Security Noticeboard

Last updated: 19 October 2026.

Security Noticeboard — Privacy Policy

This policy explains what Security Noticeboard ("the noticeboard", "we", "us") collects, why, and who can see it. It's written for the ordinary visitor, not a lawyer — if anything below is unclear, use the contact details at the end.

• What we collect
• Camera network and plate-recognition checks
• Who can see what
• Sharing with others
• How long we keep information
• Keeping information secure
• Accuracy of information
• Your rights
• Contact

What this noticeboard is

Security Noticeboard is a community stolen-vehicle noticeboard, for New Zealand, organised by the 12 New Zealand Police districts. The Police stolen-vehicle register is brought in one district at a time, starting with Wellington; a district that isn't yet shows as "not covered yet" on the map. It publishes vehicle theft reports (from the community and from the New Zealand Police stolen-vehicle register), lets people add sightings and updates, and connects reports with a private network of camera owners who've volunteered to check their footage on request. It is not operated by, or on behalf of, the New Zealand Police, and it is not an emergency service — if something is happening now, call 111.

What we collect, and why

Stolen-vehicle reports and sightings are public, but your name isn't on them. Once a vehicle is marked recovered, where it was taken from and every place it was seen are hidden from the public, replaced with "Hidden details - contact for more information". A year after it's recovered, those details are deleted for good, keeping only the suburb. While a vehicle is still listed stolen, its newest sighting or update also appears on the Noticeboard tab (the street and suburb only), linking to the report. When you report a vehicle stolen, add a sighting, or add a detail to an existing report, we publish the vehicle and description information you provide, and where it happened as the street and suburb only. A house number, full address or exact map point is never published; the map shows the spot to within about 100 metres, and only the noticeboard's PI-licensed administrator, and Crime Stoppers if the report is forwarded to them, can see the exact location you gave. Filing a report needs an account: the report is linked to your account privately, and your name, email address and phone number are never shown on it. We also keep:

• A salted, one-way hash of your IP address, used only to enforce fair-use limits (so one connection can't flood the board with reports) — never your actual IP address, and never shown to anyone.
• A one-time token, stored as a hash, so the browser that filed a report can later mark it recovered without creating an account.
• The region you pick on the map of New Zealand, so the Stolen List and the Noticeboard open on it: kept only in your browser on that device, never sent to us. Pick another with "Change region"; clearing your browser's site data forgets it.
• Whether you've told us you're 18 or over, so the Noticeboard doesn't keep asking: as a small cookie on your device (30 days unless we change it, holding no personal information), and, if you tick "I'm 18 or over" when you sign up, on your profile, or click Continue while signed in, as a note on your account. It's your own statement; we don't check ID. You can untick it on your profile.

Where a vehicle was stolen from is treated as sensitive, because it's often someone's home. If you add it to a report ("I know where it was stolen from"), only the suburb is shown publicly, with no map pin. The noticeboard's PI-licensed administrator, and Crime Stoppers if the report is forwarded to them, can see the full location you give; other administrators see the street and suburb. If you ask for footage, camera owners within the distance you choose are told the street and suburb, never the house number, so they can check their footage.

Other incident reports are private by default. A report of a break-in, damage or similar (not a stolen vehicle) is not published. It goes only to the noticeboard's administrators and, if you switch on footage requests, to camera owners within the distance you set — who are only ever told the type of incident, the suburb, and a distance rounded up to the nearest 100 metres, never the address. You can choose to make a short public notice from it (incident type, suburb and date only), and separately choose to include a street name and number in that public notice. Photos you add (up to six) are kept privately, not in a public folder, and are seen only by the administrators unless you choose to post them in your public notice, or say which ones can be shared. You can lock any photo so that only the noticeboard's PI-licensed investigators can see it; a locked photo is never made public.

If you register a CCTV camera, we collect its approximate location, what it can see, how long you keep footage, your name, and a way to reach you (and optionally a cell number). This is stored privately against your account and is only ever visible to you and to a noticeboard administrator — it is never included in anything public — with one exception: confirmed New Zealand Police staff on our Police registry, signed in, can see on a map where registered cameras are, what each one sees, how long its footage is kept and whether it reads plates, so they know where footage might exist. They never see your name, contact details, address or account; to ask for footage, they ask us, and we ask you. Each time the map is opened, it's logged. You can register more than one camera on the same account. If we verify a camera and its recorded location is then moved by more than about 50 metres, it automatically drops back to unverified, since verification is tied to a specific place.

Statistics. Signed-in members can see statistics about the noticeboard, and the weekly summary includes them: counts and breakdowns only (how many vehicles were reported and recovered, the most stolen makes and models, by district and suburb, and how much is posted and updated on the Noticeboard). They never include a plate, an address or anything about who reported or posted.

