Baavana

Privacy Policy

Last updated: 5 May 2026 · Effective: 5 May 2026

This Privacy Policy explains how Baavana collects, uses, and shares information about you when you use the Baavana app. We've tried to write it in plain English. If anything is unclear, please email support@baavana.app.

Short version: we collect the minimum we need to run a festival rating app. We don't sell your data and we don't use it for advertising. We use Firebase to host the app and Apple/Google to deliver push notifications. You can delete your account from inside the app.

1. Who is responsible for your data

The data controller for Baavana is Nic Gibbens, sole trader trading as MakeYourOwnSpace, based in Wellington, New Zealand. References to "we", "us", and "our" in this Policy mean MakeYourOwnSpace.

Contact: support@baavana.app

2. What we collect

Information you provide

Account information: email address, display name, password (stored as a hash by Firebase Authentication).
Festival access code: validated at registration; not stored on your account record.
Ratings, comments, and photos: anything you submit through the app.

Information collected automatically

Push notification token: an opaque identifier from Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android, web). Used only to deliver in-app announcements during the festival.
Device and usage analytics: app version, device model, OS version, screen views, and a small set of custom events (rating submitted, event entered, leaderboard viewed). Collected via Firebase Analytics. Linked to your Firebase Auth user ID so we can understand attendee engagement, but never linked to advertising identifiers (IDFA collection is disabled).
Crash reports: stack traces and device metadata when the app crashes, collected via Firebase Crashlytics. Linked to your Firebase Auth user ID so we can debug specific reports. Crashlytics does not run on the web build of Baavana.
Festival attendance: the event ID(s) you attend are stored on your user record so we can target push announcements only to current attendees.
Block list: the user IDs you have blocked, so blocked users' content is hidden from your view.

What we do not collect

We do not collect precise location.
We do not access your contacts, calendar, or microphone.
We access your camera and photo library only when you choose to upload a photo, and only the photo you select.
We do not use advertising identifiers (IDFA on iOS, GAID on Android).
We do not run third-party trackers or advertising SDKs.

3. How we use your information

To run the app: authenticate you, show you ratings and photos, deliver push announcements, attribute crashes to your account so we can fix bugs you've hit.
To moderate content: respond to in-app reports and remove content that violates our Terms of Service.
To improve the festival: aggregate analytics tell us which beers were most-rated, which events drew the most engagement, and where the app slowed down or crashed. We do not use this for advertising.

4. Who we share with

We do not sell or rent your information to anyone. We share it only with the following service providers, each strictly to operate the app:

Google / Firebase (Authentication, Firestore database, Cloud Storage for photos, Cloud Messaging for push, Analytics, Crashlytics, Hosting). Data is processed under Firebase's data processing terms. Most Firebase data is stored in Google-operated data centres outside New Zealand, including the United States.
Apple (Apple Push Notification service for iOS notifications). Apple receives an opaque device token; the notification payload is sent through Apple's servers.
Law enforcement, but only if legally compelled (such as a valid New Zealand court order). We will tell you about any such request unless prohibited by law.

5. Where your data is held

Most data is stored in Google Cloud regions outside New Zealand, including the United States. By using the app you acknowledge that your data may be transferred to and processed in countries other than New Zealand, including ones that do not have privacy laws equivalent to New Zealand's. Where required by law, we rely on Google Cloud's standard contractual clauses or equivalent safeguards.

6. How long we keep it

While your account is active: we keep your account, your content, and a rolling history of analytics and crash data while you have an account in Baavana.
Analytics: Firebase Analytics retains event-level data for up to 14 months, then aggregates and discards.
Crash reports: Crashlytics retains reports for up to 90 days.
After you delete your account: see "Account deletion" below.

7. Account deletion

You can delete your account at any time inside the app: Settings → Delete account. When you delete:

Your authentication record is removed and you are signed out everywhere.
Your push notification tokens, your block list, and your festival attendance records are removed.
Your ratings, photos, and comments are anonymised: they remain visible in the leaderboard and photo feed but are attributed to "Deleted user" rather than your name. We retain the content because removing it would create gaps in the festival's leaderboard scoring and photographic record.
The image files for your photos remain in cloud storage as part of the festival's photographic record.

If you want a specific photo removed entirely (for example, an image containing personal information you no longer wish to be hosted), contact support@baavana.app with the photo and we will remove it within a reasonable time.

8. Your rights

Under the New Zealand Privacy Act 2020, you have the right to:

Access the personal information we hold about you.
Correct personal information that is inaccurate.
Complain to the New Zealand Office of the Privacy Commissioner (privacy.org.nz) if you believe we have mishandled your data.

If you are in the European Union or the United Kingdom, you may have additional rights under the GDPR or UK GDPR — including the right to data portability and the right to object to processing — and you can exercise them by emailing us. We will treat such requests under the same process we apply to New Zealand requests.

To exercise any of these rights, email support@baavana.app with enough detail for us to verify it's you (typically the email address on your Baavana account).

9. Children

Baavana is rated 17+ on the App Store and is not directed at children. We do not knowingly collect information from anyone under 17. If you believe a child has used the app, contact support@baavana.app and we will remove the account.

10. Security

We rely on Firebase's infrastructure for encryption in transit and at rest. We restrict access to your data on a need-to-know basis. No system is perfectly secure; if we ever discover a breach affecting your data, we will notify you and the New Zealand Privacy Commissioner where required by law.

11. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated in the app before they take effect.

12. Contact

Questions, complaints, or rights requests: support@baavana.app.