Privacy notice

Version 2026-10-09.1 · in effect from 9 October 2026

Learn It With Me is a teaching resource site run by Learn It With Me Limited (NZBN 9429054012622), Auckland, New Zealand, which holds the information described here. Everything on the site can be used without an account. If you do create one, this notice explains what we keep, why, where, and what you can do about it. We follow the New Zealand Privacy Act 2020 and its information privacy principles, and we design the site to the standard of the EU's General Data Protection Regulation as well.

In short

• There are no adverts, and we never sell personal information or use it for marketing.
• We collect only what's needed to run accounts, classes and subscriptions. We don't ask for a date of birth, address, phone number or photo.
• Names, email addresses and IP addresses are encrypted before they're stored.
• We count page views ourselves, without cookies, and your browser only ever talks to this site: no analytics or advertising company sees you.
• You can download or delete everything about you from your account page.

If you don't have an account

We don't know who you are. To show prices in your currency (and greet you in your language), we look up which country your IP address is in, in our own copy of DB-IP's country list on our own server: the address isn't stored for this, or sent anywhere. If you choose a different country on the pricing page, that choice is kept in a cookie in your browser for a year.

We count the pages people look at ourselves, to see which resources are used: for each page, its address (never the part after a "?"), the page you came from, and whether you're on a computer, tablet or phone. To tell how many people visit, your browser is given a code made from its IP address and browser name with a secret key that changes every day and is then deleted: we can count you for that day, but never recognise you on another day or work out your address from it. We don't use cookies for this, and don't use Google Analytics or any other outside service. Games with a high-score table keep the initials you type, your score, and a record of the game used to check the score is genuine, with your IP address for 30 days (to stop cheating).

If you use the site without signing in, the time counter in the footer is kept only in your own browser and is never sent to us. The home page sets one small cookie, liwm-clip, holding a random number, so you keep seeing the same video on each subject card until you close your browser. It says nothing about you and isn't used for anything else.

What we keep when you create an account

• Your email address and name: to sign you in and to show your name to you (and to your teacher, if you join their class). A first name or nickname is fine.
• Whether you are a student or a teacher, and for teachers, whether you're one of your school's admins.
• A three-letter leaderboard code (by default the first three letters of your family name, which you can change). It is what appears on the leaderboards; only people in your own school can also see your name.
• Your school and classes: which school and classes you belong to. For a school, its name, website, Ministry of Education number, and the email domains its teachers and students use.
• Your scores in the games, saved automatically under your leaderboard code.
• The pages you look at while signed in, as above but with your account, its type and your school, so we can see how the site is used and which resources lead people to sign up or subscribe. Only our site administrator sees it, in totals, never your teachers.
• What you use while signed in: which interactives and games you open, how long you spend on each (counted only while the page is open and in use, in total and day by day), how many times you play each game, a dated trail of these activities, and some of what you do inside them: for example each transmission you complete in Bits on the Wire, or whether you got each challenge question right first time.
• How you sign in: a password (stored only as a one-way Argon2id hash, which even we can't reverse), the public half of any passkey, and the account id of any Google or Microsoft account you link. If you sign in with Google, also the web address of your Google profile picture, so it can be your picture in the site's header. Only you see it, the picture itself stays with Google, and the address is removed when you unlink Google or delete your account.
• Your settings, such as which languages the Key Terms lists show, and your country (you choose it when you sign up), so we show prices in your currency.
• A security log of sign-ins and changes to your account, with the device type (for example "Chrome on Windows") and IP address.
• What you agreed to: the version of this notice you accepted, and for students, the age or permission confirmation.
• If you subscribe: your plan, the amount and currency, the country your card is from (international prices differ), Stripe's references for you and your subscription, when it renews or ends, and a copy of each invoice (encrypted). Never your card details.
• For a school that pays: the billing details its admins give (who invoices go to, the accounts email address, the postal address, its GST number and any purchase order number), encrypted, and the invoices sent to it to pay by bank transfer.
• If you contact us through the support page: your name, email address and message (encrypted), and your school if you're signed in.

We use this information only to provide the site to you and your school: to sign you in, run classes, assignments, gradebooks and leaderboards, take payments, answer you, and keep the site secure. We don't profile students, make automated decisions about anyone, or use what students do for anything but their own learning and their teachers' view of it.

Students and schools

The site is made for school students, so we keep what we collect about them to a minimum. Students under 13 confirm, when they create an account, that a parent, caregiver or teacher has said they can. When a school uses the site with its classes, the school decides how its students use it, and we look after their information on the school's behalf, as set out in our school data agreement.

Before students can join a school's classes, we check the school: that the person registering uses the school's own email domain, that its website is real, and for New Zealand schools, its entry in the Ministry of Education's public Schools Directory. A site administrator then approves it. When a teacher asks to join a school that is already registered, we email the school's admins to confirm they teach there, and tell them the teacher's name and email address.

