Privacy Policy

1. Who this Policy covers

This Policy covers people who create or use a BreakStacks account, Club Operators and Club members, people recorded as casual Club participants, visitors to password-gated Club pages, and people who contact Support.

Club Operators decide what Club and participant information they enter into BreakStacks. They may have their own privacy responsibilities and should tell participants when their information will be recorded in the Service.

2. Personal information we collect

Depending on how you use BreakStacks, we may collect:

• Account and authentication information: name, email address, optional profile details, authentication identifiers, session information, and account-security records.
• Club and participation information: Club names and settings, member display names, roles, invitations, games, entries, recorded Unit balances, Points, ledger records, and related timestamps.
• Subscription and billing information: plan, subscription status, billing identifiers, and transaction records. Stripe processes payment-card information; we do not ordinarily receive full card details.
• Support information: your name, email address, message, and any other information you choose to include when contacting us.
• Technical and security information: IP address, device and browser information, cookies, request data, error information, and security or abuse-prevention records.
• Compliance information: records of required confirmations, including the confirmation type and version, timestamp, IP address, and user agent.

BreakStacks records virtual Units for Club administration. Units are not legal tender or funds held, transferred, or settled by BreakStacks.

3. Where information comes from

We collect personal information:

• directly from you when you register, use the Service, or contact us;
• from a Club Operator when they add or manage members, games, or other Club records;
• from service providers, such as authentication and payment providers, when they send us information needed to operate your account or subscription; and
• automatically from your browser or device when you use the Service.

If a Club Operator has entered information about you and you do not have a BreakStacks account, you may contact us through Support to ask what information we hold and why.

4. Why we use personal information

We use personal information to:

• provide accounts, Clubs, games, ledgers, standings, and related features;
• authenticate users and maintain the security and reliability of the Service;
• administer subscriptions, payments, entitlements, and billing support;
• respond to support, privacy, security, and abuse reports;
• enforce our Terms, investigate misuse, and comply with legal obligations; and
• maintain and improve the Service using operational and diagnostic information.

We do not sell personal information as part of our business model.

5. Password-gated Club pages

Some read-only Club pages are available to anyone who has the Club’s current shared password. Depending on the Club’s settings, these pages may show Club names, game details, member display names, Points, aggregate totals, and an exact-name Unit balance result for a casual member.

A shared password limits access, but it does not make information confidential between every person who knows it. Club Operators are responsible for sharing and rotating the password appropriately and for enabling optional balance lookup only when suitable for their Club.

6. Service providers and other disclosures

We disclose personal information only where reasonably needed to operate the Service, meet legal obligations, protect people or the Service, or complete a business reorganisation subject to appropriate protections. Providers used by the current Service include:

• Supabase for database, authentication, and related infrastructure;
• Vercel for website hosting and service delivery;
• Stripe for subscription and payment processing;
• Resend for sending Support messages by email;
• Cloudflare Turnstile for bot and abuse prevention when enabled; and
• Google for optional sign-in and delivery of web fonts.

We may also disclose information when required by law or reasonably necessary to investigate fraud, security incidents, unlawful activity, or a breach of our Terms.

7. Overseas processing and disclosure

Some of our providers operate internationally, so personal information may be processed or stored outside New Zealand or Australia. Privacy protections in another country may differ from those available where you live.

Where New Zealand Privacy Act information privacy principle 12 or Australian Privacy Principle 8 applies, we assess the relevant overseas handling and take the steps required by applicable law. You can contact Support to ask about the providers relevant to your information.

8. Cookies and security

We use cookies and similar browser storage for authentication, password-gated Club access, preferences, security, and essential Service operation. Providers such as Supabase, Google, Stripe, and Cloudflare may set or receive their own technical information when their features are used.

We use safeguards such as access controls, authentication, hashed Club passwords, and service-provider security features. No internet service can guarantee absolute security. Please contact Support promptly if you believe your account, Club password, or personal information has been compromised.

9. Retention and deletion

We retain personal information for as long as reasonably needed to provide and secure the Service, maintain accurate Club and billing records, resolve disputes, enforce agreements, and meet legal obligations. Retention therefore depends on the record and why we hold it.

The product supports account deactivation and, after 30 days, a request for full account deletion. Club ownership or membership may need to be resolved first. Deletion of an account does not necessarily delete every Club, ledger, billing, compliance, security, or backup record. We may retain or de-identify records where they remain reasonably necessary, including to preserve an authoritative ledger or meet legal and accounting obligations.

You may also make a privacy request through Support. We assess privacy requests separately from the self-service account-deletion flow and will explain any information we cannot delete.

10. Your privacy rights

New Zealand

Under the Privacy Act 2020, you may ask for access to personal information we hold about you and ask us to correct it. You may also ask us to attach a statement of correction if we do not make the correction requested, and you may complain to the Office of the Privacy Commissioner.

Australia

If the Australian Privacy Act 1988 and Australian Privacy Principles apply, you may ask to access or correct personal information we hold about you and make a privacy complaint. If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner.

Other locations

Depending on where you live, local law may give you additional rights concerning access, correction, deletion, restriction, objection, portability, consent, or complaints. We will consider requests under the laws that apply to us and your information.

11. Privacy requests, complaints, and breaches

Submit a privacy request or complaint through Support. Include enough information for us to understand the request and identify the relevant account or Club. We may need to verify your identity or authority before disclosing or changing information.

We will investigate privacy complaints and respond within the time required by applicable law. If a privacy breach occurs, we will assess it and notify the relevant regulator and affected people when required.

12. Adults-only Service

BreakStacks is intended only for people aged 18 or older and for lawful private games. If you believe a person under 18 has provided personal information to the Service, contact Support so we can investigate and take appropriate action.

13. Changes to this Policy

We may update this Policy when our practices, providers, or legal obligations change. We will publish the updated version here and change the “Last updated” date. Where required, we will provide additional notice.