Privacy Policy

Introduction

Driving Forever Limited ("Driving Forever", "we", "us", "our") runs the website at drivingforever.com, the Driving Forever mobile app, and the email communications sent under the Driving Forever brand. This policy explains what personal information we collect about you, why we collect it, who we share it with, and how you can control it.

We operate from New Zealand and handle personal information in line with the New Zealand Privacy Act 2020. If you live somewhere else, we still apply the protections below, and nothing in this policy is intended to limit rights you have under your own local law.

Last updated: 14 October 2026.

Who we are

Driving Forever Limited is a company registered in New Zealand.

• Contact email: drive@drivingforever.com
• Privacy queries & data requests: privacy@drivingforever.com — your request will reach the person responsible for privacy at Driving Forever.

What this policy covers

This policy applies to everything we do under the Driving Forever brand, including:

• The website at drivingforever.com, its blog, and any pages we add to it.
• The Driving Forever mobile app for iOS and Android.
• Shopify customer accounts created through drivingforever.com.
• Email newsletters and transactional emails.
• Orders for merchandise or printed cards fulfilled through the site.

It does not cover websites we link out to. Those have their own policies.

What we collect

Information you give us directly

• Account information: email, password (stored hashed, we never see the plain text), display name / nickname, and any profile details you add such as a bio, avatar, home region, clubs, or a contact phone number and contact email, each with its own switch for whether it shows publicly.
• Member card details: if you make a printable member card, the title, full name, business name, phone number and email you choose to put on it. These are kept private, used only to make your card, and appear nowhere else unless you switch them on.
• Vehicle and garage data: anything you enter about your vehicles — make, model, year, odometer readings, service history, fuel entries, expenses, photos, notes, moods, reflections, and journal entries.
• Trading card and listing content: anything you choose to publish, including vehicle photos, narrative copy, pricing if you create a for-sale listing, and the location you attach to the listing.
• Community & Collector activity: records of Fist Bumps, Spotted vehicles, event check-ins, and partner-venue visits are stored in our cloud database and shared only with the other member(s) involved in each exchange. Cards you collect, and where you collected them, are covered under "Collecting cards" below.
• Commerce information: when you buy something through drivingforever.com, we receive the shipping address, billing address, items ordered, and order total. Payment card details are collected by our payment processors, not by us (see "Third-party services" below).
• Support and feedback: anything you email us or submit through a contact form.
• Subscriptions: if you subscribe to DF Pro, we receive confirmation of your subscription status and plan from the relevant app store or payment processor. We do not receive your full card details.

Information collected automatically

• Device and connection data: IP address, device type, operating system, app version, browser type, referring URL, and general location inferred from IP (country / region level).
• Usage data: the pages and screens you view, features you use, search terms you type on our site, interactions with emails we send, and timestamps of those events.
• Diagnostics: crash reports and performance logs from the app and site, used to fix bugs and improve reliability.
• Usage analytics: we record basic in-app events (such as publishing a card) tied to your account ID to understand how the app is used. If you choose "Other" on a vehicle details list and type your own answer, we receive that answer when you save the vehicle, so we can add common ones to the list. We don't use third-party advertising or tracking SDKs.
• Cookies and similar technologies: see "Cookies" below.

Location: We don't collect or store your precise location. Venue check-in uses your device's location on-device only, to confirm you're at a partner venue — your coordinates are never sent to us or saved. (The coarse country/region location inferred from your IP address, noted above, is separate.) Scans, Fist Bumps and signing sessions also use your device's location, to keep the name of the town or suburb you were in, never your coordinates (see "Collecting cards" below).

Information from third parties

• Payment processors confirm whether a payment succeeded, the last four digits of the card, and the card type.
• Authentication providers (Apple, Google) share your name and email with us if you sign in with them, subject to the controls you set with that provider.
• App stores (Apple App Store, Google Play) tell us when your subscription starts, renews, lapses, or is refunded, but do not share your card details.

Vehicle history

When you enter a VIN, chassis number or number plate on a vehicle, the app offers a switch: "Tell me if another member has had this vehicle". It is on unless you turn it off, and vehicles you added before the switch existed are asked about once, on the Home screen. While it is on, we keep a scrambled version of those numbers on our server so we can tell when another member enters the same ones. The scrambled version cannot be turned back into the number, the matching record never holds the number itself, and the other member is never shown it. The numbers themselves stay in your own garage entry, like the rest of your vehicle data. A matching VIN or chassis number counts as the same vehicle. A matching number plate, with the same make and model, is only a possible match for the two of you to confirm.

