself doesn't set tracking cookies. Google Analytics, described above, may set its own identifiers in your browser as part of how it builds aggregate usage reports — that's Google's mechanism, not something Deets adds on top of it, and it's never combined with your name, email or the household details you've entered into Deets.

Where Deets operates

Deets is built for New Zealand and the deadlines, dates and penalty figures in it are all NZ-specific. It isn't offered as a product for other countries. As noted above, the database itself is hosted in Australia (Supabase's Sydney region) as part of our hosting setup, which is the one respect in which your information leaves New Zealand.

That hosting arrangement carries a contractual safeguard behind it, not just disclosure: Supabase's Data Processing Addendum — which forms part of Supabase's Terms of Service and applies to Deets' use of Supabase's services generally — incorporates the Standard Contractual Clauses, including the versions modified for transfers involving jurisdictions other than the EU, as the mechanism governing this transfer. Under that Addendum, accepting Supabase's terms has the same effect as signing those Clauses. Lika Limited relies on this as the contractual protection behind the Australian hosting described above — we're not separately asserting anything about Australian privacy law itself.

Changes to this policy

Deets ships changes continuously (see our Terms of use for what that means). If we change what we collect or how we handle it in a way that matters, we'll update this page and change the date at the top.

Contact

Questions, access requests or complaints: hello@deets.co.nz.