DRAFT prepared with AI assistance, 26 September 2026. Internally reviewed against NZ law but NOT reviewed by a lawyer. Do not publish until a New Zealand lawyer has approved it. See REVIEW.md.
Deleting your My Shout data
Published at myshout.nz/data-deletion. This page is the data deletion instructions page for My Shout, run by NetPotential Limited (trading as Growth Spurt), Auckland, New Zealand. It applies to every player, including players who signed in with Google, Facebook or X.
How to delete your account
Pick any one of these. They all end in the same place.
1. In the app (fastest). Open My Account, tap Delete my account, and confirm. You will get a confirmation code on screen and a status link. Deletion starts straight away.
2. By email. Email privacy@myshout.nz from any address with the subject "Delete my account" and the mobile number you play with. We will text a confirmation code to that number, because we need to be sure it is you. Reply to the text to confirm.
3. By text. Text DELETE to the My Shout number from the mobile number you play with. We reply with a confirmation code. Text it back to confirm. (Texting STOP only stops texts; it does not delete the account.)
4. Through Facebook. In Facebook go to Settings and privacy, Settings, Apps and Websites, find My Shout, choose Remove, and tick "Delete posts, videos or events My Shout posted on your timeline" or "Send request" if it is offered. Facebook sends us a deletion request. We delete the information we received from Facebook and the link between your Facebook account and your My Shout account, and give Facebook a confirmation code and a status link which you can see in your Facebook activity log. Note: this removes the Facebook login and the Facebook data. It does not by itself delete the rest of your My Shout account, because your account is anchored to your mobile number, not to Facebook. Use options 1 to 3 for the whole account, or tell us in the same request.
5. Through Google. Go to myaccount.google.com/permissions, find My Shout and remove access. This stops Google sign-in. Google does not send us a deletion request, so also use option 1, 2 or 3 to have us delete the Google information we hold (your Google ID, name, email and picture). We will do that on any deletion request, and we also delete it if you unlink Google in My Account.
6. Through X. In X go to Settings and privacy, Security and account access, Apps and sessions, Connected apps, and revoke My Shout. As with Google, X does not tell us, so also use option 1, 2 or 3, or unlink X in My Account. When you delete your X account or content, we delete anything we hold from X within 24 hours of learning of it.
Unlinking one login without deleting the account. In My Account you can unlink Google, Facebook or X separately. We delete the provider ID, name, email and picture we got from that provider at that moment. Your account stays open on your mobile number.
What happens after you confirm
- Your account is closed immediately. You are logged out on every device, push notifications stop, and you are removed from every draw that has not yet been sealed.
- Within 10 working days we delete or anonymise everything listed under "What we delete" below.
- Backups roll off within 30 days after that.
- We email or text you when it is done, then we delete that contact record too.
- You can check progress at any time at the status link, using your confirmation code. The status page shows only "received", "in progress" or "complete".
If you sign up again later you start from scratch. Your streak, history and any unused entries are gone and cannot be restored.
What we delete
- Your mobile number (both the hashed and the encrypted copy), and the SMS logs between us.
- Google, Facebook and X IDs, names, email addresses and profile pictures we received, and the links to those accounts.
- Your display name, home region, preferences and device tokens.
- Push subscriptions.
- IP addresses and location signals.
- Your gameplay: answers, timings, scores, streaks, leaderboard positions and team board memberships. Leaderboards that already showed your display name are regenerated without it.
- Your draw salt and internal player ID, and the record linking you to your entries. See the next section for why this matters.
- Consent records, except a minimal record that you requested deletion and when.
- Sponsor marketing opt-ins. We also tell each sponsor you opted in to that the opt-in is withdrawn. The sponsor already holds the details you allowed us to pass on, and is responsible for deleting them under its own policy; you can ask the sponsor directly, and we will help if they do not act.
- Shona chat logs.
- Unused prize codes and deal codes. If you are deleting your account with an unclaimed prize, claim it first; we cannot reissue it afterwards.
What we keep, and why
Some things stay. We keep them because they are needed to keep the draw honest, to meet legal obligations, or to stop banned players coming back. None of them lets us or anyone else identify you once the rest is deleted.
The public draw log. Every draw is published in a public, permanent log so anyone can check it was fair. Your entries appear there only as leaves: a hash of the draw ID, an internal player ID, an entry number and a random secret called a salt that only we held. When we delete your salt and your internal player ID, those leaves can no longer be connected to you by us, by a sponsor or by anyone else, and there is no way to tell which leaves were yours or that any two leaves belonged to the same person. The leaves themselves cannot be removed: they are part of a fingerprint that has been published, signed and anchored on the Bitcoin blockchain, and removing any one would break every draw's proof. So the log stays and the key to it is destroyed.
Note for the lawyer: confirm that a salted hash whose salt has been destroyed is not personal information for Privacy Act purposes, so its retention is outside IPP9.
Winner records. If you won a prize, we keep a record that a person with your mobile number won that prize on that date and whether it was redeemed, for [3 years], because we must be able to show that every announced prize went to a real winner and to deal with any dispute with the sponsor. After that period the record is anonymised. If you agreed to your first name and suburb being published, we remove them from myshout.nz on deletion; we cannot recall videos or posts that other people have already shared.
Note for the lawyer: confirm the period and whether we may keep the number in hashed form only.
Fraud records. If your account was closed for breaking the terms of entry, we keep a hashed form of your mobile number and device fingerprint on a blocklist for [2 years] so the same number or device cannot re-enter. Nothing else about you is kept.
Note for the lawyer: confirm this is a lawful retention purpose, and that hashed-only retention is proportionate.
Financial and contractual records involving you, for example if a prize was paid out in cash or you are a sponsor contact, are kept for 7 years as tax law requires.
Anonymised statistics (how many people played in a region on a day, average scores, redemption rates) are not about you and are kept.
Records held by others. Sponsors you opted in to, your carrier, and Google, Facebook or X hold their own copies of some information under their own policies. Deleting your My Shout account does not delete those.
Requests from someone else
We only act on deletion requests we can tie to the mobile number on the account, or that arrive through the Facebook data deletion callback for that Facebook account. We will not delete an account on the say-so of an email address alone. If you have lost access to your number, email privacy@myshout.nz and we will find another way to check it is you.
Questions
privacy@myshout.nz, or NetPotential Limited, [POSTAL ADDRESS], Auckland, New Zealand. If you are not happy with how we handled a deletion request you can complain to the Office of the Privacy Commissioner at privacy.org.nz.