Privacy policy

This policy covers the Afterburner mobile app and this website, both operated by Chartres Software Limited, a company registered in New Zealand ("we", "us"). It explains what we hold, why, who else sees it, and what you can do about it.

We handle personal information in accordance with the New Zealand Privacy Act 2020.

This policy does not cover your heater's own firmware, which is developed and maintained independently.

The short version

• You sign in with Apple or Google. We never create or hold a password.
• Your heater's readings pass through our messaging service in real time and are not kept. The one exception is a flag showing whether it is currently connected.
• Payment is handled entirely by the App Store or Google Play. We never see your card.
• No advertising, no analytics, no crash reporting, no tracking, and nothing sold or shared.

What we hold

Three things, and nothing else:

Your heater's readings

To show your heater's status and send it commands, the app exchanges messages with your heater through a messaging service we operate, using a protocol called MQTT. Those messages carry temperature readings, fuel use, run state, timer settings, supply voltage, fault codes, and diagnostic details the heater reports about its own connection — network name, signal strength and hardware address.

None of it is retained. Messages pass through the service to your phone in real time and are not logged, archived or stored once delivered. There is no server-side history of how you have run your heater, and we could not produce one if asked.

That is deliberate rather than incidental. A heater can be controlled by more than one means, so the app never assumes it holds the current state. It asks the heater directly when you open the app, when you bring it back to the foreground, and at intervals while it is running. Stored history would be a liability rather than a feature.

The one exception

Our messaging service keeps a single flag recording whether your heater is currently connected, so the app can tell you that the moment you open it rather than making you wait.

That flag says one thing only: connected, or not connected. It carries nothing about temperature, fuel use, timers or how the heater is running. It is overwritten the instant the connection state changes, so it is a current status rather than a log — there is no record of when your heater has been on or off over time.

What we do not collect

• No password. You sign in with Apple or Google, so there is nothing for us to hold or lose.
• No location data. The app does not request or use your location.
• No contacts, photos, messages, calendar, microphone or camera.
• No advertising identifiers. There is no advertising in the app.
• No analytics or crash reporting tools. We do not embed third-party tracking software.
• No browsing or search history.
• No card number, billing address or other payment details.

Tracking

We do not track you. We do not link your data to data from other companies' apps or websites, and we do not share it with data brokers or advertising networks. There is nothing to opt out of, because we do not do it.

How we use what we hold

Only to run the app: signing you in, provisioning and maintaining your heater's private messaging channel, relaying your heater's status to your phone, carrying your commands back to it, and answering you if you contact support. Nothing is used for advertising, profiling, or any purpose unrelated to running the service.

Who else sees your information

We do not sell your information and we do not share it with third parties for their own purposes. It is only ever handled by:

• Apple and Google, for sign-in and for processing your subscription. Their own privacy policies govern what they collect.
• Our hosting and messaging providers — EMQX Cloud for the messaging service and Cloudflare for this website and our account infrastructure — who process data on our behalf under contract and may not use it for anything else. As with any internet service, the provider carrying your connection necessarily sees the IP address it comes from. That is ordinary infrastructure exposure rather than something we collect, receive or keep.
• Anyone we are legally compelled to disclose to — a court order, or a request we are obliged by New Zealand law to comply with.

Where your information is held

Our messaging service is hosted in Singapore, on infrastructure operated by EMQX Cloud running in Google Cloud's Singapore region.

Your account record is held on Cloudflare's edge network. Cloudflare distributes processing across data centres worldwide and serves each request from a location near the user, so for users in New Zealand and Australia this is typically within the Asia-Pacific region, though it is not confined to a single country.

Because both are outside New Zealand, we rely on the protections our providers have in place — including independently audited information security and privacy management certifications — to ensure your information is subject to safeguards comparable to those required by the Privacy Act 2020, as the Act requires when personal information is disclosed offshore.

Security

Traffic between the app, our messaging service and your heater is encrypted in transit using TLS. Your heater's messaging channel uses credentials generated specifically for your account and is not shared with other users.

The app can also talk to your heater directly across your own local network, without going through our messaging service at all. That direct connection is not encrypted, because the heater's own hardware cannot offer an encrypted connection. It never leaves your local network, and is protected by whatever security your own Wi-Fi network uses. If that matters to you, use the messaging service connection rather than the direct one.

No system is perfectly secure, and we will not pretend otherwise. If a breach occurs that poses a risk of serious harm, we will notify affected users and the Office of the Privacy Commissioner as the Privacy Act requires.

How long we keep it

Your account record — the identifier from Apple or Google, any email address you shared, and the credentials linking you to your heater's channel — is kept while your account is open.

Heater readings are not retained. The connection flag described above is held only as a current value and is overwritten whenever it changes; it disappears when your heater's channel is removed.

When you delete your account we remove the account record and revoke the heater credentials within 30 days, except where we are required to keep transaction records for tax purposes.

Your rights

Under the Privacy Act 2020 you can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. We will respond within 20 working days.

You can delete your account from within the app, under Settings, or email us and we will do it for you. Separately, you can revoke the app's access at any time in your Apple ID settings on iOS or your Google Account settings on Android.

Deleting your account does not cancel your subscription — that is managed in your App Store or Google Play settings.

If you are unhappy with how we have handled your information, contact us first. If we do not resolve it, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

Children

Afterburner is not directed at children and we do not knowingly collect information from anyone under 16. If you believe a child has given us information, email us and we will delete it.

Changes to this policy

If we change what we hold or how we use it, we will update this page and change the effective date. Material changes will also be notified in the app before they take effect.

Contact