Privacy Policy

At Disc-Connected, we are committed to protecting your privacy. This policy explains what information we collect, how we use it, and how we keep it secure, particularly regarding our “Lost & Found” connection service.

1. Information We Collect

When you register or use our Service, we may collect the following:

• Account Information: Email address, Display Alias, Country, and, if you add one, a Phone Number.
• Disc Listings: Information about lost discs (Brand, Mold, Color, Weight, Location Lost) and optional images.
• Usage Data: Login timestamps and interaction history (such as Pings sent/received).
• My Bag (Optional): If you use the “My Bag” feature, details of the discs in your personal collection (such as brand, mold, colour, weight, and any notes you add).
• Notification Tokens (Optional): If you turn on push notifications, a device-specific messaging token (via Google Firebase Cloud Messaging) so we can deliver notifications to that device. You can turn this off per device at any time.
• Referral Information: If you join through another member's invite link, we record which member invited you. If you invite others, we record how many of them joined and went on to post a listing.
• Points and Badges: The points, level and badges your activity has earned, and the counts behind them — such as how many listings you have posted, or how many discs are in your My Bag.

2. How We Use Your Information

We use your data to:

• Create and manage your user account.
• Display your lost disc listings to other users (without revealing your direct contact info publicly).
• Facilitate the “Ping” system to connect owners with finders.
• Improve the functionality of the website.
• Run points, badges, levels and any reward programme — and detect attempts to manipulate them.

3. How Your Contact Data is Shared (The “Ping” System)

We take a privacy-first approach to lost property:

• Public Visibility: Your disc details are public, and your “Alias”, level, points and earned badges appear on the public leaderboard. Your Alias is not shown on a listing itself — a listing stays anonymous until you accept a contact request. Your Email Address and Phone Number areHIDDEN by default.
• Consent-Based Sharing: Your private contact details (Email/Phone) are stored securely in our database. They are only revealed to another user if you specifically click “Accept” on a contact request (Ping) sent by that user, or that user accepts one you sent. If you add a Phone Number after accepting, it is passed on to the people whose open requests you have already accepted, so they can reach you.
• We do not sell your personal data to third parties.
• Post-Sharing Disclaimer: Please note that once you consent to share your contact information with another user, Disc-Connected has no control over, and is not responsible for, how that user stores, uses, or shares your information.

4. Third-Party Services

We use trusted third-party services to operate our platform:

• Google Firebase: We use Firebase for authentication, database storage, and image hosting. Data stored in Firebase is subject to Google's security standards.
• Google Auth: If you sign in via Google, we access your basic profile info (Email/Name) to create your account.
• Vercel: Our website is hosted by Vercel, which also gives us anonymised page-view statistics (pages visited, referring site, country and device type). It does not use cookies and does not identify you. Its use is governed by Vercel's Privacy Policy.
• Google Analytics: We use Google Analytics (provided through Firebase) to understand how visitors use the site — for example which pages and features are popular — so we can improve the Service. This collects anonymised usage, event, and device data. Its use is governed by Google's Privacy Policy.
• Firebase Cloud Messaging: If you opt in to push notifications, we use Google Firebase Cloud Messaging to deliver them to your device (see Section 7).

Where your information is stored

Disc-Connected is run from New Zealand, and we are the ones who hold your personal information. The database and the disc photos you upload are stored on our behalf by Google in its australia-southeast1 region — that is, on servers in Sydney, Australia. Database backups are held in the same region.

Google stores and processes that information only as our service provider, on our instructions, and does not use it for its own purposes. It remains our information and our responsibility: using an overseas host does not hand either of those to Google, and we stay accountable under the New Zealand Privacy Act 2020 for keeping it secure. If you are in Australia, this means your information is stored in your own country.

5. Data Retention and Deletion

We retain your account data as long as your account is active. You may delete your disc listings at any time via your Dashboard. If you wish to delete your account entirely, please contact us at disc.connected.nz@gmail.com.

If you delete your account, the record of which member invited you is removed. If you claim a reward, we collect a delivery address solely to send it, and delete that address once the reward has been sent.

