Privacy Policy

Account information. When you create an account we collect your name, email address, and profile picture via our authentication provider (Clerk). You may sign up using an email and password or a supported OAuth provider.

Canvas and workspace data. We store the canvases, circles, and labels you create so that your work persists between sessions and can be shared with collaborators.

Usage data. We collect standard server logs including IP addresses, browser type, pages visited, and timestamps. This helps us diagnose issues and understand how people use the product.

Billing information. Payments are handled by Stripe. We do not store your full card details. Stripe shares limited billing metadata (plan type, subscription status) with us to manage your account.

• To provide, operate, and improve the Treasure Map service
• To authenticate you and manage your account and subscription
• To enable real-time collaboration between members of your organisation
• To send transactional emails (account confirmation, billing receipts)
• To respond to support requests and feedback
• To comply with legal obligations

We do not sell your personal information to third parties, and we do not use your canvas content to train machine-learning models.

We share data only with the following categories of third-party service providers:

• Clerk — authentication and identity management
• Supabase — database hosting and real-time infrastructure (hosted on AWS)
• Stripe — payment processing and subscription management
• Vercel — application hosting and edge delivery

Each provider is bound by their own privacy policy and, where applicable, a Data Processing Agreement. We do not share your data with advertisers.

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymise your personal information within 30 days, except where we are required to retain it for legal or billing purposes (e.g. tax records).

Canvas data associated with an organisation is deleted when all members have left or when the owning account is deleted.

We use cookies and browser local storage to maintain your session and remember preferences such as your signed-in state. We do not use tracking or advertising cookies. No third-party analytics scripts are loaded on the canvas application.

We take reasonable technical and organisational measures to protect your data, including TLS encryption in transit, encrypted storage at rest, and row-level security policies that ensure users can only access data belonging to their own organisation.

No system is completely secure. If you believe you have discovered a security vulnerability, please contact us at the address below.

Depending on your jurisdiction you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your data (“right to be forgotten”)
• Object to or restrict certain types of processing
• Data portability (receive your data in a machine-readable format)

To exercise any of these rights, email us at privacy@treasuremapp.ing. We will respond within 30 days.

Treasure Map is operated from New Zealand. Our infrastructure providers may process data in other countries (including the United States). Where data is transferred outside New Zealand or the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or the provider's certification under an approved adequacy framework.

Treasure Map is not directed at children under 16. We do not knowingly collect personal information from anyone under 16. If we become aware that a child has provided us with personal information, we will delete it promptly.

We may update this policy from time to time. When we make material changes we will update the date at the top of this page and, where appropriate, notify you by email. Continued use of the service after changes are posted constitutes acceptance of the revised policy.

Questions about this policy? Email privacy@treasuremapp.ing.