Privacy policy · Crateclass

The short version

We only collect what we need to run Crateclass.
Students never give us an email, phone number or photo.
We never sell personal information or use it for advertising. There are no ads.
Schools stay in control of their students' information.
You can see, correct or delete your information — just ask.

Who we are

Crateclass is a New Zealand teaching service for schools and families. We follow the New Zealand Privacy Act 2020. If you have a question about privacy, contact our privacy officer using the contact form (choose "Privacy or deleting data").

What we collect

Teachers and parents

Your name, email address and password (passwords are stored scrambled — we can't read them).
Your plan, trial and payment status. Card payments are handled by Stripe; we never see or store your card number.
The classes you make, the work you set and the marks you give.
Messages you send us.

Students

A made-up display name (like SwiftKea27), a username and a password.
An optional private note their teacher or parent adds (for example their first name) — only that adult sees it.
Their class, the work they're given, their answers, scores and progress.
Their coins, crates, items, trades and character settings.

We don't collect students' email addresses, phone numbers, photos, home addresses or locations, and we don't track students across other websites.

How we use it

To run the classroom: signing in, showing work, saving results and giving rewards.
To show teachers and parents how their students are going.
To manage plans, trials and payments, and to answer messages.
To keep Crateclass safe and working — for example, pausing sign-in after too many wrong passwords.

We don't sell personal information, use it for advertising, or build profiles of students for anyone else.

Who can see it

Teachers and parents see the students in their own classes or family, and nothing else.
Students see the made-up names, characters and items of others in their class. On the Family plan, children can also see the made-up names and items of children in other families when trading. Students never see real names, notes, marks or passwords of others.
Schools that hold a licence can ask which of their teachers have accounts.
Service providers who run parts of Crateclass for us: Supabase (database and sign-in), Netlify (website hosting) and Stripe (card payments). They may store information on secure servers outside New Zealand, and may only use it to provide their service to us.
Website pieces are loaded from Google Fonts and Cloudflare (cdnjs). These services see your device's internet address when the page loads, as with most websites.
We would only give information to anyone else if the law requires it.

Cookies and storage on your device

We don't use advertising or tracking cookies. Your browser stores a few small things so the site works: that you're signed in, which class this device uses, and settings like "low power" mode. Signing out clears your sign-in.

How long we keep it

While your account is active.
If a plan ends, classes are kept for 12 months so you can come back, then deleted.
Teachers can remove students and classes at any time.
Ask us to delete your whole account and we'll do it within 30 days.
Payment records are kept for 7 years because New Zealand tax law requires it.

Keeping it safe

All connections are encrypted (HTTPS). Passwords are hashed. Every database request checks who is asking, so teachers can only reach their own classes and students only their own class. If a privacy breach ever happened that was likely to cause serious harm, we would tell the people affected and the Privacy Commissioner, as the Privacy Act requires.

Schools

When a school uses Crateclass, the school is in charge of its students' information and we look after it on the school's behalf. We'll help the school answer any request from a student or their whānau.

Your rights

You can ask to see the information we hold about you, ask us to correct it, or ask us to delete it. For a student's information, ask their teacher or school, or contact us. We'll reply within 20 working days. If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner.

Changes

If we change this policy in a way that matters, we'll tell teachers and parents by email or on the site before it takes effect.