If you leave a class, or its teacher removes you, the class's teachers no longer see your information; your account and its history stay yours. A school that stops using the site can ask us to delete its students' and teachers' accounts: we do it within 30 days of the school confirming the request.

Who can see it

Only you, and our site administrator where needed to run and support the site, with these exceptions:

• Your teachers see your name, email address and leaderboard code in their class list, and your name and email address next to your code on the leaderboards (see below).
• Your teachers also see what you do on their class's subjects, from when you joined the class: your time on each of those subjects' resources and how many times you played each game, and for work they set you, how far along you are and your grade. They don't see what you do on other subjects, or anything from before you joined.
• Everyone in your school (its teachers and students) can see your name by pointing at, or tapping, your leaderboard code on any leaderboard: the public, class and school ones; its teachers also see your email address. If a score of yours is rejected (it failed the checks), its teachers can see your name on the list of rejected scores. Our site administrators who handle support also see which school you are in, and who sent each rejected score and why it failed.
• Everyone else (people in other schools, or not in a school) sees only leaderboard codes and scores on the public leaderboards, and whether a score is from a visitor, a user not in a school, or someone in another school: never your name, email address or which school.
• Your school's admins see its teachers' names and email addresses, its classes, and its subscription and invoices.

The companies that help us run the site

These companies process information for us, only to provide their service, under their own security and privacy commitments. We don't share information with anyone else, unless the law requires it.

• DreamHost (United States) hosts the website, its database and our backups: everything described here, with names, email addresses and IP addresses encrypted.
• Google Workspace (United States and elsewhere) sends the site's emails (sign-in codes, notices, receipts): your email address and the email's content.
• Stripe (United States and elsewhere) takes card payments and runs subscriptions and invoices: your name, email address, card details (entered on Stripe's own page) and payments.
• Google and Microsoft (United States and elsewhere), if you choose to sign in with their accounts: they know you signed in here.

Outside data some resources show (World Bank figures, flags, exchange rates, maps) and the site's fonts are fetched by our server, so those services never see you.

Sending information overseas. Our hosting is in the United States, which the Privacy Act counts as sending information overseas. We do it because the site needs these services to run, we choose providers that protect information to a standard comparable to New Zealand's, and we encrypt the most personal information ourselves before it's stored, with keys that stay in our own configuration and never reach a database or a backup.

How it is protected

• Every connection to the site uses HTTPS, and the connection between the website and its database is encrypted too.
• Your email address, name, linked-account ids, IP addresses, support messages and invoice copies are encrypted (AES-256-GCM) before they are stored, so a copy of the database on its own would not reveal them.
• Sign-in codes, links and session cookies are stored only as keyed hashes, and codes and links work once, for a few minutes.
• Repeated wrong passwords or codes are slowed down and then blocked for a while.
• Site and school admins must sign in with a passkey (two factors) to use their admin powers.
• The site's pages may only load code from the site itself (a strict Content Security Policy), and they don't use outside analytics or advertising services.
• Database backups are kept for 90 days and stay encrypted the same way.

If information we hold is ever lost, seen or changed by someone who shouldn't have it, and it's likely to cause serious harm, we'll tell the people affected (and their school) and the Office of the Privacy Commissioner as soon as we practicably can, as the Privacy Act requires. More on how we look after security is on our security page.

How long we keep it

• Unused sign-in codes and links: deleted within a day of expiring.
• IP addresses (including those recorded with game scores): erased after 30 days.
• The activity trail: 24 months. Your totals (time on each resource, games played) are kept while your account exists.
• The security log: 12 months.
• Support messages: 24 months after they're answered.
• Payments and invoice copies: 7 years, as New Zealand tax law requires, even if the account is deleted (without the link to it).
• Page counts: 13 months.
• Game scores that were rejected (they failed the checks): 12 months. Accepted scores are kept on the leaderboards.
• Backups: 90 days.
• Your account: until you delete it. An account nobody has signed in to or used for two years is deleted: we email a week before, and signing in keeps it.
• When you delete your account, everything connected to it is deleted straight away, apart from payment records (above) and security-log entries, which lose any link to you. It leaves our backups within 90 days.

Your choices and rights

From your account page you can download everything we hold about you, correct your name, remove sign-in methods, sign out other devices, or delete your account. You can also ask us to see or correct anything we hold, or to explain how it's used: write to our privacy officer through the support page (choose "Privacy"). We'll answer within 20 working days. A parent or caregiver can ask on behalf of their child.

If you're in the European Union or the United Kingdom, you have the same rights under the GDPR, including to have your information deleted, to take a copy with you, and to object to how it's used. We use your information to provide the service you or your school asked for, and for its security.

If you're not happy with how we've handled your information, please tell us first. You can also complain to the Office of the Privacy Commissioner.

Changes to this notice

If we change what we collect or how we use it, we'll update this notice and its version, and tell account holders by email before a significant change takes effect. The terms of use cover the rest of the rules for using the site.