Security Noticeboard

Last updated: 10 October 2026.

Security Noticeboard — Privacy Policy

This policy explains what Security Noticeboard ("the noticeboard", "we", "us") collects, why, and who can see it. It's written for the ordinary visitor, not a lawyer — if anything below is unclear, use the contact details at the end.

• What we collect
• Camera network and plate-recognition checks
• Who can see what
• Sharing with others
• How long we keep information
• Keeping information secure
• Accuracy of information
• Your rights
• Contact

What this noticeboard is

Security Noticeboard is a community stolen-vehicle noticeboard, currently covering the Hutt Valley and expanding — first across the wider Wellington region, then the North Island, with the aim of covering all of New Zealand over time. It publishes vehicle theft reports (from the community and from the New Zealand Police stolen-vehicle register), lets people add sightings and updates, and connects reports with a private network of camera owners who've volunteered to check their footage on request. It is not operated by, or on behalf of, the New Zealand Police, and it is not an emergency service — if something is happening now, call 111.

What we collect, and why

Stolen-vehicle reports and sightings are public, but your name isn't on them. Once a vehicle is marked recovered, where it was taken from and every place it was seen are hidden from the public, replaced with "Hidden details - contact for more information". A year after it's recovered, those details are deleted for good, keeping only the suburb. While a vehicle is still listed stolen, its newest sighting or update also appears on the Noticeboard tab (the street and suburb only), linking to the report. When you report a vehicle stolen, add a sighting, or add a detail to an existing report, we publish the vehicle and description information you provide, and where it happened as the street and suburb only. A house number, full address or exact map point is never published; the map shows the spot to within about 100 metres, and only the noticeboard's PI-licensed administrator, and Crime Stoppers if the report is forwarded to them, can see the exact location you gave. Filing a report needs an account: the report is linked to your account privately, and your name, email address and phone number are never shown on it. We also keep:

• A salted, one-way hash of your IP address, used only to enforce fair-use limits (so one connection can't flood the board with reports) — never your actual IP address, and never shown to anyone.
• A one-time token, stored as a hash, so the browser that filed a report can later mark it recovered without creating an account.
• Whether you've told us you're 18 or over, so the Noticeboard doesn't keep asking: as a small cookie on your device (30 days unless we change it, holding no personal information), and, if you tick "I'm 18 or over" when you sign up, on your profile, or click Continue while signed in, as a note on your account. It's your own statement; we don't check ID. You can untick it on your profile.

Where a vehicle was stolen from is treated as sensitive, because it's often someone's home. If you add it to a report ("I know where it was stolen from"), only the suburb is shown publicly, with no map pin. The noticeboard's PI-licensed administrator, and Crime Stoppers if the report is forwarded to them, can see the full location you give; other administrators see the street and suburb. If you ask for footage, camera owners within the distance you choose are told the street and suburb, never the house number, so they can check their footage.

Other incident reports are private by default. A report of a break-in, damage or similar (not a stolen vehicle) is not published. It goes only to the noticeboard's administrators and, if you switch on footage requests, to camera owners within the distance you set — who are only ever told the type of incident, the suburb, and a distance rounded up to the nearest 100 metres, never the address. You can choose to make a short public notice from it (incident type, suburb and date only), and separately choose to include a street name and number in that public notice. Photos you add (up to six) are kept privately, not in a public folder, and are seen only by the administrators unless you choose to post them in your public notice, or say which ones can be shared. You can lock any photo so that only the noticeboard's PI-licensed investigators can see it; a locked photo is never made public.

If you register a CCTV camera, we collect its approximate location, what it can see, how long you keep footage, your name, and a way to reach you (and optionally a cell number). This is stored privately against your account and is only ever visible to you and to a noticeboard administrator — it is never included in anything public. You can register more than one camera on the same account. If we verify a camera and its recorded location is then moved by more than about 50 metres, it automatically drops back to unverified, since verification is tied to a specific place.

Your own camera system is your responsibility. Registering it here doesn't mean we've reviewed, approved or vetted how you run it. Signage, footage retention, and your own compliance with the Privacy Act 2020 — including the Office of the Privacy Commissioner's guidance on CCTV — are entirely yours to get right. We broker footage requests between reporters and camera owners; we accept no responsibility or liability for how an individual owner's camera system is installed, operated or maintained.

Urgent reports — a one-tap "something is happening right now" feature — are only available to specific people we've individually approved and trained. If you're one of them and you use it, we collect the video you record and your location at the time, and send an immediate alert to verified camera owners nearby (never to the public). This feature is off by default for every account and only turned on for someone once we've granted it. A recording like this is filmed in a public place by a member of the public, not covert surveillance, but it can end up including other people nearby as well as the vehicle or incident itself — access to it stays locked down to the verified camera owners it's sent to and the noticeboard's administrators, and it's deleted automatically after 30 days.

