Privacy Policy
Effective: 26 July 2026 · Last updated: 10 August 2026
House Finder helps you find electronic music events and plan trips around them. To do that we collect some personal information. This policy explains what we collect, why, where it goes, and the control you have over it. We're covered by the New Zealand Privacy Act 2020, and we treat everyone's information to that standard wherever you are.
Who's collecting your information
House Finder is operated as a partnership based in New Zealand. For anything privacy-related, contact [email protected].
What we collect
When you create an account (all needed to run your account):
- Email address
- Date of birth — we're an 18+ platform and we require a date of birth showing 18 or over
- Password (stored only as a secure bcrypt hash — we never see or store the actual password)
- Home region (optional) — so we can show your local scene first
- Username (optional, shown publicly)
If you sign up or log in with Google, Spotify, or Facebook:
- Your email and basic profile from that provider, plus a provider account ID so we can log you in next time
- Facebook may also share your date of birth (so we can skip asking for it)
- Spotify (optional, and only if you choose Spotify signup): we request your top artists at signup, and again only if you choose “Connect Spotify” in Settings, purely to auto-follow the artists you already listen to that are in our catalogue — the "here's your scene" moment. We don't store your Spotify listening data or top-artist list; only the resulting artist follows are kept, and you can unfollow any of them. If Spotify declines or returns nothing, signup carries on without it.
Profile extras you can add (all optional, shown on your profile): avatar photo, short bio, favourite genres, Instagram handle.
As you use House Finder: artists you follow, events you save, your Keys balance and transaction history, referral activity (your invite code, who invited you), email preferences, and the signup source tag if you arrived via a campaign or invite link.
If you enable push notifications: the browser push subscription for your device (an endpoint URL and encryption keys). This only exists if you switch notifications on, and it's deleted when you unsubscribe or revoke permission.
Outbound click tracking — anonymous by design. When you click out to a ticket, travel, or source link, we log that a click happened (which link type, which event, which partner, and when). This log contains no user ID, no IP address, and no device identifier — we count clicks, we don't track clickers.
Proof that you agreed to our terms. When you create an account you tick a box agreeing to our Terms and this Privacy Policy. At the moment you tick it we record when you agreed, the IP address you signed up from, your browser's user-agent string, and which version of the Terms you agreed to. We keep that with your account for as long as the account exists. It's there so we can answer someone who says they never signed up, and so we can find and remove an account created with someone else's email address. It isn't used to track you around the site or to build a profile of you.
Technical basics: like nearly every website, our hosting and CDN infrastructure processes your IP address and browser details to deliver pages and protect against abuse, and keeps short-lived server logs. Our own application logs also note the IP address of signup attempts that get blocked or rate-limited, for the same reason — those are short-lived too.
What we don't collect: payment details (we don't sell anything), precise location, or government IDs.
Why we collect it
| What | Why (our basis for using it) |
|---|---|
| Email, password / OAuth identity | Run your account and log you in — necessary to provide the service you asked for |
| Signup consent record (time, IP, browser, terms version) | Prove you agreed to the Terms and to our emails, as NZ's Unsolicited Electronic Messages Act 2007 and Australia's Spam Act 2003 expect — and identify a signup made by someone else |
| Date of birth | You must be 18+ — we require a date of birth showing 18 or over, and we close any account we find belongs to someone under 18 |
| Home region, genres, follows, saves | Personalise your event feed, alerts, and weekly digest — the core service |
| Spotify top artists (one-off) | Set up your artist follows at signup, with your consent |
| Email address + preferences | Send the alerts and digests you've signed up for, with unsubscribe on every one |
| Push subscription | Send notifications you've turned on, with your consent |
| Keys and referral history | Run the rewards programme fairly and detect abuse |
| Anonymous click counts | Understand which links and partners are useful (and support our affiliate commissions) — no individual tracking |
| Usage analytics (Google Analytics) | Understand how the site is used so we can improve it |
We don't sell your personal information, and we don't use it for third-party advertising.
