Privacy policy

Last updated 6 November 2026.

This page explains what personal information pocketpass.nz collects, why, who it goes to, and what you can do about it. It is written to meet the New Zealand Privacy Act 2020.

Who we are

pocketpass.nz is run by Bill Walker, a sole trader in Christchurch, New Zealand (NZBN 9429054064300). It is a service that turns a spreadsheet into Apple Wallet and Google Wallet passes. You can contact us about privacy at info@pocketpass.nz.

Two kinds of people

• Account holders: the people who sign up to pocketpass.nz to make passes for a club, school, business or group (the “organisation”).
• Pass holders: the people a pass is made for, whose details an organisation uploads in a spreadsheet or sends through our API.

What we collect about account holders

• Your email address and organisation name.
• Your password, stored only as a one-way hash. We cannot see or recover it; you can reset it from the log in page.
• When you signed up, confirmed your email and agreed to the terms, the internet (IP) address you signed up from, and the address used to ask for a confirmation or password reset link.
• Failed log in attempts (the email address tried and the IP address), kept for one day to stop password guessing.
• The templates, artwork, passes and API keys you create (API keys are stored only as a hash).
• If you apply for not-for-profit pricing: your organisation’s Charities Register or incorporated society number, website and anything you write in the application, and whether it was approved.
• If you buy passes: the number you bought, your subscription’s status and renewal date, your answer to how many to renew, and the reference numbers Stripe gives your account and subscription. Your card details go straight to Stripe; we never see or store them.

We need your email address to run your account: we use it to confirm the account is yours, to let you reset your password, and to send you notices about your account and payments. Without it you cannot sign up. We do not send marketing emails.

What we collect about pass holders

The organisation decides what goes on its passes. We keep only the spreadsheet columns its pass template uses (for example name, member number, email address and expiry date). Every other column in an uploaded spreadsheet is ignored and never saved, and the uploaded file itself is not kept.

We also keep:

• Pass-link emails the organisation asks us to send (address, name, subject and message), and whether they were delivered.
• A simple record of what happens to each pass: when the pass page is opened, when the Apple pass is downloaded, when Save to Google Wallet is tapped, and when the pass is added to or removed from a wallet. This record notes only the type of phone (iPhone, Android or other) and the time. It does not keep your IP address or browser details. Visits by search engines, link checkers and logged-in account holders are not recorded.
• If you add a pass to Apple Wallet, an identifier for your device’s wallet and the push token Apple gives us, so we can tell your iPhone when the pass changes. These are removed when you remove the pass from your wallet.

For pass holders, the organisation that issued the pass is responsible for having the right to share your details with us. We hold and use them on the organisation’s behalf, only to make, update and deliver its passes. If you have questions about why an organisation has your details, ask that organisation.

Who we share information with

• Google: when someone taps Add to Google Wallet, the pass details (and its images) are sent to Google so Google can show the pass in Google Wallet. When the organisation changes a saved pass, we send the change to Google. Google tells us when a pass is saved to or deleted from Google Wallet.
• Apple: an Apple Wallet pass is downloaded straight from us to your device. When a pass changes, we send Apple’s push notification service a message to your device’s push token; the message contains no pass details, and your iPhone then fetches the updated pass from us.
• Our email provider (25mail.st) sends our emails: account confirmation and password reset emails, and pass-link emails an organisation asks us to send.
• Stripe takes payments for not-for-profit accounts. We give Stripe the account’s email address, organisation name and the number of passes being bought; you enter your card details on Stripe’s own payment pages. Stripe’s pages set their own cookies, which are covered by Stripe’s privacy policy. Pass holders’ details are never sent to Stripe.

Google, Apple, Stripe and our email provider are based outside New Zealand, so information sent to them is handled overseas under their own privacy policies. We do not sell personal information, we do not use advertising or tracking cookies, and there are no analytics or advertising scripts on this site.

Where it is stored and how we protect it

Our server is in New Zealand. Connections to the site are encrypted (HTTPS), passwords and API keys are hashed, pass links are long random codes that cannot be guessed, each organisation can see only its own data, and the database is readable only by the server itself. Uploaded images are checked and re-made before they are used.

If a privacy breach happens that is likely to cause someone serious harm, we will tell the people affected and the Office of the Privacy Commissioner as soon as we can, as the Privacy Act 2020 requires. If it involves pass holders, we will also tell the organisation that issued their passes.

How long we keep it

• Pass holders’ details, their pass record and pass-link emails are deleted when the organisation deletes the batch, template or account they belong to, or replaces the pass by uploading that person again.
• Account details are kept until the account is deleted. To delete your account, email info@pocketpass.nz. Sign-ups that are never confirmed are removed after 7 days.
• A pass already saved in someone’s Apple Wallet or Google Wallet stays there until that person removes it; deleting it here stops its link working and stops further updates.
• Our web server’s access log (which records IP addresses and browser details of every visit) is kept for 14 days.
• Before each software update we take a copy of the database. We keep copies from the last 7 updates; older copies are deleted automatically when we update. Until then, a copy may still hold information that has since been deleted.

Cookies

We set one cookie, called pocketpass. It keeps you logged in and protects forms from misuse. It is deleted when you close your browser, and it is never used for tracking or advertising. We do not set any other cookies. (If you pay through Stripe, Stripe’s payment pages set their own cookies; see above.)

Your rights

Under the Privacy Act 2020 you can ask to see the personal information we hold about you and ask us to correct it. Email info@pocketpass.nz. If you are a pass holder you can also contact the organisation that issued your pass, which can change or delete your details itself.

If you are not happy with how we have handled your information, please tell us first. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes

If we change how we handle personal information, we will update this page and the date at the top.