Kaupapa here tūmataitiPrivacy policy

Last updated 24 October 2026

This policy covers the Hemapire website and every Hemapire app. It says what each app collects, where it is kept, who else is involved, and how you can see, change or delete it.

Te whakarāpopototangaThe short version

• No ads. We never sell, rent or trade your information.
• No tracking cookies and no analytics, on this website or in the apps.
• We only collect what an app needs to work, and only use it to run that app for you and your whānau.
• Google and Microsoft data is used only for the feature you turned on, and never for ads or to train AI.
• You can ask to see, fix or delete your information at any time: tiaki@hemapire.nz.

Ko wai mātouWho we are

Hemapire is a small whānau-run maker of apps, based in Aotearoa New Zealand. In this policy “we” and “us” means Hemapire. We are responsible for the personal information the apps collect, under the New Zealand Privacy Act 2020. Our privacy contact is tiaki@hemapire.nz.

Tēnei paetukutukuThis website (hemapire.nz)

• The website has no sign-in, no forms, no cookies and no analytics.
• Our email address is hidden from spam bots by Cloudflare. A small Cloudflare script shows it to you when the page opens. It does not track you.
• It is hosted on Cloudflare Pages. Like any web host, Cloudflare handles your IP address and browser details to deliver the page and protect it from attacks.
• Its typeface (Archivo) is loaded from Google Fonts, so your browser also asks Google’s servers for the font files. Google Fonts does not set cookies.

Mahere whānauMahi ā Whānau

Mahi ā Whānau is the family planner at whanau.hemapire.nz.

What it stores

• Your account: your username, the display name you choose, your colour, whether you are a parent or kid, and your password. Passwords are stored only as a scrambled one-way hash (scrypt), so nobody can read them, including us.
• Your whānau: its name, timezone and language setting, invite codes, quests, points, rewards and requests, the weekly goal, the shopping list, the dinner plan and events.
• Calendars you bring in: if you add a calendar by its private iCal address, the address is stored encrypted, and the planner copies that calendar’s events in about every 30 minutes so your whānau can see them. You can choose “Busy only” so titles and details are hidden.
• Your calendar feed link: each person has a private link that Apple, Outlook or Google Calendar can subscribe to. It only shows planner events and dinners you are part of. You can make a new link at any time, which stops the old one.
• Signing in: one cookie keeps you signed in for up to 30 days. It is needed for the app to work and is not used for tracking. Your browser also remembers which tab you last opened. To stop people guessing passwords, failed sign-ins are counted against your network address for 10 minutes, in memory only.

Where it is kept

On our own small server in New Zealand. People reach it through Cloudflare, which carries the encrypted connection to the server but does not keep your planner data.

Connect Google (optional)

Each person can choose to press Connect Google in Settings › Calendars. Nothing happens with Google unless you do.

• What we ask Google for: the calendar.app.created permission, plus your Google account’s email address. The email is only shown in Settings so you know which account is connected.
• What that permission allows: the planner makes its own calendar, called “(your whānau) (Mahi ā Whānau)”, in your Google account, and can only see and change that one calendar. It cannot see, read or change any of your other calendars or events.
• What goes into it: the planner events you are part of and the whānau dinners, so they appear on your phone. Events brought in from other calendars are not sent to Google.
• What we keep: a long-life sign-in token from Google, stored encrypted, and a list matching each planner event to its copy in that calendar.
• Disconnect: pressing Disconnect deletes the Mahi ā Whānau calendar from your Google account, tells Google to cancel the planner’s access, and deletes the token. Removing a person from the whānau does the same. You can also remove access at any time at myaccount.google.com/permissions.
• What we never do with Google data: we do not sell it, share it with anyone, use it for advertising, or use it to train artificial intelligence or machine-learning models. No person reads it, unless you ask us to help with a problem, or the law requires it.

Mahi ā Whānau’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The app’s typefaces

The app loads its fonts from Google Fonts, so your browser asks Google’s servers for those files. No planner information is sent.

Whare whakaahuaPātaka

Pātaka is the whānau photo storehouse at pataka.hemapire.nz.

