Privacy Policy

Last updated: 5 October 2026

RunOrder is provided by Polychrome Limited (New Zealand). This policy explains what we collect and why. We comply with the New Zealand Privacy Act 2020 and, where they apply, other privacy laws such as the GDPR.

What we collect

• Organiser accounts: your name and email address from sign-up or Google/Apple/Microsoft sign-in.
• Event content: what organisers enter, such as event names, times, venues, performer or session names, logos and taglines.
• Guests' devices: if a guest turns on alerts, we store a notification token for their device, linked to that event only. Guests don't need an account and we don't collect their names or emails.
• Purchases: handled by Paddle. We receive a transaction reference and the buyer's email; we never see card details.
• Contact form: your name, email and message.
• On your device: your sign-in session, theme choice and whether alerts are on, stored in your browser.
• Usage analytics: how people use RunOrder (pages visited, buttons used, device and browser type, approximate location from IP address, and how you heard about us if you tell us). For organisers this is linked to your account; guests stay anonymous. We also record anonymised screen sessions with all text and typing hidden, so we can see where people get stuck.

How we use it

To run RunOrder: showing events, sending alerts, managing credits, answering messages and keeping the service secure. We use analytics only to understand how RunOrder is used and improve it. We don't sell personal information, show ads or use advertising trackers.

Who helps us run RunOrder

• Base44: hosting, database and sign-in.
• Google Firebase: delivering alerts to phones.
• Paddle: payments, invoicing and sales tax.
• Google Fonts: website fonts (your browser requests them from Google).
• PostHog (EU hosting): usage analytics and anonymised session recordings.

These providers may store data outside New Zealand, including in the United States. We use providers that protect personal information to a comparable standard.

How long we keep it

• Account and event data: until you delete the event or your account.
• Alert tokens: until the device turns alerts off or the token stops working.
• Contact messages: up to 2 years.
• Usage analytics: as long as useful for improving RunOrder, and deleted on request. Session recordings are deleted automatically after about a month.

Your rights

You can ask to see, correct or delete your personal information using the contact form. If you're not happy with how we handle your request, you can complain to the New Zealand Privacy Commissioner (privacy.org.nz) or your local data protection authority.

Children

Organiser accounts are for adults. Recital organisers may list children as performers. Please use first names only, with the permission of a parent or guardian.

Changes

We'll update this page if anything changes and note the date at the top.