Last updated 6 November 2026
This policy explains what Kupu Kupu (“we”, “us”) collects when you use the Kupu Kupu app, why, and what you can do about it. We follow the New Zealand Privacy Act 2020.
What we collect
- Account details: your email address, or the sign-in details Apple or Google share with us when you sign in with them, and your date of birth (to confirm you're 18 or over).
- Your profile: your name, photo or avatar, paddler, reo level, rohe, region, iwi, interests and bio, if you add them.
- Messages: the text and voice messages you send, and your moves in games you play with other people.
- Learning progress: games played, scores, streaks, the words and grammar you've practised, and which grammar points you've ticked off.
- Safety records: people you've blocked, and reports you make or that are made about you.
- Device details: a push-notification token so we can tell you about new messages and turns.
We don't collect your location, contacts or advertising identifiers, we don't track you across other apps or websites, and we don't show ads.
How we use it
- To run the app: sign you in, pair you with people to play with, deliver messages and keep your progress.
- To keep people safe: when someone is reported, we read the reported message and the messages around it so we can act on it.
- To send you notifications you've allowed.
We never sell your information.
Who else handles it
We use these services to run the app. They handle your information only on our behalf:
- Supabase: our database, sign-in and file storage (servers in Seoul, South Korea).
- Google Firebase Cloud Messaging and Apple Push Notification service: delivering notifications.
- Apple and Google: if you choose to sign in with them.
- Resend: emailing us when someone sends a report.
Other people in the app see your profile, and the messages and game moves you send them.
How long we keep it
We keep your information while you have an account. When you delete your account, your profile, messages, voice recordings and progress are deleted straight away. Reports about other people that you made are kept without your details. Backups are cleared within 30 days.
Your choices
- Change your profile at any time in Ahau → Edit profile.
- Delete your account in the app (Ahau → Delete account), or ask us to.
- Ask for a copy of your information, or ask us to correct it, by emailing apera.woodfine@gmail.com.
- If you're unhappy with how we've handled your information, you can complain to the Office of the Privacy Commissioner.
Age
Kupu Kupu is for people aged 18 and over. If we learn that someone under 18 has an account, we delete it.
Changes
If we change this policy in a way that matters, we'll tell you in the app.