Privacy

The short version

Groundie Ltd runs this app. Two different kinds of information are held in it and they are treated differently. This policy explains both.

What we hold about you

We hold your email address, your name if you give one, and what the app needs in order to work: which business you belong to and what you are permitted to see.

If you sign in with a code from your manager, we hold no email address that can reach you. The account is given an address at our own domain with no mailbox behind it. This is deliberate: because no mail can be received there, a sign-in code cannot be obtained by asking for a password reset.

This information is used to operate the app and for nothing else. We do not sell it, and we do not advertise to you.

Nothing in the app records what you tap or reports to us on how you use it. It contains no advertising and nothing about you is sold to anybody. We have no need to know how you use the app, so we do not collect it. One thing does leave your device on every open, and it is not us: a Google security check that we cannot run without. It is described under Information we pass to others below, and it is worth reading.

What your business writes down

Your clients, quotes, invoices, job sheets, photos, hours and safety records — including the names and signatures of people who were on site and have no account here, such as contractors or traffic management.

Some of this is more sensitive than the rest, and it is worth setting out which. An incident report records what happened to a person, what they hurt, how badly, and their phone number. A personal prestart records a person's answers about whether they are fit to work that day, together with anything they wrote in the box, which may include a medication or advice a doctor has given them. Training records set out what a person is and is not signed off for.

These are not open to the whole crew. An incident report can be read by the people you have put in charge of the hazard register or of managing people, and by whoever filed it. A personal prestart can be read by the people in charge of the hazard register, and by the person it concerns. Training records can be read by the people who can sign visitors on, manage people or see everyone's timesheets, and by the person named. Everyone else sees only their own.

This information belongs to your business, not to us. We store it so that the app works, and we do not use it for any purpose of our own. Your business decides what goes into it, who may see it, and how long it is kept.

Photographs can carry the place they were taken. A photograph taken with the camera from inside the app records the position of the device at that moment. Where a photograph already carries a position of its own, written by the camera that took it, that is read from the file and kept instead. What is recorded is where the person taking the photograph was standing rather than where the work is, so for a photograph taken at a job it is a point at or near that property. It is held with your business's records in the same way as the photograph itself and is not passed to anybody outside them. Where the device is not permitted to give its location, or the photograph carries none, nothing is recorded.

A signature is kept as a record in its own right. When somebody signs a toolbox talk, their name, who they came with, what they were doing and the mark they drew are kept together as one record, along with which account was holding the device at the time. It is held with the talk it was given at, comes out in the same export, goes into the same archive if that talk is deleted, and is removed with it when the deletion becomes permanent. It is kept this way so that a signature cannot be altered or removed by anybody but the person who gave it, the person who recorded it, and whoever your business has put in charge of its hazard register.

If you record somebody's details and you obtained them from someone else — a bystander's name after an incident, a tenant's number from a property manager — you are required to tell that person that you hold their details, what for, and that they may ask to see them. This was introduced in May 2026 and is known as principle 3A. It applies to your business rather than to us. We set it out here because the app is where those details are recorded.

Where it is kept

Your records are kept on Google's business hosting service in Sydney, Australia, which encrypts everything it stores. Google holds the information on our behalf and does not use it for any purpose of its own. Under the Privacy Act this means it is treated as still being held by us, and your business's records as still being held by your business. A copy is also kept on your own device, so that the app continues to work without a signal.

That copy includes the names and email addresses of the people in your business, so that the app can say whose a job, an hour or a safety record is when there is no signal. It is removed by the Clear this device button described below, along with everything else.

Work you are part way through writing, such as a quote you have not saved yet, is also kept on the device you are typing it on, so that the app can offer it back to you if the page reloads before you have saved it. It stays on that device, it is not sent to your account and it is not included in a backup file. It is removed when you save the record, when you choose to start fresh, after a fortnight, or by the Clear this device button described below.