Cookies and browser storage
We keep this deliberately minimal:
| Name | What it is | Purpose |
|---|---|---|
session cookie | Signed session cookie (HTTPS-only, SameSite) | Keeps you logged in |
hf-theme (localStorage) | Your light/dark theme choice | Remembers your theme |
hf-welcome-seen (localStorage) | A "seen it" flag | Stops the welcome pop-up reappearing |
housefinder.eventsView (localStorage) | List vs map preference | Remembers your events view |
Google Analytics cookies (_ga etc.) | Usage analytics | See below |
| Push subscription | Stored by your browser | Only if you enable notifications |
Google Analytics runs with Consent Mode v2. Advertising storage is denied everywhere — we don't run ads. Analytics is on by default for our AU/NZ audience; for visitors in the EEA, UK, and Switzerland, analytics storage is denied by default unless granted. You can also block analytics with standard browser tools and the Google Analytics opt-out.
Who we share it with (and where it goes)
We share personal information only with the service providers that run House Finder, under their contractual privacy commitments — never for their own marketing. Some of them are overseas, which we're telling you here as the Privacy Act 2020 (IPP 12) expects:
- Railway (USA) — hosts our application and database. Your account data lives here.
- Cloudflare (global network) — CDN and security in front of the site; processes IP addresses and requests in transit.
- Resend (USA) — sends our emails; processes your email address and the content of emails we send you.
- Google (global) — Google Analytics (usage data, per the consent settings above) and Google sign-in if you use it.
- Spotify (EU/USA) — if you sign up with Spotify, the login and one-off top-artists request happen on Spotify's side under Spotify's privacy policy.
- Facebook / Meta (USA) — if you sign in with Facebook.
- Browser push services (e.g. Google, Mozilla, Apple, depending on your browser) — deliver push notifications you've enabled.
- Travel and ticketing partners (e.g. Expedia, Hotels.com, Wotif, Booking.com, and ticketing sites) — when you click an outbound link you leave House Finder and land on their site under their privacy policy. Affiliate links tell the partner the click came from House Finder; they don't carry your identity, and we don't send partners your personal information.
These providers may not be subject to obligations identical to the NZ Privacy Act, so we pick reputable providers with strong contractual safeguards and share the minimum needed. We'll disclose personal information beyond this list only if the law requires it or you ask us to.
Parts of your profile you choose to fill in (username, avatar, bio, genres, Instagram) are visible on the site itself.
How long we keep it
- Account data: for as long as your account exists. Ask us to delete your account and we'll delete or anonymise your personal information within a reasonable period, except where we need to keep a minimal record (e.g. abuse prevention or legal obligations).
- Signup consent record: kept for as long as your account exists, as proof you agreed. It's deleted along with the rest of your account when you delete it.
- Push subscriptions: deleted when you unsubscribe, or automatically when the push service tells us the device is gone.
- Anonymous click logs: kept for analytics — they contain no personal information.
- Email unsubscribe state: kept for as long as your account exists, so we don't email someone who's opted out.
- Admin audit log: actions our staff take in the admin tools (who did what, and when) are recorded and kept indefinitely as a security record.
Security
We take reasonable steps to protect your information: HTTPS everywhere, secure (HTTPS-only, SameSite) session cookies, passwords stored as bcrypt hashes only, access to admin tools restricted to named staff accounts with an audit log, and minimal data collection in the first place — the best-protected data is data we never collected.
If a privacy breach happens that is likely to cause you serious harm, we will notify the Office of the New Zealand Privacy Commissioner and affected people as required by the Privacy Act 2020, as soon as practicable, and tell you what happened and what we're doing about it.
Your rights
Under the Privacy Act 2020 you can:
- Access the personal information we hold about you;
- Correct it if it's wrong;
- Unsubscribe from any or all emails (link in every email, or in Settings) and turn off push notifications;
- Delete your account — email us and we'll take care of it.
Email [email protected] and we'll respond within 20 working days as the Act requires. Most profile information you can view and change yourself in Account → Settings.
If you're in Australia, the EU, or the UK, we'll honour equivalent access, correction, and deletion requests. If you're not happy with how we've handled your information, tell us first — and you can also complain to the Office of the Privacy Commissioner (privacy.org.nz) in NZ, or your local privacy regulator.
Under 18s
House Finder is strictly 18+. We don't knowingly collect information about anyone under 18, and we require a date of birth showing 18 or over at signup. If you believe someone under 18 has an account, email [email protected] and we'll remove it.
Changes to this policy
When we change how we handle personal information — for example, when Keys redemption or new integrations launch — we'll update this policy, change the date at the top, and flag significant changes by email or on-site notice before they take effect.
Contact
[email protected] — for privacy questions, access or correction requests, deletion requests, or anything else.