If you report a stolen vehicle, we email you when someone adds to it. When someone else adds a sighting or update to your report, we send you what they added (the street and suburb, never a house number), when, and a link to the report, at the email address on your account. These stop once the report is marked recovered.

If you create an account (needed to file a report, post on the Noticeboard, register a camera, or be granted Urgent reporting), WordPress collects the usual account information — username, email address, and a hashed password — under WordPress's own account handling.

Noticeboard posts are public, but your name isn't on them. To post a notice or an update you need an account, and we keep your real name on file (we ask for it if your account doesn't have one); only the noticeboard's administrators see it. We publish what you write: the kind of notice, a heading, the details, the suburb, the date and any photo or video you add. Once a notice is approved, the same public details (never your name, and never a house number) are also posted to the Security Noticeboard Facebook Page, with a link back to it. You can edit your notice while it's up; your changes are checked before they show. If you add an address, it must be your own or added with the owner's or tenant's permission; the public sees only the street and suburb, and only the PI-licensed administrator sees the number and exact point. We email updates about your notice to your account's address. A signed-in member can ask for more detail about a notice to help in the search for evidence; the PI-licensed administrator decides, and if they agree the details are emailed to that member, never put on the site. Please leave out other people's names and faces; an administrator checks posts before they go up unless you've been marked as a trusted member.

If you subscribe to the weekly summary, we keep your email address, the date you signed up and confirmed, and when we last sent you a summary. We email you a confirmation link first and only start sending once you've clicked it. Every summary has a link to unsubscribe, which deletes your address from our list straight away. The summary only contains what's already public on the noticeboard.

If you ask to advertise (the Advertise page), we collect your business or group name, your name, email address, optional phone number, the link your advert should go to, any charity number or description of your group, your message, and the images you upload. Only noticeboard administrators can see your contact details; we use them to check your advert, send an invoice and talk to you about it. Your advert itself (its images, name and link) is public once it goes live. For adverts we count clicks per month, and nothing about who clicked.

If you ask about a CCTV package (the CCTV Packages page), we collect the kit you chose, the price the page showed, your name, email address, suburb, optional phone number and your message. Only noticeboard administrators see it, and we use it only to reply to you about that enquiry. Enquiries are deleted 2 years after they come in. If you go ahead and buy, we keep a record of the sale (your name and email, what you bought, the amount and how and when you paid) for 7 years, for the trust's financial records.

If you click a sponsor's advert, it goes through our own site first so we can count it. We keep only a monthly total of clicks for each sponsor. So that one person's repeat clicks aren't counted many times, we keep a scrambled, one-way version of your connection's address for 30 minutes, after which it's deleted. Nothing else about you is recorded, and no advertising network or tracking is involved.

We use a small amount of automated anti-abuse data across all our forms: a hidden field that only a script would fill in, a signed timestamp, and — if enabled — a Cloudflare Turnstile check. These exist to stop automated spam and don't identify you personally.

If you sell or buy on the CCTV Market (members only; every sale is by secure transfer), we collect your first and last name, a contact number and your postal address, and, for a seller, the bank account the payout goes to. We also keep the listing and its photos, and a record of each step of a sale: when the payment came in and went out, with the bank references, and the IP address each step was taken from (saving your details, listing, buying, marking an item sent or dropped off, raising a problem), in case of a fraud complaint. A website can't see a device's MAC address, so we don't collect one. We never handle card details: payments are bank transfers you make yourself.

Location is only ever collected when you actively provide it — dropping a pin, searching an address, or tapping "use my location". We don't collect device location in the background or without your action.

We also receive information from third parties, specifically:

• The New Zealand Police published stolen-vehicle register (a public data feed), which we use to confirm and cross-reference community reports.
• CarJam, if you use the "fill from CarJam" lookup on the report form — we send the plate you typed and receive back basic vehicle details (make, model, year, colour, body style, and whether it's flagged stolen). We only keep the fields the form actually uses, cached for 30 days, and none of CarJam's more detailed data (VIN, ownership history, WOF history, odometer) is stored or shown.

