Privacy Policy

Internal tools · Last updated: 16 October 2026

1. What this policy covers

Mangaroa Farms Limited (108 Whitemans Valley Road, Upper Hutt 5371, New Zealand) operates a small set of internal tools for our team and invited collaborators:

• Mangaroa Stories — the media app on this domain (media.mangaroa.org), where team members share farm photos, video, voice notes, and updates.
• The Mangaroa MCP server — an internal assistant service our team connects to from approved AI clients.

These tools use Google Sign-In to verify who you are. This policy explains exactly what Google user data they access and how it’s used, stored, and shared. Our public websites are covered by the general Mangaroa Farms Privacy Policy.

2. Google user data we access

When you sign in with Google, we request only the basic sign-in scopes (openid, email, profile), which give us:

• Your name
• Your email address
• Your profile picture

That is all. We do not request or receive access to your Gmail, Google Drive, Calendar, Photos, Contacts, or any other Google account content, and we will not ask for additional scopes without updating this policy and asking for your consent first.

3. How we use it

• Authentication — to sign you in securely without a separate password.
• Access control — your email address is checked against our team allow-list; only approved people can use these tools.
• Attribution — your name and picture identify your contributions (e.g. who uploaded a photo) to the rest of the team.
• Administration — contacting you about your account or the tools.

We don’t use Google user data for advertising, and we don’t use it to train AI or machine-learning models.

4. Where it’s stored

• Sign-in records (name, email, profile picture URL) are stored in our authentication database, hosted by Supabase.
• The tools themselves run on Vercel and Railway, with media files stored on Cloudflare R2 in transit and then on farm-controlled storage.
• All connections use HTTPS/TLS encryption.

5. Sharing

We do not sell Google user data, share it with advertisers, or transfer it to any third party — except the hosting providers listed above, which process it on our behalf solely to run these tools, or where disclosure is required by law.

6. Google API Services User Data Policy — Limited Use

Mangaroa Farms’ use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: Google user data is used only to provide and improve the user-facing features of these tools, is never used for advertising, is never sold, and humans don’t read it except for security, support, compliance, or with your explicit consent.

7. Retention & deletion

• We keep your sign-in data while you hold an account on these tools.
• When you leave the team or ask us to, we remove your account and delete your sign-in data — email welcome@mangaroa.org.
• You can also revoke our access to your Google account at any time at myaccount.google.com/permissions.

8. Security

Access to these tools is restricted by allow-list, all traffic is encrypted in transit, and we limit team access to stored data to those who need it to operate the tools.

9. Changes

If we change what data these tools access or how it’s used, we’ll update this policy, update the date at the top, and ask for your consent again where required.

10. Contact

Questions about this policy or your data: welcome@mangaroa.org · Mangaroa Farms Limited, 108 Whitemans Valley Road, Upper Hutt 5371, New Zealand.