Privacy notice

Draft for review (version 2026-09-draft.2). This notice describes how the accounts system is built. It will be reviewed before accounts open to the public.

Learn It With Me is a teaching resource site run from Auckland, New Zealand, as part of the Russell Education Foundation. Everything on the site can be used without an account. If you do create one, this notice explains what we keep, why, and what you can do about it. We follow the New Zealand Privacy Act 2020 and its information privacy principles.

If you don't have an account

We don't know who you are. Like most websites, the site uses Google Analytics to count visits and see which pages are used, and it may show adverts. Games that have a high-score table store the initials you type and a record of the game used to check the score is genuine.

What we keep when you create an account

• Your email address and name — to sign you in and to show your name to you (and to your teacher, if you join their class). A first name or nickname is fine.
• Whether you are a student, teacher or school.
• A three-letter leaderboard code (by default the first three letters of your family name, which you can change). It is what appears on the public leaderboards; your name never does.
• Your school and classes: which school and classes you belong to. For a school, its name, website, Ministry of Education number, and the email domains its teachers and students use.
• Your scores in the games, saved automatically under your leaderboard code.
• What you use while signed in: which interactives and games you open, how long you spend on each (counted only while the page is open and in use), how many times you play each game, and a dated trail of these activities.
• How you sign in: a password (stored only as a one-way Argon2id hash, which even we can't reverse), the public half of any passkey, and the account id of any Google or Microsoft account you link.
• Your settings, such as which languages the Key Terms lists show.
• A security log of sign-ins and changes to your account, with the device type (for example "Chrome on Windows") and IP address.
• What you agreed to: the version of this notice you accepted, and for students, the age or permission confirmation.

We don't ask for your date of birth, address, phone number or photo, and we never store payment card details.

Checking schools and teachers

Before students can join a school's classes, we check the school: that the person registering uses the school's own email domain, that its website is real, and for New Zealand schools, its entry in the Ministry of Education's public Schools Directory. A site administrator then approves it. When a teacher asks to join a school that is already registered, we email the school (or another of its teachers) to confirm they teach there, and tell them the teacher's name and email address.

If you use the site without signing in, the time counter in the footer is kept only in your own browser and is never sent to us.

The home page sets one small cookie, liwm-clip, holding a random number, so you keep seeing the same video on each subject card until you close your browser. It says nothing about you and isn't used for anything else.

How it is protected

• Every connection to the site uses HTTPS, and the connection between the website and its database is encrypted too.
• Your email address, name, linked-account ids and IP addresses are encrypted (AES-256-GCM) before they are stored, so a copy of the database on its own would not reveal them.
• Sign-in codes, links and session cookies are stored only as keyed hashes, and codes and links work once, for a few minutes.
• Repeated wrong passwords or codes are slowed down and then blocked for a while.
• Account pages don't run analytics or adverts.

Who can see it

Only you, and the site administrator where needed to run and support the site, with these exceptions:

• Your teachers see your name, email address and leaderboard code in their class list, and your name next to your code on their class and school leaderboards.
• Other students in your class or school see only your leaderboard code and best scores on the class and school leaderboards.
• Everyone can see the public leaderboards, which show leaderboard codes and scores only.
• Your school's account (if your school registered itself) sees its teachers' names and email addresses, and its classes.

We don't sell personal information or share it with advertisers. Signing in doesn't change the adverts you see. Emails are sent through our email provider, and if you sign in with Google or Microsoft, that company knows you used your account to sign in here.

How long we keep it

• Unused sign-in codes and links: deleted within a day of expiring.
• IP addresses (including those recorded with game scores): erased after 30 days.
• The activity trail: 24 months. Your totals (time on each resource, games played) are kept while your account exists.
• The security log: 12 months.
• Your account: until you delete it. Accounts unused for two years will be flagged, and we'll email before removing any.
• When you delete your account, everything connected to it is deleted straight away, apart from security-log entries, which lose any link to you.

Your choices

From your account page you can download everything we hold about you, correct your name, remove sign-in methods, sign out other devices, or delete your account. You can also ask us to correct or explain anything we hold. If you're not happy with how we've handled your information, you can complain to the Office of the Privacy Commissioner.