Your details, and what we do with them.

Account details — the email you sign up with, and the display name and location you choose for your profile.

Your listings — the titles, descriptions, prices, quantities, units, regions, categories, history details and photos you post for sale or wanted, including job lots and their itemised contents.

Contact activity — when you use a contact button on a listing we record that contact happened (which listing, and when), so the marketplace can measure whether it's working. We do not store the content of what you then say to each other — that happens over your own email.

Messages to us — if you use our contact form or report something, we keep what you send so we can deal with it.

Technical data — basic information your browser sends and that our hosting keeps to run the site securely, such as log and session data.

To create and secure your account, show your listings, let buyers and sellers find and contact each other, respond to your enquiries and reports, keep the platform safe and honest, and — only if you opt in — send you the weekly summary email. When someone contacts you about a listing, we share the email on your account with them so they can reach you; it is not shown publicly on the page.

Where the law asks us to name a basis for using your information, ours are: performing our agreement with you (running your account and your listings), our legitimate interests in operating a safe and useful marketplace, your consent for the weekly summary email, and meeting our legal obligations.

We don't sell your personal information and we don't run ads on it. We do use a few trusted providers to run Leftover, who handle data on our behalf:

• Supabase — our database, logins and photo storage.
• Vercel — hosting that serves the site.
• MailerLite — sending the weekly summary email and handling unsubscribes, if you opt in.

We may also disclose information if the law requires it, or to protect members, the public or Leftover. Other members see your public profile and listings, and the email you've chosen once you or they start a contact.

Our database is hosted in Sydney and some of our providers process data elsewhere again, so your information is held outside New Zealand. Principle 12 of the Privacy Act 2020 is about exactly this: personal information may only be disclosed overseas where the receiving party is subject to safeguards comparable to the Act's. We rely on the data protection terms our providers publish, and we choose providers that apply recognised security and privacy standards.

We keep your information while your account is open and for as long as we need it for the purposes above or to meet legal obligations. If you delete your account, we remove your live listings and profile; where a record of a completed sale needs to remain, we detach it from your identity rather than keep your details.

You can see and change most of what we hold from your account: edit your profile and your listings any time, turn the weekly summary on or off, and delete your account from your account settings.

You can also ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Those are principles 6 and 7 of the Privacy Act 2020, and they are rights rather than favours: we don't charge for either, and if we turn a request down we have to tell you why. You can ask us to delete information or stop using it in a particular way, and you can withdraw consent to the weekly email at any time without affecting anything already sent.

To make a request, get in touch through the Contact page. Tell us what you want and we will come back to you within the time the Act allows.

If you think we have got it wrong — tell us first, and if you are not satisfied with what we do about it you can complain to the Office of the Privacy Commissioner at privacy.org.nz. You don't need our permission to do that, and you don't need a lawyer.

Leftover is a New Zealand marketplace and this policy is written to New Zealand law. If you are somewhere whose law gives you stronger rights than this describes, those rights still apply — tell us and we will work to them.

We take reasonable steps to protect your information, including access controls on our database so members can only reach what they're meant to. No online service can promise perfect security, so please use a strong, unique password and keep it to yourself.

We use the cookies needed to keep you signed in and the site working. We don't use advertising or cross-site tracking cookies.

Leftover is for people aged 18 and over. We don't knowingly collect information from anyone under 18.

We may update this policy as Leftover grows. If we make a material change we'll give reasonable notice on the site.