Disc listings (lost or found posts on the community board) are retained according to the following lifecycle:

• Active listings are retained for as long as needed to facilitate the disc finding its owner or finder.
• Stale listings (active for more than 90 days without renewal) are flagged for review. We send the listing owner an email asking whether the listing is still needed.
• Unrenewed listings (no response within 7 days of the reminder, and no active contact requests on the listing) are automatically archived. Archived listings are removed from public search results but retained on our systems.
• Archived listings may be permanently deleted after a further period — including the listing details, any uploaded photos, and the private contact details associated with the listing (phone number, email address). At time of writing this period is 30 days, but we may extend or shorten it for operational reasons.

Listings with active or pending contact requests are exempt from auto-archiving and the associated retention timers, so any in-flight reunion conversation can complete naturally.

This lifecycle is designed to comply with the data minimisation principle of the New Zealand Privacy Act 2020 — keeping personal information only as long as it serves the purpose for which it was collected.

If you wish to delete a listing (and any associated personal data) sooner than the automatic lifecycle would, you can:

• Close the listing from your Dashboard at any time, which makes it ineligible for public search and queues it for the standard retention timer.
• Email us at disc.connected.nz@gmail.com to request immediate deletion.

In the event of a data breach that is likely to cause serious harm, we will notify affected users and the New Zealand Office of the Privacy Commissioner, as required by New Zealand law. Where such a breach affects users in Australia, we will also notify the Office of the Australian Information Commissioner.

6. Cookies and Local Storage

We use a small number of cookies and browser storage entries, all of them to make the site work the way you left it. None of them are used for advertising, and none are shared with anyone:

• Your sign-in session, stored by Firebase Authentication, so you stay logged in between visits.
• Your country (dc_country), so the site opens on New Zealand or Australian listings — whichever you last chose — and so the post-a-disc form offers the right course list. It is only set when you pick a country or save one in your profile, it holds nothing but that country name, and the site works without it: if it is absent or blocked we fall back to the country your connection appears to be in.
• Your light or dark theme (dc-theme), so the page does not flash the wrong colours while it loads.

We do not show third-party advertising and do not use advertising cookies. Google Analytics (Section 4) may set its own cookies to measure how the site is used.

7. Notifications (Email & Push)

In addition to the listing-status reminders described in Section 5, we may send you the following emails as part of operating the Service:

• Match notifications when a new listing matches one of yours (lost ↔ found).
• Contact request notifications when another user pings your listing, and when an owner accepts or declines your ping.
• Return-completion review requests after a disc is reunited, asking you to leave optional feedback.
• Welcome emails when you first sign up.

We never share your email address with other users. Contact details are only revealed inside the platform once both parties accept a contact request (see Section 3), and only to the two parties involved in that ping.

Operational emails (matches, ping notifications, lifecycle reminders) are integral to using the Service and cannot be individually opted out of while you maintain an active listing. Marketing or promotional emails (Section 4 of our Terms) are optional and can be unsubscribed from at any time.

Push notifications: If you opt in (per device) from your Dashboard, we may also send key account updates — a new ping, an accepted ping, a potential match, or a completed return — as web push notifications. We store a device-specific messaging token (via Google Firebase Cloud Messaging) solely to deliver these. Push is entirely optional and separate from email: you can turn it off for any device from your Dashboard profile settings, or by revoking notification permission in your browser or device settings.

8. Your Rights

Under the New Zealand Privacy Act 2020, you have the right to ask for a copy of any personal information we hold about you, and to ask for it to be corrected if you think it is wrong. If you'd like to ask for a copy of your information, or to have it corrected, please contact us at disc.connected.nz@gmail.com.

If you are in Australia, you have the same rights with us, and we handle your personal information to the same standard wherever you are — the protections described in this policy are not limited by which country you are in. Disc-Connected is a New Zealand service and this policy is written against New Zealand privacy law. If you are not satisfied with how we have handled your information, you are welcome to raise it with us first, and you may also take it to the Office of the Australian Information Commissioner.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us at: disc.connected.nz@gmail.com