Your documents and your privacy.

Updated 2 October 2026.

Unpack exists to keep your property documents in one place. This page says what we keep, for how long, who can see it, and what we never do with it. It is written to be read, not skimmed past.

What we keep

• The emails you forward to files@unpack.nz, as received, and every document we pull out of them or fetch from a real estate agent’s portal link. Each message is listed on the property page it built, where you can read it as plain text or download the original.
• Any file you drop onto your property page yourself.
• Your email address, which is your account. There is no password. If you add them on your account page, we also keep your first and last name and your phone number, used only to register with portals that ask for them, and the theme you chose.
• The replies we send you, so that a reply to one of them can be matched to the right property.
• What you write to support@unpack.nz, send from the support page or send from the feedback box on a property page, and our answers, so a conversation stays together.
• What happens on your pages, so we can see what helps and what gets in the way: which pages and documents are opened or downloaded, what is changed, and which buttons are pressed, with the time and the kind of device. A cookie holding a random number joins up one browser’s visits. Nothing you type into a note or a name is recorded, and none of it goes to Google or anyone else. When someone opens a page you have shared, we record that the link was used, not who they are. It is deleted with the page, or after 13 months.

For how long

A property page and everything on it is deleted six months after it was last touched. Forwarding another email about the property, opening the page, or adding a file all count as touching it. If you have bought the house, download the zip and keep your own copy.

A page that never held a document is deleted once nobody has touched it for 14 days.

A forwarded email is deleted six months after it arrived, on its own clock. On a page you have kept alive for longer than that, the documents stay and the message that brought them drops off the list.

Your account stays until you delete it. If all your properties are deleted because nobody used them, your account goes with them.

A support conversation is deleted a year after it was closed.

Who can see a page

• Each page belongs to the address that forwarded the email. Two buyers looking at the same house get two separate pages and never see each other’s documents.
• A property page opens only for you. The link to it in our emails opens that one property on the device you open it on, and nothing else.
• To show someone the documents, press Share on the page. That makes a read-only link to the documents, and to your notes if you tick the box. It never shows your emails or your other properties. You can turn a share link off at any time.
• You can hide any email on the page by pressing Hide beside it. Shared links never show your emails either way. Hiding is not deleting: we keep the original until six months after it arrived, then delete it as usual. To have it deleted sooner, ask on the support page.
• To see all your properties in one place, sign in with your email address. We email you a six-digit code and a link; there is no password. Anyone can sign in, and an address we haven’t seen before starts an empty account. That browser stays signed in until you sign out, sign out your other devices, or don’t visit for 400 days.
• If one of our emails reached the wrong person, use “Replace the links in our emails” on your account page. We email you a button that replaces every link we have sent you and signs out every other device. To end other sessions without changing the links, use “Sign out of other devices”.
• We reply to a forwarded email only when it passes the standard sender checks (SPF or DKIM). A forged message from your address is parked, not processed, so nobody can use your address to read or replace your documents.

What we do with the files

• We sort documents by their filenames. For the few names that give nothing away, we send the filename alone to Google’s Gemini, on a tier where Google may use what it is sent to improve its models. Document contents are never sent.
• When a link goes to a portal we don’t read yet, we look for ordinary document links on that page. No AI model sees portal pages.
• We use the documents, filenames and portal links sent to Unpack to teach our system to recognise and sort documents, to read portals it hasn’t come across before, and to improve the service.
• One portal, PropertyFiles, releases its files once you give it a name and phone number. For that portal only, we register on your behalf, once, with the name and phone you give us by reply or on your account page, and tell you we have done so.

Where it is stored

Documents and raw emails are stored with Cloudflare R2 in the Asia-Pacific region. The application runs on a server in Sydney. Outbound email goes through Amazon SES in Sydney, with Resend kept as a backup.

Two other services see a little: Google’s Gemini sees the filenames described above, and LINZ (Land Information New Zealand) is asked to complete a property’s address from the address in the email.

Visitor statistics

This page, the home page, the terms and the support page use Google Analytics to count visits: which pages are read, which site or campaign sent the visitor, the rough area and the kind of device. It sets its own cookies to do that. Property pages, shared pages, Your properties, your account page and the sign-in page don’t load it (what happens there is recorded by Unpack itself, as above), so the address of a property and the link to it never reach Google. The sample property page doesn’t load it either: Unpack itself records that it was opened, with the campaign named in the link that led there and the kind of device, and sets the same random-number cookie. To opt out, block the script or use Google’s opt-out add-on.

Deleting things early

Every page has a Delete this page link at the bottom, and your account page has Delete everything. You can also reply “delete” to any email we have sent you, or ask on the support page from the address you forwarded from.

Only you can see those links: people you share a page with get a read-only view. The link shows what will go, and nothing is deleted until you press the button. We then delete the page, its documents, your notes and the emails it was built from, and confirm by email. Delete everything also removes your account: your email address, name, phone number and settings.

Copies in our nightly database backups age out within 30 days. If we registered with a real estate agent’s portal for you, the agent keeps the details you gave them.

Questions

Unpack is made in Wellington, New Zealand. Ask on the support page, or write to support@unpack.nz.