Privacy Policy

Last updated: 9 October 2026

This policy explains what personal information the maru app (com.lynskey.koreapost on iPhone and Android) and the maru website (marucommunity.com) collect, what we do with it, who else handles it, how long we keep it, and what you can ask of us. maru is developed and operated by Half Full Studios Limited (“Half Full Studios”, “we”, “us”), a company registered in New Zealand (NZBN 9429053822239, company number 9445408). We handle personal information in line with the New Zealand Privacy Act 2020.

The short version: we collect what it takes to run a marketplace, job board and community: your account, what you post and send, where you are roughly, and technical information about the app and your phone. We don’t sell any of it, and we don’t use it to target you with advertising. The service runs on providers in Australia, the United States, South Korea and elsewhere, named below.

What we collect

#

Your account

#

• When you sign up: a username, your email address and a password (stored only as a one-way hash), and optionally your first and last name.
• If you sign in with Google, Apple, Kakao or Microsoft: we receive your email address, name and that provider’s profile photo from them, and an account identifier from Firebase Authentication (see Who handles your information).
• Your profile: photo, bio, country, preferred language, the places you’ve saved and how far around them you want to hear about, your notification settings, and the payment methods you usually accept.
• Account security: whether your email address is verified, whether sign-in codes are switched on, and passkeys. For a passkey we keep its public key, the name you gave it and when it was last used; the private key never leaves your device.
• Standing on maru: your reviews, your manner temperature, your Maru score and the events that earned it, and your points.

What you post and send

#

• Listings, job ads, community posts and comments, with their photos, prices, location and payment details.
• Chat messages and the photos you send in them, reactions, and whether each message has been read.
• Reports you make about content or other members, and any blocks or mutes you set.
• Searches you make while signed in, which results you open, and the keyword alerts you set up.
• Translations: posts, listings, comments and chat messages are translated automatically between Korean and English, and the translations are stored alongside the original.

Photos are re-encoded when you upload them. That removes the hidden information cameras attach, including the GPS position where the photo was taken. A profile photo copied from Google, Apple, Kakao or Microsoft when you sign in with them is stored as that provider supplied it.

Your location

#

• Places you choose. The suburbs you save, and the suburb on a listing, are stored as that suburb’s centre point, not your address.
• Your phone’s location, if you allow it. maru asks for location permission while you’re using the app (on Android it may ask for precise location). We use it to sort what’s near you first, and to suggest a suburb when you post. When it’s only used for sorting, it’s sent with the request and not stored.
• When you create a community post or job ad, the location your phone reported may be saved with it if you don’t choose a suburb. Other people never see that exact point: maru only ever shows a post’s location rounded to about a kilometre, with the suburb name.
• Maps. When you open a map, Apple Maps (iPhone) or Google Maps (Android and web) draws it, and can show your own position on it.

Information from your phone and the app

#

• App and device: the app version and update you’re running, your phone’s operating system, and a description of the device and browser when you sign in.
• Notifications: a push-notification token for your phone, its platform, and a name for the device.
• Usage analytics: we use Google Analytics for Firebase in the app and on the web app to learn which features are used. It records events such as signing up or in (and how), opening a listing, posting, liking, sending a message, contacting a seller, searching (including the words searched for), sharing, filtering, reporting or blocking, and the screens you visit, along with your account ID and a few account details (account type, app language, how you signed up, and whether you’ve published a listing). Google also collects device and app information with these events. We don’t sell it or use it to show you advertising.
• Crash reports: if the app crashes or hits an error it can’t recover from, it sends us a report: the error, the app version and update, the phone model, operating system and language, technical details such as free memory and screen size, the last few dozen steps before the crash (screens opened, web addresses requested with anything after a “?” removed, and the app’s own log messages), and your account ID if you’re signed in, or a random ID for that installation if not. Reports come straight to our own server; they are not sent to Sentry or any other crash-reporting company.
• Updates: when the app downloads one of our over-the-air updates, it reports the update and a random ID for that installation of the app (not linked to your account), so we can tell whether updates install correctly.
• Views: we count how many people view a listing or post. For signed-in members this records who viewed what, and when. For visitors who aren’t signed in it records a one-way scrambled value made from the internet address and browser, not the address itself.
• Adverts: when an advert is shown or tapped we record that, with a random ID for the installation and the country. That record carries no account and no internet address.

Signing in and security

#

• Internet (IP) address. We use it to slow down password guessing (each address gets a limited number of attempts, counted for up to an hour) and to count repeated failed sign-ins.
• Sign-in notices. When you sign in with a password we email you, and can notify you, with the time, a description of the device and browser, and the IP address, so you can spot a sign-in that wasn’t you.
• Staff alerts. Repeated failed sign-ins or wrong sign-in codes raise an alert to our team that includes the account’s username and the IP address.
• Server logs. These record requests to our servers (including which account made them) and errors, and are used to run the service and investigate problems.

