Privacy notice

Draft for review (version 2026-09-draft). This notice describes how the accounts system is built. It will be reviewed before accounts open to the public.

Learn It With Me is a teaching resource site run from Auckland, New Zealand, as part of the Russell Education Foundation. Everything on the site can be used without an account. If you do create one, this notice explains what we keep, why, and what you can do about it. We follow the New Zealand Privacy Act 2020 and its information privacy principles.

If you don't have an account

We don't know who you are. Like most websites, the site uses Google Analytics to count visits and see which pages are used, and it may show adverts. Games that have a high-score table store the initials you type and a record of the game used to check the score is genuine.

What we keep when you create an account

• Your email address and name — to sign you in and to show your name to you (and to your teacher, if you join their class). A first name or nickname is fine.
• Whether you are a student, teacher or school, and for a school, its name.
• How you sign in: a password (stored only as a one-way Argon2id hash, which even we can't reverse), the public half of any passkey, and the account id of any Google or Microsoft account you link.
• Your settings, such as which languages the Key Terms lists show.
• A security log of sign-ins and changes to your account, with the device type (for example "Chrome on Windows") and IP address.
• What you agreed to: the version of this notice you accepted, and for students, the age or permission confirmation.

We don't ask for your date of birth, address, phone number or photo, and we never store payment card details.

How it is protected

• Every connection to the site uses HTTPS, and the connection between the website and its database is encrypted too.
• Your email address, name, linked-account ids and IP addresses are encrypted (AES-256-GCM) before they are stored, so a copy of the database on its own would not reveal them.
• Sign-in codes, links and session cookies are stored only as keyed hashes, and codes and links work once, for a few minutes.
• Repeated wrong passwords or codes are slowed down and then blocked for a while.
• Account pages don't run analytics or adverts.

Who can see it

Only you, and the site administrator where needed to run and support the site. When classes are added, your teacher will see your name and your work in their class. We don't sell personal information or share it with advertisers. Signing in doesn't change the adverts you see. Emails are sent through our email provider, and if you sign in with Google or Microsoft, that company knows you used your account to sign in here.

How long we keep it

• Unused sign-in codes and links: deleted within a day of expiring.
• IP addresses: erased after 30 days.
• The security log: 12 months.
• Your account: until you delete it. Accounts unused for two years will be flagged, and we'll email before removing any.
• When you delete your account, everything connected to it is deleted straight away, apart from security-log entries, which lose any link to you.

Your choices

From your account page you can download everything we hold about you, correct your name, remove sign-in methods, sign out other devices, or delete your account. You can also ask us to correct or explain anything we hold. If you're not happy with how we've handled your information, you can complain to the Office of the Privacy Commissioner.