Privacy Policy

Who we are

Tally Sphere Limited, a New Zealand company, operates the queenstownpocket.com website and the Queenstown Pocket app, which is in testing now and launches in November 2026. Our privacy officer is the company’s director. For anything in this policy, contact us at hello@queenstownpocket.com.

We handle personal information under the New Zealand Privacy Act 2020, and send email under the Unsolicited Electronic Messages Act 2007, which means we only email people who asked us to, every email identifies us, and every newsletter and launch email has a working unsubscribe.

In short: the app works without an account, your location never leaves your phone, we show no ads, and we sell nothing about you to anyone.

The waitlist

When you join the waitlist we collect your email address, where the signup came from (for example “site” or “beta”), when it happened, and whether and when you confirmed it. Once you confirm, the address also goes on our mailing list at Resend with where you signed up and your place in line.

If you give the day you arrive (the “Remind me before I go” form on our pages), we keep it with your email, as part of where the signup came from, together with the page you asked for, so we can time one reminder email to your trip. It goes to Resend with the rest of your record. We do not use it for anything else, and a reminder signup gets no welcome email: the form promises two emails at most.

We use it for these things, and nothing else:

• to tell you about the Queenstown Pocket launch: a welcome email, the launch announcement and, at most, a small number of updates directly about it, such as a beta invite;
• the founding member badge: if you sign in to the app with the same email, the app checks whether that email joined the waitlist before 1 November 2026 and was confirmed, and if so gives the account the badge and one free Trip Pass. The check happens on our server; nothing is copied between the two records;
• to count signups by where they came from;
• to send the page you asked for two days before the day you said you arrive.

We will not sell your email address, rent it, trade it, or use it for anything unrelated. Every launch email includes an unsubscribe link; the confirmation email is sent only because you asked for it. You can also unsubscribe, or ask us to delete your record entirely, at any time by emailing hello@queenstownpocket.com.

The newsletter

When you sign up for the Thursday newsletter we collect your email address, the page the form was on, and when it happened. Signing up consents to the weekly email and to one email when the app launches, and to nothing else. Your address also joins the launch waitlist, so it counts for the founding member badge. We keep the list in our own database and send the issues through beehiiv, a newsletter service; beehiiv processes your email address to deliver the issues, run the confirmation and unsubscribe links, and count opens and clicks in aggregate. If you share your personal referral link, beehiiv records which signups came through it. Every issue has a one-tap unsubscribe, and you can ask us to delete your record at hello@queenstownpocket.com.

The app

Queenstown Pocket is built to work offline and to collect as little as possible. Trail maps, timetables and guides are downloaded to your phone, and you can use all of them without an account.

Your location

If you allow it, the app reads your location on your phone, while the app is open, to sort places, stops and trails by distance and to put you on the map. It is never sent to us or to anyone else. The trip planner works from the stay area you choose, not from GPS.

Usage counts and crash reports

The app sends us anonymous usage counts: which screens are opened, which partner links are tapped, and small details that go with them, such as a category, the place or tour you opened, a tour search you typed, or the queue you reported. Each count carries a random number the app makes when it is installed, whether it is an iPhone or Android, and the app version and build. It carries no name, email, account, location, device identifier or advertising identifier, and we don’t store your IP address with it. We use the counts to see what is used and what is broken, and, as totals only, to show booking partners how often their links are used. They go to our own database, are deleted after 14 months, and we never match them to accounts.

If the app crashes, or a screen fails to load, it sends a crash report to PostHog, a product analytics company, on its European Union cloud: the error, where in the code it happened, the phone’s make and model, operating system, language and time zone setting, screen size, and the app version and build, under a random number PostHog makes on the phone. No person profile is built and no session is recorded. PostHog receives your connection’s IP address, as any server does, and is set not to work out a location from it.

You can switch both off: the Account tab, Settings, Privacy, Usage counts. They are on until you do. With them off, the app sends no usage counts and doesn’t contact PostHog at all. A development copy running on our own computers never sends either.

