Privacy Act 2020
Privacy policy
Version 8 · In effect from 1 November 2026
Kiwi Game Bazaar shows which New Zealand shops have a used game in stock. We sell nothing ourselves and no purchase happens here, so there is very little about you for us to hold. This page says exactly what there is.
1. What we collect
We collect the minimum a feature genuinely needs, and nothing else.
- If you write to us through our contact form: your name, your email address and your message. We also record the IP address the message was sent from, kept for spam and abuse triage only. It is never used to identify you for anything else.
- If you set up a stock alert: your email address, the game and platform you asked about, the condition you chose, whether it should repeat, and the IP address the request came from (for abuse triage only). We also record which copies we have emailed you about, so we never email you twice about the same copy turning up. If you chose a repeating alert and a copy sells and comes back on a later night, we will tell you again. That is what a repeating alert is for.
- If you tip through Ko-fi, Ko-fi and the payment service it uses (PayPal or Stripe) pass us what they show a creator about a payment: your name, email address, the amount and whether it repeats, any message you add, and some payment details, such as a card's type and last four digits (never the full number). We use it only to say thanks.
- Analytics: we count visits with Umami (umami.is), a cookieless analytics service. It sets no cookie. When a page loads, your browser sends Umami the page's address and title and the address you came from (each address with everything after a ? or # removed, so no key in a link we email you is sent), along with your screen size, language, browser, operating system and device type. A page's title can carry what you typed: a search for "zelda" is titled "Search · zelda", so what you search for does reach Umami. Umami also receives your IP address, as any website you load does, and uses it to work out a country, region and city and to group the pages viewed in one visit. We use it to see which pages people read and what they look for, not to identify anyone, and nothing from it is shared with advertisers.
- Site monitoring: a sample of page visits and the site's error reports go to Nightwatch, our monitoring service, so we can find errors and slow pages. Section 4 says exactly what they carry; none of it is your IP address.
- Standard technical cookies: a session cookie and a security (CSRF) cookie, which the site needs to work correctly and to keep our forms safe to submit. Neither builds a profile of you.
- If you choose where you are delivering to on a game page (urban, rural or Auckland), your browser remembers that choice in its own storage so the shipping lines stay on it. It is not a cookie, it is never sent to us, and you can clear it with your browser's site data.
2. What we do not collect
No full card numbers, because nothing is ever bought or paid for on this site: a tip through Ko-fi is paid on Ko-fi's own site, and we never see your full card number. No government or identity document numbers. No accounts, passwords or logins: there is no way for a member of the public to create one. Nothing a health, ethnicity or other special-category rule would cover.
3. Why we collect it
Only for the reason it was given to us.
- Contact details and your message: so we can read it and reply, including a shop writing in to ask to be left out of our listings, which is the request this form was originally built for.
- Stock alerts: to email you when a copy of the game you asked about turns up at a New Zealand shop, and for nothing else. When you set one up we send one email saying it is on; after that we email only when a copy turns up. Every alert email says who it is from and carries a link to stop it, or to delete your address and every alert on it.
- The sending IP address: so that a flood of automated submissions can be told apart from people writing in.
5. Where it is stored, and whether it leaves New Zealand
Our database is hosted on Laravel Cloud infrastructure provisioned in Sydney, Australia, so your information is stored outside New Zealand.
Australia has its own privacy law, the Privacy Act 1988 (Cth) and the Australian Privacy Principles, which we consider provides comparable safeguards to New Zealand's Privacy Act 2020, and our hosting provider is contractually bound to protect your information under standard confidentiality and data-processing terms. That comparable-safeguards reading is our own judgement rather than a legal opinion, and it is being reviewed.
Nightwatch's servers are also outside New Zealand; they hold the page-visit samples and error reports described in section 4.
What Ko-fi and the payment service pass us about a tip sits in our Ko-fi, PayPal or Stripe account and in our email, outside this site's database, and may be stored outside New Zealand.
Umami's servers are also outside New Zealand; they hold the visit data described in section 1.
6. How long we keep it
Contact messages are kept for up to 24 months after we have dealt with them, and then deleted. Messages our spam filter catches are kept only as long as an abuse review needs them.
A stock alert is deleted automatically once it has had no activity for 12 months (never switched on, never fired, or stopped), along with the record of what it sent you. When an address has no alerts left, the address is deleted too.
You do not have to wait for either. Every alert email links to a page where you can delete your address and all its alerts yourself, straight away. Ask us to delete a contact message you have sent and we will, whenever you ask.
What a tip passes us sits in our Ko-fi, PayPal or Stripe account and in our email. We will delete the emails if you ask; the account records are kept under those services' own rules and any record-keeping the law requires.
On the Umami plan we use, visit data is available for 6 months. What Umami does with it after that is set by Umami's own privacy terms, published at umami.is.
7. Keeping it secure
What this site holds sits in a managed, access-controlled database, and the number of people who can read it is one. No online system is completely secure, but the honest reason your risk here is low is that we hold so little: a name, an email address and a message you chose to send, or an email address and the games you asked to hear about.
If you tip through Ko-fi, what Ko-fi and the payment service pass us sits in our Ko-fi, PayPal or Stripe account and in our email, and none of it is in this site's database.
The visit data described in section 1 is held by Umami, not in our own database.
8. Your rights
Under the Privacy Act 2020 you can ask us to tell you what we hold about you, to correct anything that is wrong, or to delete it. Ask through the contact form at kiwigamebazaar.co.nz/contact, and give the email address you wrote to us from, or the name and email on your tip, so we can find what we hold. We will answer within a reasonable time and will not charge you for a straightforward request.
9. If something goes wrong
If we ever suffer a privacy breach that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as we reasonably can, as Part 6 of the Privacy Act 2020 requires.
10. Complaints
If you are unhappy with how we have handled your information, tell us first through the contact form at kiwigamebazaar.co.nz/contact. If our answer does not satisfy you, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
11. Children
This site is not directed at children, and we do not knowingly collect personal information from anyone we know to be under 16.
12. Changes to this policy
We will update this policy as the site grows. The version and date at the top always reflect the latest change, and anything that materially changes how we use your information will be said plainly rather than slipped in quietly.
Write to us: use the contact form.