Privacy Policy

• If you create an account: your email address, a username, and your password. The password is stored only as a salted hash, so nobody, including us, can read it.
• When you sign in: a random sign-in token. Your browser keeps it in a cookie and the server keeps only a scrambled copy. It expires after 30 days, or when you sign out.
• When you add a plate: the plate and the details you enter, tied to your account, plus the reviewer's decision and any note.
• When you report an entry: what you write and, if you choose to give one, your email address. You don't need an account to report.
• Server logs: the web server records your IP address, the time, the page you asked for and your browser type. Because a plate is part of the address of its page, a plate you look up shows in those logs. They are kept for about two weeks, to keep the site secure and fix faults.
• Short-lived counters: to slow down repeated sign-in, sign-up and report attempts, the server remembers your IP address in memory for a short while. It isn't written to the database.

No analytics, advertising, tracking pixels, social-media buttons, or third-party scripts or fonts. The only cookie is the sign-in cookie, and it exists only if you sign in. We don't ask for your location or your real name.

• To run your account and show you where your submissions are up to.
• To review, publish, correct or remove entries, and to answer reports.
• To contact you about a submission or report, if you gave us a way to.
• To protect the site from abuse.

We don't sell your information, send marketing email, or build profiles of people.

• The public sees approved plate entries. They don't see who added them.
• Reviewers see your username next to your submissions, and the email address on a report if the reporter gave one. Nobody else sees your email.
• CarJam. When a reviewer asks for a vehicle's details, the plate (and nothing about you) is sent to CarJam, which supplies the make, model and year from the NZ vehicle register. CarJam's own terms and privacy policy apply to what it does.

We don't pass your personal information to anyone else, unless the law requires it.

An entry shows the plate, workgroup, region, station, callsign, livery, any notes, and the car's year, make, model, variant, colour and body style. It never includes owners, drivers, VINs or engine numbers; the CarJam lookup is cut down to the fields above before anything is saved. Entries describe vehicles, not people. If one identifies a person, or is wrong, use Report This Entry on its page.

• Your account details, until you close the account.
• Sign-in tokens, for 30 days at most.
• Plate entries, while they're listed. An entry that is taken down stays on file, hidden, so it isn't put back by mistake.
• Reports, after they're resolved, so we can see how a decision was made.
• Server logs, about two weeks.

You can ask us for the personal information we hold about you, and ask us to correct it. You can also ask us to close your account.

Closing an account removes your email and password and replaces your username, so nothing identifies you any more. The plates you added stay listed, because they're facts about vehicles, but they are no longer linked to a name.

Use the Report This Entry link on any plate page and say it's a request about the site or your account. A reviewer will pass it on.

If you think we've handled your information badly and we haven't put it right, you can complain to the Office of the Privacy Commissioner.

Passwords are stored only as salted hashes, sign-in tokens only as hashes, the sign-in cookie can't be read by scripts on the page, and only reviewers can see account details. No system is perfectly safe. If we find a breach that is likely to cause you serious harm, we'll tell you and the Privacy Commissioner, as the law requires.

You need to be 16 or over to have an account (see the Terms of Service). We don't knowingly keep accounts for younger people.

If this policy changes, we'll update the date at the top. If a change affects how we use what you've already given us, we'll say so on the site.

Use the Report This Entry link on any plate page and say it's a request about the site or your account. A reviewer will pass it on.