Queue wait reports

If you report how long a queue is, the app sends the place, the minutes you chose and a random number used only to stop the same phone reporting the same place twice in ten minutes. It is a different random number from the usage counts. If usage counts are on, the app also counts that a report was sent for that place. Reports are deleted after 7 days. A report goes even with Usage counts off, because you chose to send it.

An account, if you want one

You only need an account to keep a plan on our server, so it survives a new phone and a partner can join it. You sign in with a six-digit code we email you through Resend, an email delivery service; there is no password. We keep your email address, a random account number, when you signed up and last signed in, and, for each phone you are signed in on, the IP address and type of device it signed in from. When you sign in we also run the founding member check described under The waitlist.

A kept plan holds what you chose or typed: its name and dates, how many adults and children and the children’s age bands (never names or birthdates), your pace, interests and how you are getting around, your stay area, your flight days and times and, if you added it, the flight number, the time your rental car goes back, your checkout time, how much you let the app decide, and the days you planned, including what you marked booked or done. Until you sign in, the plan stays on your phone only.

Planning with other people

If you share a plan, up to four people can see and edit everything in it, including the stay and flight details. The app names people by role only: “You”, “Plan owner” or “Partner”. No one on the plan sees another person’s email. An invite link works once and for 14 days. It opens our website first, which counts the visit like any other page. If the person who started a plan deletes their account, the plan is deleted for everyone on it.

The Trip Pass

A founding member’s free pass is a record on the account of which pass it is and when it starts and ends. Paid passes are not on sale yet. When they are, they will be bought through the App Store or Google Play, who take the payment; we never see card details. We will record what was bought through RevenueCat, a payments service, so the pass works on the account, and this section will be updated before that happens.

Booking with partners

When you tap a booking or website link, the partner’s own page opens in a browser inside the app, and anything you enter there goes to that partner under their own privacy policy, not to us. The link carries a tag naming the app screen it came from so the partner can pay us a commission. It carries nothing about you.

Kept on your phone

The optional Face ID or fingerprint lock is checked by your phone, which tells the app yes or no; nothing is stored or sent. Your settings, saved places and a plan you haven’t kept stay on your phone, and in your phone’s own backup if you use one. A phone restored from a backup can bring back the same random usage number.

What the app connects to

• Our own servers at Supabase, with data stored in Sydney, Australia, for timetables, the offline map, weather, listings and everything above. Weather and tour searches go through our server, which asks the weather service about named places and passes tour search words to Viator, with nothing about you.
• Expo (United States), which delivers app updates. Each check sends the platform, the installed app and update versions, a random number Expo uses to count installs, and, if an update failed to start, the error.
• Protomaps, through GitHub (United States), for the map’s fonts and symbols, until the offline map has downloaded.
• The sites that host photos of tours and places, when a photo loads.
• PostHog (European Union) for crash reports, as above.

Like any server, each of these sees your connection’s IP address when the phone contacts it. The app has no advertising, no advertising identifier and no tracking across other apps or sites. Bus timetable data shown in the app comes from the Otago Regional Council, licensed CC BY 4.0; it’s public data and contains no personal information.

Coming in a later version

A later version adds Sign in with Apple, which gives us only your email address, or a relay address from Apple if you choose to hide it, and never your name. It also adds optional plan alerts by notification: if you turn them on, the app sends us a notification token for your phone so the alert can reach it. We will update this policy before either ships.

Testing the app before launch

Test versions send the same usage counts and crash reports as the app, marked with the test build number. On iPhone the test runs through Apple’s TestFlight: Apple shares with us the crash reports and usage figures TestFlight collects, and any screenshots and comments you choose to send as feedback. If you joined through a public link, Apple doesn’t tell us who you are.

On Android the test runs through Google Play’s internal testing, which only admits Google accounts on its tester list. You send us that Google account address by email; we add it to the tester list, and Google Play shares crash reports from testers with us. The tester list is cleared after launch. Your email, like any email to us, sits in our mailbox (Google Workspace, with a copy at Resend); beta emails are deleted after launch.

