Privacy notice

Last updated 14 November 2026.

Epic Trails helps people find walking and riding trails in New Zealand and plan trips with friends. This notice explains what personal information we collect, why we collect it, who can see it, how long we keep it, and how to ask us about it. We follow the Privacy Act 2020.

Who we are

Epic Trails is operated by Scripted Ventures Limited, Ground Floor, Block C, 401 Grey Street, Hamilton 3216, New Zealand.

For any privacy question or request, contact our privacy officer at hello@epictrails.nz or on +64 7 834 0500.

What we collect

When you browse

The pages you visit on the public parts of the site. Our analytics service, Syncaida, records them with a random visitor ID kept in a cookie. We do not run analytics on account, sign-in, password or trip pages.
Favourite trails, trip drafts, recently opened trips and your shop bag. These stay in your browser unless you sign in and choose to save them to your account.

When you create an account

Your name, email address and password. We store the password only in a scrambled form that cannot be read back.
The trips and favourite trails you save to your account.
When you sign in, we link the analytics visitor ID in your browser to your account email address, so your later visits to public pages are linked to you.

When you plan a trip or reply to one

The trip details the organiser enters: title, dates, trails, meeting place, notes, places, cost and reply-by date.
Replies: the names people enter, whether they are going, the dates they tick, and whether they agree to a cost. We do not check names; each person enters their own.
A cookie that recognises your browser, so you can change your reply later.

When an organiser invites you by email

Your email address, entered by the organiser, and your reply.
Your invitation email contains a private link. Anyone with that link can reply as you, so please do not forward it.
If you ask us to stop trip emails, a scrambled form of your address, so we never email it about a trip again, even after we delete the address itself.

When you join the shop launch list

Your email address, so we can tell you once when the shop opens.

Payments

The shop does not take payments yet. When it does, Stripe will process payment details, and we will update this notice before that happens.

How we use it

To run your account and keep you signed in.
To show trips and replies to the people they are shared with.
To send the emails you or an organiser ask for: account verification, password reset, trip invitations and reminders, updates about your place, the cost or the dates, and the one shop launch email.
To protect the site from abuse, for example by limiting how many requests and emails can be sent.
To understand how the public site is used, so we can improve it.

We do not sell personal information, and we do not use it for advertising.

Who can see it

People on a trip. Anyone with a trip's group link can see the plan. On a trip without email invitations, they can also see the replies and the names in them. On a trip with email invitations, only the organiser and invited people see names; anyone else with the group link sees the plan and the number of replies.
The organiser sees the email addresses they invited and each person's reply. Invited people never see each other's email addresses.
Invited people see the organiser's name, and trip emails show the organiser's account email address so you can reply to them directly.
Service providers that run parts of Epic Trails for us. Amazon Web Services hosts the site and the database in its Auckland region. MailerSend delivers our emails. Syncaida provides our analytics. Some of these providers may process information outside New Zealand, and they may use it only to provide their service to us.

We do not share personal information with anyone else unless the law requires it.

Emails and how to stop them

We send account emails only when you ask for them. We send trip emails when an organiser invites you or reminds you (at most twice), and when your place, the cost or the dates change. Every trip email has a link to stop trip emails, and it works for every organiser on Epic Trails. You can also reply to the organiser, or email us.

Cookies and browser storage

Sign-in cookies, with names containing epic-auth, keep you signed in for up to 30 days.
The trip cookie, epic_trails_session, recognises your browser for trip replies and invitation links for up to 180 days.
The analytics cookie, _sa_id, holds the random visitor ID that Syncaida uses on public pages.
Browser storage keeps your favourites, trip drafts, recently opened trips, shop bag, and which notices you have already seen. It stays on your device, and clearing your browser data removes it.

We do not use advertising cookies.

How long we keep it

Accounts, saved trips and favourites: until you ask us to delete them.
Trips and their replies: until the organiser deletes the trip.
Email addresses of invited people: 30 days after the trip ends or its last activity, whichever is later, or 180 days after the last activity on a trip with no dates. The reply stays with the trip.
The stop list: for as long as we send trip emails, so we keep honouring your request.
The shop launch list: until we have sent the launch email.
Password reset and email verification links: they expire after one hour.

Our error logs record what failed, not who: they contain no email addresses, names or trip details.

Your rights

You can ask us for a copy of the personal information we hold about you, and ask us to correct it. You can also ask us to delete your account, your replies, or your email address from a trip. Email hello@epictrails.nz and we will respond within 20 working days.

If you are not happy with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Changes to this notice

When we change what we collect or how we use it, we will update this notice and the date at the top.