DrinkSpy

Privacy policy

Last updated 30 October 2026.

DrinkSpy is an app for people aged 18 and over. It compares liquor prices at New Zealand stores and shows bars, pubs and clubs near you, with happy hours, drink deals and events. This policy explains what personal information we collect, why, how long we keep it, and what you can do about it. We follow the New Zealand Privacy Act 2020.

Who we are

DrinkSpy is operated by Treadstone Systems Limited, a New Zealand company (company number 9469560, NZBN 9429054062214). "We" and "us" mean that company. Our privacy officer can be reached at support@drinkspynz.co.nz.

The short version

Using the app

Your searches and filters are sent to our server to get results. We don't store them, and our logs leave them out. Your 18+ confirmation is kept in your device's secure storage (iOS Keychain or Android Keystore). Favourites are kept on your device, not on our server. Price reports you make while offline wait on your device until they can be sent.

Using Going out without an account

If you're not signed in, the app makes a random ID when it's installed (in a web browser, one per browser) and sends it with busy reports, deals and "still on" answers. It isn't linked to your name, your phone or an account. With each report, deal or answer, we keep a scrambled copy of that ID and a scrambled copy of your network address (never the address itself), so each person counts once and one person can't get around the limits by resetting the app. Deleting the app, or clearing the browser's data, makes a new ID.

Accounts

If you create an account, we store your name, email address, a salted scrypt hash of your password (never the password itself), and when you created the account and last signed in. Each signed-in device holds a random sign-in token, and we keep only a SHA-256 digest of it. If you sign in with Apple or Google instead, they send us your name, your email address (with Apple, this can be a private relay address that forwards to you) and an ID for your account, and we don't store a password. For Apple, we also keep an encrypted token so that we can cancel the Sign in with Apple link when you delete your account. We use your email address to identify your account and to contact you about it; we don't send marketing. A sign-in ends after 90 days without use or when you sign out. If you ask to reset your password, we email you a 6-digit code. We keep only a scrambled copy of it, and delete it once it's used or after 15 minutes. Setting a new password signs you out on your other devices.

Price reports

A price you report (the drink, store, price and an optional note) is reviewed before it can appear for other people. Reports are not linked to your account. Please don't put personal information in the note.

Your location

When you use Near me, Going out or directions, the app asks for permission to use your location while the app is open. It never uses your location in the background. When the app sends your position to our server, it is first rounded to about 100 metres. We use it only to answer that request, for example to work out distances or to check you're at a venue before a busy report. It is not stored, and our logs leave it out. You can type an address instead of sharing your location. As you type, our server asks Google Maps Platform to suggest New Zealand places and addresses, and when you pick one, where it is. When you ask for a route to a store, our server asks Google for it, sending your starting point rounded to about 100 metres and the store's position. Google gets these from our server, never from your device, and nothing else about you; we don't store what you type, and our logs leave it out. Naming places, and finding an address you search for without picking a suggestion, can also be done by your phone's own map service (Apple on iPhone, Google on Android).

Happy hours and drink deals

Deals come from venues' own websites and from people using the app. When you add a deal, we keep the venue, the days, times and description you entered, when you sent it, and your account (or, if you're not signed in, the scrambled copies above for a day), so we can check it and limit how many one person adds. Once checked, a deal is shown to everyone without your name. When you say a deal is still on or has ended, we keep that answer, when you gave it, and your account or the scrambled copies, so each person counts once. If you delete your account, your answers are deleted and the deals you added stay without any link to you.

Updates from venues' owners and managers

If you own or manage a venue, you can tell us what's changed on its page: its website, opening hours, deals and events, and a note. With the update, we keep the venue, what you sent, when you sent it, your name, whether you're the owner or a manager, and the email address or phone number you give us. We use your contact details only to check the update really comes from the venue and to contact you about it. Who sent it is kept as for deals: your account, or if you're not signed in, the scrambled copies above for a day. Nothing changes on the page until we've checked it, and the changes then show to everyone without your name. We remove your name, email address and phone number 30 days after we've approved or declined the update; the update itself stays, so we know where the venue's details came from.

Venue photos you add

When you add a photo of a venue, we keep it on our server with the venue, when you sent it and your account, so we can check it and limit how many one person adds. Before saving, we make a new copy of the photo without its hidden details, such as where and when it was taken and the camera. Once checked, it's shown to everyone as "Photo: a DrinkSpy user", without your name. If you delete your account, your photos are deleted too.

Going out busy reports

Bars, pubs, clubs and restaurants come from OpenStreetMap (© OpenStreetMap contributors). To say how busy a venue is, you must be at the venue. A report keeps the venue, the level you chose, whether there's a queue, the time and your account (or, if you're not signed in, the scrambled copies above), so one person can't report the same venue more than once every 30 minutes. Reports are deleted after 24 hours, or straight away if you delete your account. Other people only see the combined level and how many recent reports it comes from, never who reported.

Server logs

Our server records each request's path, result and timing, without your network address or search terms. Logs are deleted after 30 days.

Who else sees information

These service providers hold information for us. They store or carry it on our behalf and don't use it for their own purposes:

Our server also asks Google Maps Platform to suggest addresses as you type and to work out routes to stores. Google receives what you type, or your starting point rounded to about 100 metres and the store's position, from our server, with nothing else about you. Google's use of it is covered by the Google Privacy Policy.

Your device also contacts these services directly, under their own privacy policies:

We don't sell, rent or share personal information with anyone else, unless the law requires or allows it, for example to prevent a serious threat to someone's safety.

How long we keep information

Keeping it safe

The app talks to our server only over HTTPS. Passwords and sign-in tokens are stored only in hashed form. Access to the server is limited to us. If a privacy breach is likely to cause anyone serious harm, we will tell the Privacy Commissioner and the people affected as soon as we can.

Your rights

You can ask to see the personal information we hold about you and ask us to correct it. You can delete your account in the app (Settings → Account → Delete account) or ask us by email. We'll respond within 20 working days, usually much sooner. If you're not happy with how we've handled your information, please tell us first. You can also complain to the Office of the Privacy Commissioner.

Age

DrinkSpy is only for people aged 18 and over. We don't knowingly collect information from anyone younger. If we learn that an account belongs to someone under 18, we'll delete it.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects how we use information you've already given us, we'll tell you in the app before it takes effect.

Contact

Questions or requests about your information: email support@drinkspynz.co.nz.