Privacy policy
Last updated 7th October 2026
GigRally collects the least it needs to tell a band who can play when: your email address, the name you go by, and which days you are free or busy. It never sees what you are doing on those days.
Who we are
GigRally is run by Tankway Productions Ltd (“we”, “us”). We follow the New Zealand Privacy Act 2020. Our privacy officer is Aaron Shirriffs, reachable at info@tankway.co.nz. You can also use the contact form.
What we collect
| What | Why | Where it comes from |
|---|---|---|
| Email address(es) | To sign you in (we email a one-time link; there are no passwords) and to send band messages you have turned on | You |
| Display name and instrument | So your band knows who is who | You, or a band admin |
| Your free and busy days | The point of the service: shown to the bands you are in | You, when you tap a date |
| Busy days from a linked Google calendar (optional) | To mark you busy when your diary already says so | Google: the names of your calendars (so you can pick which count, never stored) and free/busy times only. No event titles, places or guests |
| Events your band books | So members and their calendars know about gigs and rehearsals | Band admins |
| Crew profile and job offers (Crew users only) | To match freelancers to work | You and the companies you work with |
| Messages you send through the contact form | To answer you | You |
| Early access links | A record of who was given early access, and which band each link started | Us: the link carries a short label we write when we send it, which may be your name |
| IP address (and browser type, for crew offer replies) | To stop abuse of sign-in and contact forms, and as a record of who asked for a sign-in link or answered a crew offer. Rate-limit records go within hours and sign-in link records within about a day; crew offer replies keep it while your account exists | Your connection |
We do not use advertising or tracking cookies. The one cookie we set keeps you signed in.
Who sees it
- Your bands see your name, instrument and your free/busy answer for each date. A band never learns which other bands you are in, or why you are busy.
- Companies you crew for see your crew profile and your replies to their offers.
- We can see the list of bands, each band’s owner and members, to manage early access. To help when something goes wrong, we can also see account names and email addresses; whether our emails reach you (and the reason, if they bounce); when you joined, last signed in, asked for a sign-in email or saved your dates; whether your Google calendar is connected and syncing; your name, role and instrument in each band you’re in, and how far ahead you’ve answered in each; and, for a band, its invite links and how many events it has. We never look at which dates you mark, or at event details.
- Service providers process data for us, only to run GigRally:
| Provider | What for | Where |
|---|---|---|
| DigitalOcean | The server and database | Sydney, Australia |
| Cloudflare | Delivers the website securely | Global network |
| Postmark (ActiveCampaign) | Sends sign-in links and band emails | United States |
| Calendar linking, if you turn it on | United States | |
| Backblaze | Encrypted off-site backups | United States |
Sending your information to these providers means it is held outside New Zealand. Under Information Privacy Principle 12 we only use providers that are bound to protect it in a way comparable to the Privacy Act, through their own privacy laws or their contracts with us. We do not sell your information or share it with anyone else unless the law requires it.
How long we keep it
- Leave or are removed from a band: your dates for that band are deleted after 30 days.
- Close your account (Account → Close my account): your emails, memberships and dates are deleted at once.
- Backups are kept for 30 days, so deleted data is fully gone from them within about 31 days.
- Unused sign-in links and expired invite links are deleted automatically.
- Our record of early access links (including the label we gave each link, which may be a name) and our log of changes to bands’ access are kept after an account or band is closed, as the record of who was given early access.
Your rights
You can see and correct your information at any time on your Account page, and download your account, email addresses, bands and dates as a file (Account → Download my data). For anything else we hold about you, ask us. You can ask us for access or correction directly, and we will answer within 20 working days. If you are not happy with how we handle your information, you can complain to the Privacy Commissioner.
Security
All traffic is encrypted (HTTPS). Sign-in links are single-use and expire. Google calendar access is stored encrypted, and you can disconnect it at any time from Account or from your Google account. If a breach is likely to cause serious harm, we will tell you and the Privacy Commissioner as the Act requires.
Changes
If we change this policy in a way that matters, we will tell you by email or in the app before it takes effect. The date at the top shows when it last changed.