• Before you both confirm: neither of you is told anything about the other, only that another member has entered a vehicle matching your own. The member who entered it first is asked first, so someone typing in a plate learns nothing unless you say yes. If you ignore a match, it drops away after 30 days and the other member is not told.
• After you both confirm: each of you sees the other's name or DF number (your member number), as each of you chose to appear, and the years they had the vehicle. That line goes on the back of both your published cards and on their web pages, where anyone with the link can see it. Nothing else is shared: never the VIN, the plate, prices, odometer readings or logs.
• Invite links: a link you send to a past or later owner carries only a code. Whoever opens it in the app sees the vehicle's make, model and year, your name or DF number and your years with it, before deciding whether to accept.
• Owners you record yourself: a previous owner you record for someone who cannot join appears on your card only, as years and the words "ON RECORD" unless you add a name and choose to show it. The relation you note, such as "my brother", is never public.
• Your controls: you can withdraw from a link at any time and it comes off both cards, blocking a member removes any history line between you, and you can turn the switch off for any vehicle whenever you like. Deleting a vehicle turns it off but keeps history you have already confirmed, so withdraw first if you want that line gone too.

What we keep. We keep a record of which members were matched, invited or linked on a vehicle, including after a match is declined or a link is withdrawn, so the same two people are not asked again. It holds member IDs, dates and the answers given, not names or vehicle numbers. When you delete your account, your side of it is erased and any line naming you comes off the other member's card.

Collecting cards

Members can collect each other's published vehicle cards, and each copy has a tier. A card collected in the app is a Collected copy. Scanning the owner's Spotted code makes it a Spotted copy, and the owner signing it, with a Fist Bump or in a signing session, makes it a Signed copy. Spotted and Signed copies are numbered in the order they are made.

• Where it happened: when you scan another member's Spotted code, Fist Bump them or open a signing session, we keep the name of the town or suburb you were in, or the wider district or region if your phone doesn't give one. For a scan or Fist Bump at an event you're checked into, we keep the event's name instead. Your phone looks the name up with its own maps service (Apple's or Google's) and sends us only the name, so we never receive or keep your coordinates. Your phone asks for permission the first time, and if you say no, scans, Fist Bumps and signing still work, without a place.
• Who sees the place: you, on your copy; the vehicle's owner, on their own card and in the notification telling them their vehicle was spotted; and the member you Fist Bumped. Anyone else looking at the card sees only how many places it has been spotted in, never which ones.
• Who holds a copy: when you collect a member's card, at any tier, its owner can see that you hold a copy, with your name and DF number. If you've taken your profile out of the member directory, or the owner has blocked you, you show only as part of a count, without your name or DF number. Notifications work differently: when you spot a card in person, or are the first to collect it, its owner may get a notification with your DF number, even if your profile is out of the directory. Nobody else can see who holds a copy.
• Your shelf: other members can see your shelf on your member page, and anyone can see it on the web once your profile is public. It shows each card's tier and, for Spotted and Signed copies, its number. Until you choose what goes on it, it fills itself from your newest copies. It never shows where or when you got a card.
• Event cards: if an event's host makes an event card, each member checked in gets a copy, numbered in the order they checked in, with their DF number and check-in time. Only you can see your copy.

When a card comes down. If a card is unpublished, or its owner deletes their account, copies collected online drop out of view. Spotted and Signed copies stay with the members who hold them, greyed, showing the vehicle's year, make and model, the copy's tier and number, and where and when it was spotted or signed, never a photo or the owner's name. When you delete your own account, your copies and your shelf are deleted and you drop off every owner's list.

How we use your information

We use personal information only for the purposes below.

• To provide the services: run your account, sync your garage, deliver published cards, process orders and subscriptions, send order confirmations and shipping updates.
• To moderate and protect the community: apply banned-word filters, pattern rules, and automated content classification to user-submitted text; review reports from other members; act on terms-of-use breaches.
• To communicate with you: reply to support enquiries, send service and security notices, and (if you opt in) send our newsletter.
• To keep you in the loop: when you join, you're subscribed to the Driving Forever club so you see app news and meets. You can unsubscribe any time from the club's page.
• To improve what we build: understand how features are used, identify bugs, measure the impact of changes. We rely on aggregated and de-identified data for this wherever we can.
• To comply with the law: meet tax, accounting, and consumer-protection obligations, respond to lawful requests from regulators or courts.

We do not sell your personal information. We do not use your data for third-party advertising. We do not train machine-learning models on the content of your garage.

Legal bases

Our primary legal framework is the New Zealand Privacy Act 2020 and its Information Privacy Principles. Depending on the activity, we rely on one or more of:

• Performance of a contract — we need the information to deliver what you signed up for (for example, processing your order).
• Your consent — for example, when you opt in to the newsletter or grant specific app permissions.
• Our legitimate interests — running a safe, working service, preventing fraud and abuse, and improving what we offer, balanced against your privacy.
• Legal obligation — complying with tax, accounting, and consumer-law requirements.

Who we share it with

We share personal information only where we need to run the service, and only with providers bound by confidentiality obligations. The current list is below. We'll update it if we change tools.