Council cameras. The locations of Hutt City Council's and Upper Hutt City Council's public CCTV cameras are listed in the camera network the same way, from the camera map Hutt City Council publishes, and refreshed about once a month. We keep only each camera's name, area and position. Once we've switched a council's requests on, a council with cameras within 500 metres of a report is sent one footage request for it, with the same details any camera owner gets (the type of incident or the plate, the suburb or street, rounded distances and the time window), never the reporter's identity. Whether and how a council releases footage is decided by that council under its own rules.

Your own camera system is your responsibility. Registering it here doesn't mean we've reviewed, approved or vetted how you run it. Signage, footage retention, and your own compliance with the Privacy Act 2020 — including the Office of the Privacy Commissioner's guidance on CCTV — are entirely yours to get right. We broker footage requests between reporters and camera owners; we accept no responsibility or liability for how an individual owner's camera system is installed, operated or maintained.

Urgent reports — a one-tap "something is happening right now" feature — are only available to specific people we've individually approved and trained. If you're one of them and you use it, we collect the video you record and your location at the time, and send an immediate alert to verified camera owners nearby (never to the public). This feature is off by default for every account and only turned on for someone once we've granted it. A recording like this is filmed in a public place by a member of the public, not covert surveillance, but it can end up including other people nearby as well as the vehicle or incident itself — access to it stays locked down to the verified camera owners it's sent to and the noticeboard's administrators, and it's deleted automatically after 30 days.

If you report a stolen vehicle, we email you when someone adds to it. When someone else adds a sighting or update to your report, we send you what they added (the street and suburb, never a house number), when, and a link to the report, at the email address on your account. These stop once the report is marked recovered.

If you create an account (needed to file a report, post on the Noticeboard, register a camera, or be granted Urgent reporting), WordPress collects the usual account information — username, email address, and a hashed password — under WordPress's own account handling. You can also give a mobile number (optional). Your CCTV contact details (a name, a way to reach you and a cell number) are kept on your account too, so each camera you register is filled in for you: they come from your account details if you tick "Use my account details for the CCTV register" (ticked on the sign-up form), otherwise from the details on the camera you saved most recently, and you can change them on your account page. Like a camera's own details, only you and the noticeboard's administrators see them.

Noticeboard posts are public, but your name isn't on them. To post a notice or an update you need an account, and we keep your real name on file (we ask for it if your account doesn't have one); only the noticeboard's administrators see it. We publish what you write: the kind of notice, a heading, the details, the suburb, the date and any photo or video you add. Once a notice is approved, the same public details (never your name, and never a house number) are also posted to the Security Noticeboard Facebook Page, with a link back to it. You can edit your notice while it's up; your changes are checked before they show. If you add an address, it must be your own or added with the owner's or tenant's permission; the public sees only the street and suburb, and only the PI-licensed administrator sees the number and exact point. We email updates about your notice to your account's address. A signed-in member can ask for more detail about a notice to help in the search for evidence; the PI-licensed administrator decides, and if they agree the details are emailed to that member, never put on the site. Please leave out other people's names and faces; an administrator checks posts before they go up unless you've been marked as a trusted member.

If you subscribe to the weekly summary, we keep your email address, the date you signed up and confirmed, and when we last sent you a summary. We email you a confirmation link first and only start sending once you've clicked it. Every summary has a link to unsubscribe, which deletes your address from our list straight away. The summary only contains what's already public on the noticeboard.

If you ask to advertise (the Advertise page), we collect your business or group name, your name, email address, optional phone number, the link your advert should go to, any charity number or description of your group, your message, and the images you upload. Only noticeboard administrators can see your contact details; we use them to check your advert, send an invoice and talk to you about it. Your advert itself (its images, name and link) is public once it goes live. For adverts we count clicks per month, and nothing about who clicked.

If you ask about a CCTV package (the CCTV Packages page), we collect the kit you chose, the price the page showed, your name, email address, suburb, optional phone number and your message. Only noticeboard administrators see it, and we use it only to reply to you about that enquiry. Enquiries are deleted 2 years after they come in. If you go ahead and buy, we keep a record of the sale (your name and email, what you bought, the amount and how and when you paid) for 7 years, for the trust's financial records.

If you click a sponsor's advert, it goes through our own site first so we can count it. We keep only a monthly total of clicks for each sponsor. So that one person's repeat clicks aren't counted many times, we keep a scrambled, one-way version of your connection's address for 30 minutes, after which it's deleted. Nothing else about you is recorded, and no advertising network or tracking is involved.

We use a small amount of automated anti-abuse data across all our forms: a hidden field that only a script would fill in, a signed timestamp, and — if enabled — a Cloudflare Turnstile check. These exist to stop automated spam and don't identify you personally.