Subscriptions, wallet passes and loyalty

#

• maru Premium is bought through the App Store or Google Play and managed by RevenueCat. We receive the product, store, dates and status of your subscription, never your card details.
• Wallet passes: if you add a maru membership card or a café loyalty card to Apple Wallet or Google Wallet, the pass carries your name (or username) and a code.
• Loyalty cards at participating cafés record each stamp, reward and redemption, with the time and the staff member who recorded it. The café’s staff can see this history for their own café.

Businesses and advertisers

#

If you use maru for a business or buy advertising, we collect:

• your business’s legal and trading names, business number (NZBN or similar), GST number, billing contact, address, phone and website;
• your team’s members and invitations;
• your orders, invoices and payment records.

Card payments for advertising are handled by Stripe. Organisations can also keep customer records in maru (names and contact details of their own customers); the organisation decides what goes in them and is responsible for them.

Information about people who aren’t members

#

Some listings are imported from other public marketplaces so that buyers can find them in one place. These carry the seller name shown on the original site and a link back to it. If one of them is about you and you want it removed, email us.

How we use it

#

• To run the marketplace, job board, community and chat, and show what you publish to other people.
• To translate content between Korean and English.
• To show you what’s near you, and tell you about new posts near the places you’ve saved, from people you follow, or matching your keyword alerts.
• To keep maru safe: preventing fraud, scams, spam and account takeover, enforcing our terms, and acting on reports.
• To find and fix problems, and decide what to improve, from crash reports, logs and analytics.
• To process subscriptions, advertising orders, invoices and loyalty programmes.
• To send you service messages: verification and sign-in codes, sign-in notices, and notifications you’ve chosen.
• To meet legal obligations, such as keeping tax records.

We don’t sell personal information, and we don’t share it with anyone so they can advertise to you.

Who sees what you publish

#

Listings, job ads, posts, comments, reviews and your public profile (username, photo, bio, temperature, Maru score rank) are visible to anyone, including people who aren’t signed in and search engines. A post’s location is shown as a suburb and an approximate point. Chat messages are seen only by the people in the conversation, and by our team when it’s needed to deal with a report or keep the service safe.

Who handles your information

#

We use these companies to run maru. Each handles your information only to provide its service to us.

We may also disclose information when the law requires it, to prevent a serious threat to someone’s safety, or as part of selling or reorganising the business (in which case this policy continues to apply to it).

Information sent overseas. Most of these providers are outside New Zealand, so your information is stored and processed in other countries, including Australia, the United States and South Korea. We choose providers that are subject to privacy laws or contractual commitments that protect it in a way comparable to the Privacy Act.

How long we keep it

#

If you delete your account (Settings → Delete account):

• Deleted: your profile (photo, bio, saved places, language and other settings), your linked sign-in methods, and your Firebase Authentication account.
• Anonymised: your username, email address and name are replaced, your password stops working, and the account is closed.
• Kept, under “deleted user”: what you published (listings, posts, comments, job ads), messages you sent (the other person keeps their conversation), reviews, and reports.
• Not yet removed automatically: some records linked to the closed account, including push-notification registrations, passkey records, search history, notification history and loyalty records. Email us and we’ll delete them.

To have your listings, posts or messages removed as well, delete them before closing your account, or email us.

Security

#

We use encrypted connections between the app, the website and our servers, store passwords only as one-way hashes, store photos in private storage that is only reachable through short-lived links, and limit who on our team can see personal information. No online service can be completely secure; if a breach is likely to cause serious harm, we will tell you and the Privacy Commissioner as the Privacy Act requires.

Cookies and similar storage

#

• The maru website (marucommunity.com’s information pages) uses no analytics or advertising cookies.
• The maru web app stores your sign-in in your browser, and uses Google Analytics for Firebase, which sets its own cookies.
• The admin area uses session and security cookies.

Your rights

#

Under the Privacy Act 2020 you can ask for a copy of the personal information we hold about you, and ask us to correct it. You can also ask us to delete it. Email [email protected]; we’ll reply within 20 working days. You can delete your own posts and close your account in the app at any time.

If you’re not happy with how we’ve handled your information, tell us first. You can also complain to the Office of the Privacy Commissioner.

Children

#

maru is not for children under 16. We enforce strict Child Safety Standards against child sexual abuse and exploitation. If you believe a child under 16 has an account, email us and we will close it.

Changes to this policy

#

When we change this policy we update the date at the top. If a change significantly affects how we handle your information, we’ll let you know in the app or by email before it takes effect.

Contact

#

Half Full Studios Limited, New Zealand. Email [email protected].