Plotstead syncs between your devices and with anyone you share a property with, and it has to keep working out the back of a paddock with no signal, so your records live on a server as well as on your phone. That means there is genuinely something to explain here. We don't sell your information and we don't share it with advertisers.
What we collect, and why
A valid email address and a password are all we need to make you an account. A display name is optional; if you don't give one, we work out a provisional name from your email address so other people on a property see something readable. Everything after that is up to you. Properties, areas, assets, contacts, birthdays, photos, work records and financial entries are all optional, and the app explains why it is asking at the point it asks. It works with as little or as much as you want to put in, though it gets more useful the more it knows. Only people you have invited can see or change your property, and only in the way their role allows.
If you write to us through the contact form on this site, we get your name, your email address and what you wrote. It arrives as an email and it stays in our inbox until it is no longer useful. We use it to answer you and for nothing else.
Location
Location in Plotstead is the whole point, and it is stored. When you drop a pin, walk a pipe run, or import a property boundary, those coordinates are saved with the record and synced along with everything else. Photos usually carry the place they were taken inside the image file itself. We store your photos exactly as you uploaded them, so that stays in them.
Where your information is stored
Your account details, property records, assets, contacts and financial entries sit in a PostgreSQL database run by Neon in Sydney, Australia. Photos and documents go to Cloudflare R2, which we have set to the Asia-Pacific region. The app itself runs on Microsoft Azure in Sydney. If New Zealand hosting becomes available for these, we intend to move.
How we protect it
All traffic between your device and Plotstead is encrypted in transit using TLS. Your password is stored only as a salted PBKDF2 hash, so it can be reset but never recovered, by us or by anybody else. Sign-in tokens, invitations and password reset links are kept as cryptographic hashes too, which means a stolen copy of our database still won't open your account.
Data is encrypted at rest by our database and storage providers. Access to your records is checked on our servers on every single request, against your role on that property (owner, editor or viewer), rather than being left to the app on your device to enforce. Links to your photos and documents are issued one at a time and stop working after thirty minutes.
No security is absolute and we won't pretend otherwise. Encryption at rest protects against somebody physically stealing a hard drive. The checks above are the ones doing the work day to day.
Who else handles your information
- Neon, database hosting, Sydney
- Microsoft Azure, application hosting, Sydney
- Microsoft Azure Maps, recent satellite imagery, Australia
- Cloudflare, photo and document storage, Asia-Pacific
- Stripe, payments, United States
- Google reCAPTCHA, spam protection on the contact form, United States
- CarJam, vehicle plate lookups, New Zealand
- LINZ, property boundaries and aerial imagery, New Zealand
- Hoopla Hosting, email delivery, New Zealand
A plate lookup sends the plate you typed to CarJam. An address or boundary search sends what you typed to LINZ. The contact form on this site checks whether you are a person using Google reCAPTCHA, which receives your IP address and some information about your browser in order to answer that question. Nothing else about you travels with any of them. Where your information is held outside New Zealand, we use providers contractually bound to privacy protections comparable to those in the Privacy Act 2020.
How long we keep it
When you delete something it is marked as deleted straight away and stops appearing in the app. The marker itself has to stay a while, because it is how your other devices, and other people's devices, find out the thing was deleted at all. Somebody whose phone has been out of signal for a month still needs to be told. Marked records are permanently removed six months later.
Closing your account
What happens depends on who else is on each property, and the app tells you which case applies to each of yours before you confirm anything. A property only you can see is destroyed outright, with its assets, records and financial entries. A property you share is handed to the longest-standing other member, because deleting it would take their records with it. A property belonging to somebody else is simply left, and nothing of theirs is touched. Your account, your sign-in and your own details go in every case.
If you are paying for Plotstead Plus, closing your account cancels the subscription at the same time, and nothing further is charged. Stripe keeps its own record of payments already made, because it has to for tax and accounting purposes.
Account identifiers
Every account and every record has a unique code in our database. We use those to link your records together and to record who owns what. They are not advertising identifiers, they aren't shared with anyone, and they aren't used to track you anywhere else.
If something goes wrong
If we ever have a privacy breach likely to cause serious harm, we will tell the people affected and the Office of the Privacy Commissioner, as the Privacy Act 2020 requires.
Your rights
You can ask for a copy of your information, or ask us to correct it. We'll come back to you within 20 working days, which is what the Privacy Act allows. For Plotstead you don't have to wait or ask at all: export is built into the app on every plan, including the free one, so your records are never held hostage to a subscription. If you think we've mishandled your information, write to us at support@sumnerd.co.nz.
If you're not happy with how we deal with it, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
A backup you have downloaded is yours, and beyond our reach
Backing up a property produces a file on your own computer. Once it leaves us we cannot see it, change it or delete it, and nothing in this policy applies to it any more. That is the point of it, and it is also worth being plain about.
It matters most for other people's details. A backup holds the contacts and the household members recorded on that property, so it holds their names, phone numbers and anything written in their notes. If one of them later asks us to delete their information we will, from our systems. We cannot reach a copy sitting on your machine, and any backup taken before they asked still contains it. Treat the file the way you would treat the paper version: keep it somewhere sensible, and delete old ones you no longer need.
Changes to this policy
If anything material changes, say an app starts collecting something it didn't before, or we add analytics, this page gets updated and the "last updated" date at the top changes with it.
Questions
hello@sumnerd.co.nz, or the contact page.
Plotstead is made in New Zealand by James Sumner, trading as Sumner Software Development and as SumnerD, NZBN 9429052362651. The policy covering our other apps is at sumnerd.co.nz/privacy.