If you sell or buy on the CCTV Market (members only; every sale is by secure transfer), we collect your first and last name, a contact number and your postal address, and, for a seller, the bank account the payout goes to. We also keep the listing and its photos, and a record of each step of a sale: when the payment came in and went out, with the bank references, and the IP address each step was taken from (saving your details, listing, buying, marking an item sent or dropped off, raising a problem), in case of a fraud complaint. A website can't see a device's MAC address, so we don't collect one. We never handle card details: payments are bank transfers you make yourself.

If you save a vehicle in My vehicles (signed-in members only), we keep what you enter: the plate, make, model, year, colour and body type, what makes it stand out (dents, stickers, known faults and so on), up to six photos of it (the front, the back, each side and two more), each with an optional caption, and up to two videos of up to 15 seconds each. Videos are cut and cropped on your phone or computer before they're sent, and saved without sound. For each photo we keep the cropped picture and the original it was cropped from, so you can crop it again. Photos are stored privately, not in a public folder, and any location data your phone adds to a photo is removed when we receive it. Only you and the noticeboard's PI-licensed administrator can see your saved vehicles. The PI-licensed administrator sees everything you've saved (every photo, the originals, the captions and the videos) with your name, email address and phone number, so they can identify a stolen vehicle, check a plate-camera match against it, and contact you. Each time they open one, it's logged. No other administrator can see them. Nothing is public unless the vehicle is stolen and you've left "Show on its listing if it's stolen" ticked. Then its photos, videos, captions and your description are shown on its stolen-vehicle listing, so it's easier to spot: on your own report of it, or, if the plate is on the NZ Police stolen-vehicle list, on that listing (only when you're the only member who has saved that plate and its make matches the Police record). Someone else reporting your plate can't make them public. They stop being shown once the vehicle is recovered or leaves the Police list, and your name is never shown. If the plate is added to the Police list, we email you. If one of our plate-recognition cameras then sees it and nobody who reported it can be told, we email you the reference number to give Police, never where or when it was seen.

Location is only ever collected when you actively provide it — dropping a pin, searching an address, or tapping "use my location". We don't collect device location in the background or without your action.

We also receive information from third parties, specifically:

• The New Zealand Police published stolen-vehicle register (a public data feed), which we use to confirm and cross-reference community reports.
• CarJam, if you use the "fill from CarJam" lookup on the report form — we send the plate you typed and receive back basic vehicle details (make, model, year, colour, body style, and whether it's flagged stolen). We only keep the fields the form actually uses, cached for 30 days, and none of CarJam's more detailed data (VIN, ownership history, WOF history, odometer) is stored or shown.

Camera network and plate-recognition checks

Separately from the public camera network above, the noticeboard's administrator operates a small number of its own licence-plate-recognition (LPR) cameras. Filing a report, or a plate becoming confirmed stolen on the Police register, may cause an automatic check of these cameras for that plate. This is not a live tracking system and does not scan traffic generally — it is one targeted check per confirmed theft, rechecked on a schedule for a limited period while the vehicle remains listed as stolen. Some of these cameras can't be reached from the noticeboard (for example, one on mobile data), so instead they send each plate they read to the noticeboard as it happens: the plate, the time, which camera, and the camera's pictures. That includes a vehicle whose plate the camera couldn't read, recorded as unreadable with its pictures. These are kept for 30 days in a locked store and then deleted. They're searched automatically only for a plate confirmed stolen on the Police register, in the same way the cameras' own recorders are searched, and there's no way to browse them. A read whose plate couldn't be read is never matched against anything. The one exception is checking that the cameras work: the noticeboard's PI-licensed administrator can search the cameras, their recorders and these stored reads by hand, for a plate, part of a plate, or plates the camera couldn't read, and look at the pictures that turn up. Each of those searches needs a reason, and the reason, who searched, when, and what was found are kept in the LPR access log. Otherwise nobody sees a read unless it's a match, handled as described below. Cameras sometimes misread a plate (a 1 read as an I, say, or a character missed), so a read that could be a misread of a plate confirmed stolen is kept as a possible match: an approved investigator checks its picture, the reporter is told nothing unless the investigator confirms it's the car, and if it isn't, its pictures are deleted straight away.

