Privacy policy

This policy applies to:

• The public website (home, about, resources, gallery, FAQ, and similar pages)
• The logged-in app at /app and related routes
• Account registration, login, and password recovery flows
• Optional features such as Optional features such as saved checklists, household notes, and document templates
• Public activity share links that do not require a login

It does not govern third-party websites we link to (such as Plunket, Healthline, or KidsHealth). Those sites have their own privacy practices.

Information you provide directly

• Account details: email address, password (stored in hashed form by our authentication provider), and optional display name
• Profile preferences: region, simple mode, milestone visibility, selected child, and similar in-app settings
• Household notes and saved checklists you choose to add name, date of birth or expected due date, pregnancy flag, optional notes, and optional avatar
• Activity and programme use: Activity and programme use: saved checklists, completed steps, dismissed Today suggestions, and optional notes
• Journal content: Optional notes: text you choose to save about what helped your household
• Communications: messages you send us for support or programme feedback

Information collected automatically

• Basic technical data: device type, browser, approximate access times, and pages or screens viewed
• Security and reliability logs: IP address, error reports, and authentication events where needed to protect accounts
• Install and session data for the progressive web app (PWA), such as whether the app was added to a home screen

We do not require you to add child profiles or journal entries. You can use much ofHome Steps with minimal personal information.

Home Steps requires a whānau account to use the app. When you sign in, your settings, saved checklists, and optional notes are stored in your programme account on our servers so you can access them across devices.

We do not offer a separate offline-only or browser-only mode for household data. If you sign out or delete your account, synced programme data is handled as described in the account deletion section below.

We use personal information to:

• Provide and maintain Home Steps (accounts, sync, and core app features)
• Personalise daily steps and topic suggestions to your household context
• Remember your preferences, saved activities, and programme progress
• Store optional notes about what helped your household
• Operate public share links for individual activities (without your profile data)
• Publish and administer programme content (activities, articles, packs) for editors
• Respond to support requests and protect the security of the service
• Understand aggregate usage patterns to improve the programme — not to profile children for promotional purposes

We do not sell your family data. Home Steps is not funded by advertising targeted at children or caregivers.

We do not:

• Sell, rent, or trade personal information to data brokers or marketers
• Use child-focused profiling for third-party advertising or behavioural profiling
• Require you to upload photos of children to use the service
• Publish your private notes or household details on public pages without your action

We handle personal information in line with the Privacy Act 2020 (New Zealand) and related guidance from the Office of the Privacy Commissioner. Depending on the activity, we rely on one or more of the following:

• Your consent — for example, when you create an account, add a child profile, or upload a photo
• Performance of the service — to operate features you ask us to provide
• Legitimate programme interests — to keep the service secure, reliable, and improving, balanced against your privacy rights
• Legal obligations — where we must retain or disclose information under New Zealand law

We process personal information to operate Home Steps, keep accounts secure, and meet our obligations under the Privacy Act 2020 (New Zealand).

You and your whānau account. Information you save to an account is accessible when you sign in. Keep your login details private.

Programme editors and administrators. Authorised Trust staff and volunteers with editor or admin roles can manage published programme content (activities, articles, packs, and public pages). They do not routinely browse private family journals. Access to user support data occurs only when needed to resolve a request, maintain security, or address a safety concern.

Service providers. Infrastructure partners (such as cloud hosting and database services) process data on our behalf under contractual safeguards. We use reputable providers with security and confidentiality obligations.

Share links. When you share an activity card URL, recipients see the activity content only — not your account, journal, or child profiles.

We may disclose information if required by law, court order, or to protect the rights, safety, or security of users, children, or the public.

Journal and activity photos are optional. If you upload an image, it is stored in our secure content storage and linked to your account. You should only upload photos you have the right to share — for example, images of your own children or where all relevant caregivers have agreed.

Deleting a journal entry or your account should remove associated photos from active programme storage, subject to short backup retention described below.

Do not upload images containing other people's personal details (such as visible address labels, medical documents, or school enrolment forms) unless you intend to store them privately and understand the risks.

Account and programme data is stored in secure cloud infrastructure operated by our service providers. Data may be processed in New Zealand and/or other countries where those providers maintain facilities, always under contractual protections.

We use technical and organisational measures appropriate to a family-facing charity app, including encrypted connections (HTTPS), access controls, row-level security on user data, and role separation for editors. No online service can guarantee absolute security; please use a strong, unique password and sign out on shared devices.

We retain personal information only as long as needed for the purposes in this policy:

• Active accounts: profile, children, journal, and logs are kept while your account remains open
• Deleted content: when you delete journal notes or child profiles in-app, they are removed from active use
• Closed accounts: when you request deletion, we will delete or anonymise personal data within a reasonable period, except where retention is required by law or for dispute resolution
• Backups and logs: encrypted backups and security logs may persist for a limited period before automatic deletion

Encrypted backups and security logs may persist for a limited period before automatic deletion.

Home Steps is designed for adults managing household resilience. We do not knowingly collect personal information directly from children under 16 without appropriate adult involvement.

If you believe a child has provided us personal information without caregiver consent, contact us and we will take appropriate steps to delete it.

Please be thoughtful about what you record in notes — everyone in your household has privacy interests.

Home Steps uses essential cookies and limited browser storage to keep you signed in, remember preferences, and support PWA installation. We do not use third-party advertising cookies.

Your browser may allow you to block cookies; doing so may prevent login or sync from working correctly.

Depending on applicable law (including the Privacy Act 2020), you may have the right to:

• Access personal information we hold about you
• Request correction of inaccurate information
• Delete child profiles, journal entries, and photos you added
• Delete your account and associated personal data via Settings or by contacting the Trust
• Withdraw consent where processing is consent-based (which may limit features)
• Complain to the Office of the Privacy Commissioner (New Zealand)

To exercise these rights, use in-app controls where available or contact the Trust. We may need to verify your identity before fulfilling certain requests.

You may delete your Home Steps account and associated personal data in Settings or by contacting the Trust. Before deleting, save any journal memories you wish to keep elsewhere.

Deletion is intended to remove personal profiles, saved checklists, optional notes, and linked content from active programme systems. Anonymised or aggregated statistics that cannot identify you may be retained for programme reporting.

If you subscribe to a newsletter or programme updates, we will use your email address to send those messages. You can unsubscribe at any time using the link in the email or by contacting us.

We do not send behavioural advertising based on child profiles or journal content.

Home Steps is built for whānau in Aotearoa New Zealand. If you access the service from overseas, your information may be transferred to and processed in New Zealand and other countries where our providers operate. By using the service, you acknowledge those transfers for programme purposes.

We may update this policy as Home Steps grows — for example, when new features ship or when legal advice requires clearer wording. We will post the updated version on this page and adjust the “Last updated” date.

Significant changes may also be highlighted in-app or by email where appropriate. Continued use after an update means you accept the revised policy, unless otherwise required by law.

Please also read our Terms of use, which describe acceptable use, educational disclaimers, and liability limits for Home Steps.

For privacy questions, access requests, or concerns about how we handle family information, contact Vector Group Charitable Trust via vectorgroup.org.nz.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner (New Zealand).