When you ask the app for a PDF of a quote or an invoice to send, the document is drawn into a PDF by a program of ours on that same hosting service, in the same place. It holds the document for the seconds that takes and keeps no copy. The email itself is sent by your own email app — or, if you tell the app to on a computer, by your own Gmail in a browser tab — and we do not see the message or who it went to.

Who can see it

People within your own business, according to the permissions you have given them. Prices are kept off job sheets and out of a worker's copy entirely.

The owner of your business, and anybody they give permission to, can see a list of who changed what and when, worked out from the records themselves. Each person can see their own the same way, from Settings.

Nobody at Groundie Ltd reads your records in the ordinary course of business. We are able to reach them, and will do so only if you ask us for help with a problem, or if we are required to by law. We do not look through your client records.

If you publish a calendar link, anybody holding that link can read whatever it contains. The app explains this where the setting is turned on, and lets you choose how much detail is included.

When somebody leaves your business

When you take somebody off the team, they stop being able to reach your records immediately. Their permission is checked on every request rather than when they next sign in, so it takes effect the moment the change is saved.

The copy already on their own phone or computer stays there. The app keeps a copy on each device so that it works without a signal, and we have no way to reach a device once the account cannot sign in. The next time they open the app somewhere it can reach us, it tells them they are no longer on the team and offers to remove that copy, and we cannot make them press it. Where it cannot reach us it does not guess: it opens what is already on the device and says that it could not check the account. Being out of signal is not the same as being taken off the team, and treating it as though it were would empty a phone of work that had not reached you yet. If the device belongs to your business, clear it before it is handed back or passed on.

A published calendar link keeps working until it is published at a new address. A calendar application cannot sign in, so the link is a plain web address and holding it is the whole of the access — which means removing somebody from your team does not take the link off them. When you take somebody off who could see the diary, the app offers to publish it at a new address; doing so retires the old link straight away, and anybody you gave it to will need the new one.

Getting it back, and having it removed

You can export your records from Settings at any time, without asking us. Photos are not included in that file, because a year of site photographs is not something a spreadsheet can hold; they are downloaded separately.

You may ask to see what we hold about you and to have it corrected. That is your right under the Privacy Act 2020.

How long it is kept

When you delete something in the app it is hidden rather than destroyed, and stays in the archive where it can be restored. This is deliberate: a safety record deleted by mistake on a Friday should still be recoverable on Monday. An owner can start a seven-day countdown on removing something permanently, and once that has passed it is removed the next time somebody with the appropriate permission opens the app.

Everything else is kept while your account is open, because it is your working record and only you know when you have finished with it.

You may have all of it deleted at any time. Write to privacy@groundie.co.nz and we will remove your business's records and your account as soon as we can, and within thirty days. You do not need to give a reason.

Please take an export before you do. Some of what is held here you are required to keep after you stop using Groundie: a notifiable event for five years, pay records for seven years, and personnel files for six. That obligation rests with your business and is not ended by the records being deleted, so the export is what allows you to meet it. Once the information has been removed from here we cannot recover it.

The copy on your own phone or computer stays there, which is what lets the app keep working with no signal. It goes when you remove the app, and Settings has a Clear this device button that removes it without removing your account. Signing out on a shared or returned handset does not clear it, so use that button.

That button removes everything the app has put on the device: every record, every photograph, and everything it remembers about who has been signed in, for every account that has used it. It cannot reach a file you have already taken out of the app — a backup, a set of photographs, or a PDF you have saved or sent — because those are in the device's own downloads and are no longer the app's to remove. Delete those yourself if the device is going to somebody else.

Information we pass to others

We do not currently take payments. When we do, your card details will be passed directly to the payment company, and we will not hold your card number.

Xero, if you choose to connect it. Two things can cross, and both only when you press the button. Your client list can be brought across: names, email addresses, phone numbers and addresses are copied from your Xero organisation into your records here, and no record is created until you have seen it. An invoice you choose to send is copied into your Xero organisation as a draft, along with the client it is for, where it waits to be approved by a person. And when a payment is reconciled against that invoice in Xero, the payment comes back — its date, amount and reference — and the invoice marks itself paid here. While the connection is in place we hold a key to your Xero account. It is not kept on any phone or computer and cannot be read by anybody using the app, and disconnecting removes it. The copy held in Xero is governed by your own agreement with Xero. Xero Limited is a New Zealand company and is subject to the same Privacy Act as we are.