• If your own report produces a match, we email you only that the vehicle has been seen, along with a reference number you can give to Police — never a location, time, camera or image. This only reaches you if you filed while signed in; anonymous reports have no way for us to contact you.
• The noticeboard's PI-licensed administrator may post a match on the report as an update, like any other sighting: the time it was seen and the street and suburb where the camera is, never a house number. The images stay locked as described below; the update says to contact the noticeboard about them.
• Police can use that reference to request the underlying material from us directly.
• Sightings are sent to New Zealand Police as they happen. Each camera sighting of a vehicle on the Police stolen-vehicle list is emailed straight away to the New Zealand Police staff on our Police registry: the plate, when and where it was seen, the Police list's own details of the vehicle, and the plate close-up. The scene picture isn't attached: each officer gets a link of their own to see it, and to ask us for the video. Opening that link and viewing the picture are recorded against the officer's name, with the time, their browser and IP address. During a trial that began in October 2026, this includes possible matches (the camera read a plate one character different from a stolen one) before an investigator has checked them, clearly marked as not yet checked; when it's checked, Police are told the answer, and if it wasn't the car they're asked to delete the plate picture, and we delete our copies. Not sent: a read from before the theft. Only @police.govt.nz addresses can be on the registry, each person confirms their address before anything is sent to them, and every send is recorded in the LPR access log.
• When a camera reads a vehicle that's still listed as stolen, the approved private investigators described below are emailed the plate and a reference number, so they know to check it on the site. Where and when it was seen, and the images, are never put in that email.
• The plate close-up, scene image and (where available) video clip are only ever accessible to specifically approved private investigators holding a current security licence, logged against their access. An approved investigator, signed in, can preview the plate close-up (on the noticeboard's dashboard or in the app), and each preview is logged; the material itself is only ever handed over through a gated, single-use, time-limited release process — never a direct download, and never to the public — apart from sightings emailed to the Police registry, as above.
• This matched material is kept for eight weeks from the date of the match, then deleted. A record of who accessed or requested access to it — including refused attempts — is kept for longer, since that log holds no imagery itself.

Camera owners in the separate, public-facing camera network described above are never asked to check footage as a result of this process — the two systems are independent, and a camera you register yourself is never queried by it.

Who can see what

Sharing with others

We don't sell personal information. We do share the following, only in the ways described:

• Facebook — reports may be posted automatically to our Facebook Page, and from there shared onward at our discretion (for example, to a community Facebook group). Posted content is what's already public on the report; camera owner details, incident addresses and footage-offer information are never included.
• Crime Stoppers — if this is switched on, and only for reports where you don't opt out, a report may be forwarded to Crime Stoppers by email. Because Crime Stoppers passes information to Police, the forward includes the full detail: the full address and exact map point of where the vehicle was taken from and of every update. It never includes a reporter's contact details, the camera register, or footage-offer information.
• Google Maps — the map on our report and sighting forms is provided by Google. Nothing is sent to Google until you actively place a pin or search an address.
• CarJam — the plate you look up is sent to CarJam to retrieve basic vehicle details, as described above.
• New Zealand Police — as described above, on request using a reference number, or where we're otherwise required to by law. Staff on our Police registry (verified @police.govt.nz addresses only) are emailed each camera sighting as it happens (the plate close-up, and a link of their own to the scene picture and to ask for the video), and each public update on a stolen vehicle as it's posted: what was posted, when and where, and any photo, but not who posted it.

Some of these providers (Facebook, Google, CarJam) are based, or store data, outside New Zealand. We've reviewed each of these providers' own data-handling policies and published security practices, and are satisfied they protect information to a standard comparable to what we'd expect here — but if this matters to you, avoid using the CarJam lookup and be aware that a published report may be shared to Facebook.

How long we keep information

Keeping information secure

Camera registration and incident details are stored privately and never included in anything the public site or its public API returns. LPR matched footage sits behind a gated release process requiring an approved licence, a one-time password, and a link that only works for the account that requested it, once, within a short window. All access — successful or refused — is logged. We run our own server rather than a shared host, and apply the usual practical safeguards (encrypted connections, rate-limiting, and automated blocking of abusive traffic) but no system is perfectly secure, and we can't guarantee it.

Accuracy of information

Every effort is made to keep what's on the noticeboard true and accurate, based on the information provided to us and the judgement of the licensed security professionals reviewing it. We're human, and mistakes happen — a detail can be wrong, or a report can turn out to have been based on inaccurate information. If you notice, or are told about, a discrepancy, please report it to our admin team in writing at errors@securitynoticeboard.co.nz so it can be corrected or resolved in a timely manner.

Your rights

Under the Privacy Act 2020, you can ask what personal information we hold about you and ask us to correct it. Contact us using the details below. We may need to verify who you are before releasing or changing anything, and some information (for example, another person's private contact details) may not be something we can share with you.

Contact, and changes to this policy

Questions about this policy, or a request about your information, can be sent to hello@securitynoticeboard.co.nz. We may update this policy as the noticeboard changes; the date at the top shows when it was last revised.

Complaints about something posted on the noticeboard (a notice, an update or a report) go to contact@securitynoticeboard.co.nz. We pass a complaint on to the person who posted it within 48 hours, and take the post down if they don't reply within 48 hours or agree to it coming down. If a post looks unsafe or plainly wrong, we may take it down straight away while we look into it.