Camera network and plate-recognition checks

Separately from the public camera network above, the noticeboard's administrator operates a small number of its own licence-plate-recognition (LPR) cameras. Filing a report, or a plate becoming confirmed stolen on the Police register, may cause an automatic check of these cameras for that plate. This is not a live tracking system and does not scan traffic generally — it is one targeted check per confirmed theft, rechecked on a schedule for a limited period while the vehicle remains listed as stolen. Some of these cameras can't be reached from the noticeboard (for example, one on mobile data), so instead they send each plate they read to the noticeboard as it happens: the plate, the time, which camera, and the camera's pictures. These are kept for 30 days in a locked store and then deleted. They're only ever searched by plate, for a plate confirmed stolen on the Police register, in the same way the cameras' own recorders are searched; there's no way to browse them, and nobody sees a read unless it's a match, handled as described below. Cameras sometimes misread a plate (a 1 read as an I, say, or a character missed), so a read that could be a misread of a plate confirmed stolen is kept as a possible match: an approved investigator checks its picture, the reporter is told nothing unless the investigator confirms it's the car, and if it isn't, its pictures are deleted straight away.

• If your own report produces a match, we email you only that the vehicle has been seen, along with a reference number you can give to Police — never a location, time, camera or image. This only reaches you if you filed while signed in; anonymous reports have no way for us to contact you.
• The noticeboard's PI-licensed administrator may post a match on the report as an update, like any other sighting: the time it was seen and the street and suburb where the camera is, never a house number. The images stay locked as described below; the update says to contact the noticeboard about them.
• Police can use that reference to request the underlying material from us directly.
• When a camera reads a vehicle that's still listed as stolen, the approved private investigators described below are emailed the plate and a reference number, so they know to check it on the site. Where and when it was seen, and the images, are never put in that email.
• The plate close-up, scene image and (where available) video clip are only ever accessible to specifically approved private investigators holding a current security licence, logged against their access, and only through a gated, single-use, time-limited release process — never a direct download from the app, and never to the public.
• This matched material is kept for eight weeks from the date of the match, then deleted. A record of who accessed or requested access to it — including refused attempts — is kept for longer, since that log holds no imagery itself.

Camera owners in the separate, public-facing camera network described above are never asked to check footage as a result of this process — the two systems are independent, and a camera you register yourself is never queried by it.

Who can see what

Sharing with others

We don't sell personal information. We do share the following, only in the ways described:

• Facebook — reports may be posted automatically to our Facebook Page, and from there shared onward at our discretion (for example, to a community Facebook group). Posted content is what's already public on the report; camera owner details, incident addresses and footage-offer information are never included.
• Crime Stoppers — if this is switched on, and only for reports where you don't opt out, a report may be forwarded to Crime Stoppers by email. Because Crime Stoppers passes information to Police, the forward includes the full detail: the full address and exact map point of where the vehicle was taken from and of every update. It never includes a reporter's contact details, the camera register, or footage-offer information.
• Google Maps — the map on our report and sighting forms is provided by Google. Nothing is sent to Google until you actively place a pin or search an address.
• CarJam — the plate you look up is sent to CarJam to retrieve basic vehicle details, as described above.
• New Zealand Police — as described above, on request using a reference number, or where we're otherwise required to by law.

Some of these providers (Facebook, Google, CarJam) are based, or store data, outside New Zealand. We've reviewed each of these providers' own data-handling policies and published security practices, and are satisfied they protect information to a standard comparable to what we'd expect here — but if this matters to you, avoid using the CarJam lookup and be aware that a published report may be shared to Facebook.

How long we keep information

Keeping information secure

Camera registration and incident details are stored privately and never included in anything the public site or its public API returns. LPR matched footage sits behind a gated release process requiring an approved licence, a one-time password, and a link that only works for the account that requested it, once, within a short window. All access — successful or refused — is logged. We run our own server rather than a shared host, and apply the usual practical safeguards (encrypted connections, rate-limiting, and automated blocking of abusive traffic) but no system is perfectly secure, and we can't guarantee it.

Accuracy of information

Every effort is made to keep what's on the noticeboard true and accurate, based on the information provided to us and the judgement of the licensed security professionals reviewing it. We're human, and mistakes happen — a detail can be wrong, or a report can turn out to have been based on inaccurate information. If you notice, or are told about, a discrepancy, please report it to our admin team in writing at errors@securitynoticeboard.co.nz so it can be corrected or resolved in a timely manner.

Your rights

Under the Privacy Act 2020, you can ask what personal information we hold about you and ask us to correct it. Contact us using the details below. We may need to verify who you are before releasing or changing anything, and some information (for example, another person's private contact details) may not be something we can share with you.

Contact, and changes to this policy

Questions about this policy, or a request about your information, can be sent to hello@securitynoticeboard.co.nz. We may update this policy as the noticeboard changes; the date at the top shows when it was last revised.

Complaints about something posted on the noticeboard (a notice, an update or a report) go to contact@securitynoticeboard.co.nz. We pass a complaint on to the person who posted it within 48 hours, and take the post down if they don't reply within 48 hours or agree to it coming down. If a post looks unsafe or plainly wrong, we may take it down straight away while we look into it.