Where your data lives

• Storage: waitlist records, accounts, kept plans and usage counts are stored with Supabase in the Sydney, Australia region, in a private database schema with restricted access. Supabase also keeps short-lived request logs, including IP addresses, to run and secure the service.
• Email: Resend (United States) sends confirmation emails, sign-in codes, the welcome email and launch emails, and keeps the confirmed waitlist as a mailing list. The newsletter is sent through beehiiv, as above. Email you send to us is held in Google Workspace (Google), with a copy at Resend.
• Crash reports: PostHog, on its European Union cloud.
• App updates: Expo, in the United States.
• Hosting: our hosting provider keeps standard, short-lived server logs (such as IP address and pages requested) to run and secure the site, as all web hosts do.
• Website analytics: Vercel Web Analytics and Vercel Speed Insights, which are cookieless; Google Analytics 4 (Google Ireland Limited and Google LLC), which only stores anything on your device after you accept; and PostHog on its European Union cloud, which your browser reaches through our own domain rather than calling PostHog directly. See Cookies and tracking below for exactly what each one does before and after a choice.

These providers process data only on our behalf and on our instructions, and we choose them because they protect it at least as well as this policy does.

How long we keep it

• Waitlist and newsletter records: until you ask us to delete them, or once they’re no longer needed for the purpose you gave them to us for. If you unsubscribe, we keep the address marked as unsubscribed so you are not emailed again; ask and we delete it.
• Your account and kept plans: until you delete them or the account. Sign-in records for a phone go when you sign out there or delete the account.
• Plan invites: 14 days to use, then deleted 30 days after they expire.
• Usage counts: 14 months. Queue wait reports: 7 days.
• Crash reports: for PostHog’s retention period under our plan, then deleted by PostHog.
• Android tester list and beta emails: cleared and deleted after launch.
• Backups: deleted data leaves our database backups as they expire, within 30 days.

Deleting your account

In the app, signed in: the Account tab, then Account, then Delete account, and confirm. This deletes your account, every plan you kept (and the copies of them on this phone), your place on plans shared with you, the invites you sent and your pass records, straight away. Without the app, follow the steps on Delete your account. Usage counts, queue reports and crash reports aren’t linked to your account, so they are deleted on the schedule above. The waitlist is a separate list: unsubscribe or ask us to remove you.

Cookies and tracking

The website sets no advertising cookies, and we never turn on any of Google’s advertising signals. There is no ad remarketing, no audience list, no ad personalisation, and nothing here is shared with an advertising network.

Before you choose: we count page views without cookies and without an id that is kept between visits. Vercel Web Analytics and Vercel Speed Insights run in this mode all the time. Google Analytics runs with every consent signal denied, which means it stores nothing on your device. PostHog records nothing at all until the banner is answered.

If you decline: nothing changes except that the banner stops asking. Google Analytics stays fully denied. PostHog switches on in its cookieless mode, which stores nothing on your device beyond your choice, and counts the visit through a hash worked out on PostHog’s own servers: no persistent identifier, no session replay, no heatmaps.

If you accept: Google Analytics 4 sets its analytics cookies, and PostHog keeps an identifier across your visits, records a replay of your session, and builds heatmaps of where people click and scroll. Session replay masks every input: anything you type, including your email address in a signup form, is replaced before the recording leaves your browser. We never attach your email address or any other personal detail to an analytics profile.

Changing your mind: select Cookie settings in the footer of any page to reopen the choice. Declining, or clearing your browser’s storage for this site, puts everything back to the cookieless state above.

Your browser also stores your waitlist and newsletter status, and your cookie choice, locally on your own device so the pages remember you. That information never leaves your browser.

Children

Queenstown Pocket is made for a general audience and is not directed at children. A plan can hold the age bands of children travelling, entered by the adult planning the trip, but never a child’s name, birthdate or contact details.

Your rights

Under the Privacy Act 2020 you can ask us at any time:

• what personal information we hold about you;
• to correct it; or
• to delete it.

Email hello@queenstownpocket.com and we’ll respond within 20 working days, usually much sooner. If you’re not happy with how we’ve handled your information, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this policy

If this policy changes materially, for example when paid passes, Sign in with Apple or plan alerts arrive, we’ll update this page and the date at the top before the change takes effect. We won’t reduce your rights over information you’ve already given us without asking you first.

Last updated 12 October 2026 · Tally Sphere Limited, New Zealand