• Shopify Inc. — hosts our website, processes payments, stores customer accounts and orders. Shopify privacy policy.
• Stripe, via Shopify Payments, for card processing where applicable. Stripe privacy policy.
• Google (Firebase) — authentication, database (Firestore), crash reporting, and hosting for the Driving Forever app. Firebase privacy policy.
• Apple — App Store distribution, sign-in with Apple, and subscription billing for iOS users. On iPhones, Apple's maps service also turns your location into a place name when you scan, Fist Bump or open a signing session. Apple privacy policy.
• Google Play — distribution and subscription billing for Android users. On Android phones, Google's location service does the same. Google privacy policy.
• RevenueCat — manages subscription entitlements for DF Pro. RevenueCat privacy policy.
• OpenAI — classifies user-submitted text (display names, bios, vehicle copy) against abuse categories. We send the text; we do not send your identity. OpenAI privacy policy.
• Expo — delivers push notifications to your device. Expo privacy policy.
• Email delivery provider — sends transactional email and, if you opt in, our newsletter. Currently Shopify Email. We will update this policy if we change providers.
• Accounting and tax providers — Xero and our accountants receive commerce records as needed for GST, income tax, and company reporting.

We may also share information where required by law, to respond to a valid legal request, to protect the safety of our members or the public, or as part of a business transfer (merger, acquisition, sale of assets) — in which case we'll notify you and keep this policy in force until a new one is published.

International transfers

Several of our providers are based outside New Zealand, and your information may be stored or processed in the United States, Europe, or elsewhere. We choose providers that offer privacy protections at least as strong as New Zealand's, and we rely on their contractual commitments to protect your data in transit and at rest.

How long we keep it

• Account and garage data: kept while your account is active. When you delete your account, we remove your data from our live systems within 30 days. Some data may remain in encrypted backups for up to 12 months before being overwritten.
• Published cards and listings: deleted when you unpublish or delete your account.
• Vehicle history: see "Vehicle history" above. Your side of it is erased when you delete your account.
• Collected cards: see "Collecting cards" above. Your copies and shelf are deleted with your account. Other members' Spotted and Signed copies of your cards stay, without your name, account or photos.
• Order records: retained for at least seven years, because New Zealand tax law requires it.
• Support messages: kept for up to three years so we can reference past conversations with you.
• Analytics and logs: retained for up to 14 months in identified form, longer in aggregated form.

Deleting your Driving Forever account

Open the app → Settings → Delete account. This permanently removes your account and all associated cloud data — published cards, member profile, photos, and vehicle data. Some records may be retained briefly for legal or backup purposes (see "How long we keep it" above), then deleted. The one exception: members who spotted your vehicles, or had a card signed by you, keep their copy as a greyed record of the vehicle, without your name, account or photos (see "Collecting cards" above).

If you can't open the app, email privacy@drivingforever.com to request deletion and we'll take care of it for you. Local data on your device is removed when you uninstall the app.

Security

We take reasonable steps to protect your information: HTTPS everywhere, password hashing via Firebase Authentication, least-privilege access to production systems, and auth-gated database rules. No system is perfectly secure, so we also ask you to choose a strong password, keep it to yourself, and tell us quickly at drive@drivingforever.com if you think your account has been accessed by someone else.

Your rights

Under the New Zealand Privacy Act 2020 you have the right to:

• Access the personal information we hold about you.
• Correct information you believe is wrong.
• Request deletion of your account and associated data. You can do this yourself from the app's Settings screen, or by emailing us.
• Export your vehicle data in a portable format (CSV export is available from the app).
• Withdraw consent for any processing that relied on your consent (for example, unsubscribing from the newsletter), without affecting processing we have already done.
• Complain to the New Zealand Office of the Privacy Commissioner if you are not happy with how we've handled your information — privacy.org.nz. We'd appreciate a chance to resolve it first.

To exercise any of these rights, email privacy@drivingforever.com. We'll respond within 20 working days.

Cookies and similar technologies

drivingforever.com uses cookies for three purposes:

• Essential cookies that make the site work — keeping you signed in, remembering your cart, preventing fraud.
• Preference cookies that remember settings you've chosen.
• Analytics cookies that measure how the site is used, in aggregate.

You can clear cookies or block them through your browser settings. Blocking essential cookies will break parts of the site. The Driving Forever mobile app does not use browser cookies, but relies on secure device tokens to keep you signed in.

Marketing communications

We only send marketing emails if you've opted in. Every marketing email includes an unsubscribe link. Transactional messages (order updates, security notices, service changes) are separate and will continue even if you unsubscribe from marketing.

Children

Driving Forever is intended for people aged 13 and over. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, email us and we will delete it.

Third-party links

Our site and app link to other websites (partner clubs, circuits, manufacturer pages, news articles). We are not responsible for their content or privacy practices. Check their policies before handing over personal information.

Changes to this policy

We'll update this policy as our services change or the law requires. When we make material changes, we'll let you know by email or an in-app notice, and we'll update the "Last updated" date at the top. Continued use of the site or app after an update means you accept the updated policy.

Questions

Send privacy questions, access requests, or complaints to privacy@drivingforever.com and we will reply.

The original of this page is at drivingforever.com/policies/privacy-policy.