Who we are
GoJa is made by Mecora Ltd, an app studio in Aotearoa New Zealand. We collect and hold the personal information described here.
Our privacy officer handles questions and requests about your information. Contact them at support@mecoranz.com, with "Privacy" in the subject.
This policy covers the GoJa app on iOS and Android, and emails you send us about GoJa. This website sets no cookies. It counts page views with Umami, which runs on our own server and doesn't store your IP address. If your browser sends Do Not Track, we don't count your visit.
What we collect and why
| What | Where it comes from | Why we need it |
|---|---|---|
| Account details: your name, email address and profile photo | You, when you sign up, or Apple or Google if you sign in with them. With Sign in with Apple you can hide your email, and we get an Apple relay address instead. | To create your account, sign you in, and show your squad who you are. Without an email address you can't make an account. |
| Trip content: trips, squads, stashes and notes, Loops, itineraries, RSVPs, bookings (including confirmation numbers, addresses and prices), checklists, costs, and saved phrases | You and the other people on your trips | This is what GoJa is for: to plan the trip and share it with the people on it. |
| Your location, only while you use GoJa and only if you allow it | Your phone | To show where you are on GoJa's maps. It's used on your phone, and we don't store it. |
| Purchases: which pass or top-up you bought, for which trip, when, and the store's transaction ID | Apple or Google, through RevenueCat | To unlock what you paid for, restore it on a new phone, and keep financial records. We never see your card details. |
| Notification token | Your phone, if you allow notifications | To tell you when someone joins your trip, a plan changes, or a booking needs sorting. |
| Usage and diagnostics: which screens and features you use, device type and operating system, app version, crash logs, your GoJa user ID, your email address, and on Android the advertising ID | The GoJa app, through Google Firebase Analytics and Crashlytics | To find and fix bugs and to understand which features help. We don't use it for advertising and we don't sell it. |
| Messages to us | You, when you email us | To answer you. |
Your trip content can include information about other people, such as a friend's name on a booking. Please only add what your squad would expect you to share. No law requires you to give us any of this information.
Planning features that use AI
Some features send trip content to Google's Gemini models, through Google Cloud's Vertex AI. This happens when GoJa groups stashes into Loops, puts stops in order, writes notes about a place, or translates a phrase. What's sent is the content the feature needs, such as place names, notes and the phrase to translate.
Google doesn't use this content to train its models. Google may keep it for up to 24 hours to answer the request, and may log it to detect abuse.
Who sees your data
The people on your trips. Anything you add to a trip or squad is visible to the other people on it, along with your name and profile photo.
Companies that run parts of GoJa for us. They receive only what their job needs:
| Company | What they do | Their privacy information |
|---|---|---|
| Google Firebase | Accounts and sign-in, the database, file storage, our server code, notifications delivery, analytics and crash reports | Firebase privacy |
| Google Maps Platform | Maps, place search and details, opening hours, and travel times | Google privacy policy |
| Google Cloud Vertex AI (Gemini) | The AI planning features above | Google Cloud privacy notice |
| RevenueCat | Managing passes and top-ups bought through Apple and Google | RevenueCat privacy policy |
| Expo | Delivering push notifications | Expo privacy policy |
| Apple and Google | Sign in with Apple, Google Sign-In, and taking payment | Apple, Google |
| Slack | Alerting our team to errors. Alerts can include your GoJa user ID. | Slack privacy policy |
Google Maps Platform and Google Analytics may also use data for Google's own purposes, under Google's terms and privacy policy. Using GoJa's maps means Google's Maps terms apply too: see our terms of use.
We don't sell your personal information, and we don't share it for advertising. We'd only disclose it otherwise if the law requires us to, or to protect someone's safety.
Where your data is stored
The companies above store and process data outside New Zealand. GoJa's database and server code are in Sydney, Australia. Firebase Authentication runs in the United States. Google's AI features may process requests in any country where Google runs them. RevenueCat, Expo and Slack are based in the United States.
Most of these companies only hold your information for us, and we stay responsible for it. Google Maps Platform and Google Analytics may use some data for their own purposes. They may not protect it in the same way New Zealand's Privacy Act does. By using GoJa, you agree to this.
How long we keep it
We keep your account and trip content while your account is open. When you delete your account, we delete your information as set out on Delete your GoJa account, which also lists what we keep for longer and why. Purchase records stay for 7 years for tax and accounting. Crash reports are kept for 90 days.
Your choices and rights
- See your information. Ask us for a copy of the personal information we hold about you.
- Correct it. Ask us to fix anything that's wrong. If we don't agree to a correction, you can ask us to attach a note saying what you think is wrong.
- Delete it. Delete your account in the app or by email. See how.
- Turn off location or notifications at any time in your phone's settings. GoJa keeps working without them.
Email support@mecoranz.com to make a request. We'll reply within 20 working days. If you're not happy with how we handle your information, tell us first and we'll try to fix it. You can also complain to New Zealand's Privacy Commissioner at privacy.org.nz. If you're in Australia, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Keeping it safe
Data travels between GoJa and our servers encrypted. Database rules limit each trip's content to the people on that trip, and Firebase App Check helps block requests that don't come from the real GoJa app.
If a privacy breach is likely to cause serious harm, we'll tell the people affected and New Zealand's Privacy Commissioner as soon as we can, as the Privacy Act requires.
Children
GoJa isn't made for children. You need to be at least 16 to use it. If you think a child has given us their information, email us and we'll delete it.
Changes to this policy
If we change how GoJa uses your information, we'll update this page and the date at the top. If a change is significant, we'll also tell you in the app before it takes effect.