Privacy Policy

Last updated: 25 May 2026

The TourCrew app is a volunteer-led project developed and operated by Simon van den Berg. This policy explains what personal information we collect, why, and how we protect it.

By using TourCrew you agree to the collection and use of information as described below. If you do not agree, please do not use the app.

TourCrew is intended for use by persons aged 13 or older. We do not knowingly collect personal information from anyone under the age of 13. If you believe a child under 13 has provided us with personal information, please contact us so we can remove it.

1. Information We Collect

a) Information you provide

Data	Purpose
Parent full name	Identify you within the app and in email communications
Email address	Account login, event reminders, swap notifications, and password resets
Password	Account authentication (stored as a one-way hash — we never store or see your plain-text password)
Child's name	Link volunteer assignments to the correct family
Swap request messages	Optional free-text notes you include when requesting or responding to a volunteer spot swap. Visible only to the other parent involved in the swap.
Chat messages	Text messages you post in chats. Group chat messages are visible to the members of the fundraising group they are posted in. Direct chat messages are visible only to the specific individuals included in that chat.
Reported content and reports	When you report a chat message, the message content, the sender, and the timestamp are sent to the admin of your fundraising group for review.
Block list	If you block another user, we store a record linking your account to the blocked account so we can stop displaying their messages to you.

b) Information collected automatically

Data	Purpose
Push notification token	Deliver push notifications to your device (e.g. swap requests, event reminders, chat messages). This is an app-specific identifier, not a hardware device ID.

c) Information we do NOT collect

• Location or GPS data
• Photos, contacts, or files from your device
• Phone numbers
• Payment or financial information
• Browsing history or advertising identifiers
• Health, fitness, or biometric data
• Analytics, diagnostics, or crash reports

2. How We Use Your Information

We use your information solely to operate the TourCrew app:

• Create and manage your account
• Assign you to volunteer spots and display event schedules
• Send you email and push notifications about your assignments, swap requests, chat messages, and event reminders
• Operate the gamification features (XP, leaderboard, cap levels, high fives) within your fundraising organisation
• Allow you to request and respond to spot swaps with other parents
• Allow you to chat with your fundraising group and with individual members
• Allow you to report improper chat messages to your group admin and block other users
• Allow group admins to review reported content and take moderation action

We do not use your information for advertising, marketing to third parties, profiling, or automated decision-making. Reported content is reviewed manually by your fundraising group admin; we do not use automated filtering or automated moderation.

3. Third-Party Services

We share limited data with the following services, solely to deliver app functionality:

Service	Data shared	Purpose
Expo Push Notification Service (expo.dev)	Push token, notification title and body	Deliver push notifications to your iOS device
Email provider (SMTP)	Your email address and name	Send transactional emails (invitations, reminders, swap notifications, password resets)

We do not sell, rent, or share your personal information with any other third parties. We do not use any analytics, advertising, or tracking services.

4. Data Storage and Security

• Your data is stored in a secured database.
• Passwords are hashed using bcrypt and are never stored in plain text.
• All communication between the app and our servers is encrypted using HTTPS/TLS.
• Authentication tokens are stored securely on your device using iOS Keychain (mobile app) or browser local storage (web app).
• Access to the database and server infrastructure is restricted to authorised administrators.
• While we take reasonable measures to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the service. Volunteer assignment records and gamification data are retained for the duration of each season to support leaderboard and event history features.

Chat messages are retained so that conversation history remains available to the other members of the group or direct chat in which they were posted.

Reported content (the reported message, sender, and timestamp) may be retained for moderation or audit purposes for a maximum of 6 months.

Password reset tokens expire automatically after 15 minutes.

6. Your Rights

You have the right to:

• Access your data — view your profile, assignments, and activity within the app at any time.
• Correct your data — contact your fundraising administrator to update your name, email, or linked children.
• Delete your account — you can permanently delete your account from the Profile screen in the app. This immediately removes your personal information, XP history, swap requests, push tokens, and high fives from our active systems and any backups. Child records may be retained if linked to another parent. Chat messages are not automatically removed when you delete your account, because each chat is shared with at least one other party and deleting your messages would remove content from their conversation history. Your messages remain visible to the other participants but are no longer attributed to your name — they are shown as coming from a deleted user. Reported content involving you may also be retained for the moderation period described in Section 5.
• Withdraw consent — you can disable push notifications through your device settings at any time.

7. Children's Privacy

TourCrew stores children's first names solely to link volunteer assignments to the correct family. We do not collect any other information about children. Children do not have accounts and do not use the app directly — only parents and fundraising administrators interact with the app.

Child names are entered by fundraising administrators, not by the children themselves. If you would like a child's name removed, contact the fundraising administrator listed on your Profile page.

Because the app includes free-text chat, each user is solely responsible for the content of their own messages. The app operator strongly discourages sharing identifying details about children — such as full names, schools, addresses, or other personal information — in any chat.

8. Tracking and Analytics

TourCrew does not track you. We do not use any analytics SDKs, advertising frameworks, or tracking technologies. We do not collect advertising identifiers or share data with data brokers.

9. International Data Transfers

Push notifications are routed through Expo's servers (based in the United States). Our server infrastructure is hosted in Australia and New Zealand. Email is sent via our configured SMTP provider.

10. Compliance with Laws

We may disclose your personal information if required to do so by law or in response to valid requests by public authorities (e.g. a court order or government request).

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify users of material changes through the app or by email. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact Us

If you have questions about this privacy policy or your personal data, please contact us:

Email: tourcrew@northshore.org.nz