Google Maps, when you use the Directions button. The address is passed to Google Maps in the same way as if you had typed it there yourself. Nothing is sent unless you choose to use that button.

Google Maps, if the map is switched on for your business. The map is drawn by Google's mapping service, and there are two places in the app that draw one. The map on the Schedule tab draws the work you are looking at. Putting photographs onto pins draws a map of the single job it was opened from, on that job's own screen, and where that job has no pins yet that map is what it opens on, so this can happen without the map on the Schedule tab being opened at all. Either of them fetches Google's mapping software and sends Google the locations of the jobs being shown, since a map cannot be drawn around places it is not told about, together with the technical signals any use of a Google service involves, including your IP address. Where a job has been pinned place by place, each of those points is sent as well, so what leaves can be more precise than a property: it is every spot on it that somebody has marked. Where none of the jobs on screen can be drawn, the map opens over the address you have saved as your base, and that point is sent instead. Nothing is sent until one of those two maps is opened. Once it is open, the mapping software stays loaded until you leave the app and keeps drawing as you move and zoom, which tells Google which part of the map you are looking at. The map stays off unless it has been switched on for your business, and only the owner can switch it on. Google's mapping service is a global one: your records are held in Sydney, but what is sent in order to draw a map may be received and processed by Google outside New Zealand and Australia. Google's use of this information is governed by Google's own privacy policy.

Google, to work out where an address is. Where a job has no pin dropped on it, the app can ask Google's mapping service what point a typed address is at, so that the job can be drawn on the map at all. Doing so sends Google that address as it is written on your records, along with the same technical signals as above, including your IP address. The address is all that is sent about the job: no client name, no telephone number and nothing about the work itself. The country your business is set to goes with it, so that an address is read as being in the country you work in. Each address is asked about once and the answer is kept on your own records, so it is not sent again unless the address is changed. It happens only when the owner asks for it on the Where jobs are page in Settings, and only while the map is switched on for your business. What comes back is treated as approximate and is never used to navigate: it is where an address is, which is not the same as where the work is, and the app marks it as such wherever it appears.

Google, to check the app is the real app. Every time the app opens it runs a Google service called reCAPTCHA. Its job is to satisfy us that the request is coming from this app rather than from a script pretending to be it, which is what stops somebody helping themselves to other firms' records with a copy of our own code. To do that, Google receives technical signals from your device — the browser and version, the address of the page, your IP address, and how the page is being interacted with — and it sets its own cookie on your device. It does not receive your records, your name, or anything your business has written down, and it happens whether or not you are signed in. Google's use of that information is governed by Google's own privacy policy. If you would rather it did not run, the app cannot currently be used without it.

Nobody else. We do not pass information to data brokers or advertising networks, and we do not sell it to anybody.

If something goes wrong

If information is lost or reaches somebody it should not have, and this could cause serious harm, we will tell you and the Office of the Privacy Commissioner within seventy-two hours of establishing that it is that serious, which is the time the Commissioner asks for. Where the information is your business's own records, you may need to tell the people affected; we will provide what you need in order to do so.

Groundie is still being built

The app is not finished and is provided as it is. We recommend keeping your own backups. The app shows how long it has been since your last one.

Contacting us

Write to privacy@groundie.co.nz. That address reaches our privacy officer, a role every business in New Zealand is required to have and which, at our size, is the person who runs it. If a matter cannot be resolved with us, it may be raised with the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this policy

Each version carries the date on which it was written, and the app records which version you agreed to. Where a newer version has been published, Settings tells you so next to the date you agreed. If a change meant something materially different about what we do with your information, we would write to you rather than leave it to be noticed.

Last changed 2026-09-04.