What it stores, and where

• Your account and the catalogue are kept in Supabase, in its Sydney, Australia region. This includes your email address, your password (stored hashed by Supabase), your name, the whānau you belong to and your role, invite codes, albums and who can see them, favourites, and any notes, reactions or name tags you add.
• Photo details are also kept in the catalogue so Pātaka can sort and find them: the date a photo was taken, its size, its width and height, which OneDrive it is in, and a fingerprint of the file used to spot duplicates.
• The photos and videos themselves are stored in your whānau’s own Microsoft OneDrive, inside the app folder Apps/Pātaka. They go straight from your device to OneDrive. Photo files never pass through Hemapire’s servers.
• Signing in: Supabase sends sign-in and confirmation emails. Your browser keeps your sign-in so you stay signed in.

Connecting OneDrive (Microsoft)

• A Kaitiaki connects a OneDrive with Microsoft sign-in. Pātaka asks for Files.ReadWrite.AppFolder, which lets it use only its own Apps/Pātaka folder, not anything else in that OneDrive. It also asks for basic account details (User.Read) to tell accounts apart, and to stay connected (offline_access).
• Pātaka reads how much space is free so it knows where to put new photos.
• Microsoft’s long-life sign-in token is stored encrypted in Supabase’s secure vault.
• We do not sell or share Microsoft data, use it for ads, or use it to train AI.
• You can remove Pātaka’s access at any time at account.live.com/consent/Manage. The photos already in Apps/Pātaka stay in your OneDrive.

If we add backups or small preview images later, we will update this policy before they start.

The app’s typefaces

Pātaka loads its fonts from Google Fonts, so your browser asks Google’s servers for those files. No photos or account details are sent.

Mā ngā tamarikiTiaki Taiao

Tiaki Taiao is made for children.

• There are no accounts, no sign-up, no ads and no tracking.
• Progress, and any name typed onto a certificate, is saved only in the browser on the device being used. It is never sent to us or anyone else. Clearing the browser’s data for the site removes it.
• The game is served from our server in New Zealand through Cloudflare. The server only sends the game. It does not keep a record of what your child does.
• The game loads its fonts from Google Fonts, so the browser asks Google’s servers for those files. Nothing about your child is sent.

Ngā ratongaServices we use

These companies help run the apps. Each only gets what it needs for its part.

Some of these are outside New Zealand. They are large, established services with their own privacy and security protections, and we only use them for the purposes above.

Ngā tamarikiChildren

Mahi ā Whānau has kid accounts. A kid account can only be made with an invite code from a parent in that whānau, and the parent is responsible for it. Kid accounts store only a username, display name, colour and the kid’s quests, points and events. Tiaki Taiao, made for children, collects nothing at all. Pātaka is meant for adults and the photos they choose to share with their whānau.

Te pupuri me te mukuKeeping and deleting your information

• We keep your information while your account is in use, and delete it when you or your whānau remove it, or when you ask us to.
• Mahi ā Whānau: a parent can remove a member in Settings › Whānau, which deletes their account, points, calendars and Google connection. Ticked shopping items disappear after 7 days. To delete a whole whānau, email us.
• Pātaka: items moved to Para can be brought back for 30 days. To delete your account, or remove photos for good, email us. Photo files can also be deleted straight from the Apps/Pātaka folder in OneDrive.
• Tiaki Taiao: clear the site’s data in your browser.
• To see, change or delete anything, ask in the app or email tiaki@hemapire.nz. We will reply within 20 working days, and usually much sooner.

Ō tikaYour rights

Under the New Zealand Privacy Act 2020 you can ask for a copy of the personal information we hold about you, and ask us to correct it. We will not charge for this. We only collect information for a clear purpose, keep it safe, use it for the reason we collected it, and do not keep it longer than needed.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.

Te tiakiKeeping it safe

All connections use HTTPS. Passwords are hashed, and sign-in tokens and private calendar addresses are encrypted. Access to each whānau’s information is limited to that whānau. If a privacy breach ever caused or was likely to cause serious harm, we would tell the people affected and the Privacy Commissioner as soon as we could, as the law requires.

Ngā panonitangaChanges and contact

If we change this policy we will update the date at the top. If a change affects how your information is used, we will say so in the app before it starts. If we ever add paid plans, payments would be handled by a payment provider, and we would update this policy before taking any payment details. Questions about privacy: tiaki@hemapire.nz.