Privacy policy

Your answers stay with you

When you take a check-in, your individual answers are worked out on your own device and then they're gone — they're never sent to us and never saved anywhere. What we keep is your result for each area: a band (like "Tracking Well") and a score. The score is an average, so it can't be turned back into the answers you gave. In the teen module, anything you type into a free-write space (like a brain dump) stays on your device too — it's never sent or stored.

What we keep

• Your email, so you can sign in — we send you a one-time link, so there's no password to remember or store.
• Your first name, if you give us one, so the tools can greet you. You can change or clear it anytime.
• Your results — a band and score for each area — and the dates of your check-ins.
• Your progress in a learning module — which parts you've done, a couple of confidence ratings, how useful you found each tool, and any structured plan you build (for example your go-to tools or a safe adult to talk to).
• If you're a young person using the teen module: your date of birth — only in that module, only to know whether a parent or guardian needs to say okay — and, if you're under 14, a parent or guardian's email so we can ask for their okay.
• Basic technical information needed to run the service securely, such as sign-in events.

That's it. We don't keep your answers, we run no advertising and nothing that tracks you as a person, and we don't collect anything from your device, your social media, or your work. On the adult pages we count visits with a cookie-free service that doesn't identify anyone (Plausible, listed below); the teen programme doesn't use it at all.

Why we collect it

We use this information to give you an account, show you your results and progress over time, provide the check-ins and learning content, keep the service secure, and meet our professional and legal obligations. We do not sell your information, and we never use it for advertising.

Only you can see your results

Your results are health information, and they're private to you. No one at 3 Big Things browses individual results — there's no staff dashboard for them; the only time anyone could reach a single person's record is a deliberate, logged "break-glass" step. Your employer can't see your results, and neither can anyone else. We don't share them.

Young people, parents and schools

The teen anxiety module (Learning What Helps) is built for young people and may be offered through a school. We handle their information with particular care:

• Age check. Everyone enters their date of birth. If they're under 14, they can't start on their own — we ask for a parent or guardian's email and only continue once that adult approves.
• A parent's approval, not a window in. That approval covers taking part only. A parent doesn't get to see the young person's answers, ratings or plan.
• Schools never see individuals. A school or organisation access code simply unlocks the tool. The school can't see who did what, or anyone's results. The only thing we ever share with a school is how many people are using it. When that's a small group we say "fewer than 10" rather than a number, so no one can be picked out.
• Free-writing never leaves the device. The spaces where a young person types freely are theirs alone — that text is never sent or stored.

Who helps us run it

We don't sell or share your information. A few trusted providers help us run the service, and only ever handle the minimum they need:

• Supabase — our database and sign-in, hosted in Sydney, Australia. This is where your account and results are stored.
• Amazon Web Services — sends our emails (your sign-in links and the occasional notice) from Sydney, Australia. It only ever sees your email address, never your results.
• Netlify — hosts the app itself (the pages and code your browser loads).
• Mux — plays video where a tool includes it. It handles video playback only, not your account or results.
• Plausible — counts visits and a few steps (like "sign-in link sent" or "check-in started") on the adult pages, so we can see where the tools are hard to use. It uses no cookies, doesn't identify you, and never receives your answers, results or email. Its servers are in the EU. It is not used in the teen programme.

Some of these providers store information outside New Zealand — mainly in Sydney, Australia. Where that happens we take reasonable steps to ensure comparable safeguards, as the Privacy Act 2020 requires. We otherwise only disclose your information where you've agreed, or where the law requires or permits it — for example, a serious and imminent risk to someone's safety.

Where it's kept, and for how long

Your account and results are held in Supabase in Sydney, Australia, and don't leave that region. We keep your information for as long as you're using the tools. If an account goes quiet for about two years, we email a heads-up, wait 30 days, and then delete it automatically — no one has to remember to. And you can delete everything yourself, anytime.

Your choices

• See and update your details and results whenever you like.
• Download your data as a file from your account settings. (It won't include your individual answers — because we never stored them.)
• Redo a check-in if things have changed.
• Delete your account and everything in it — across every 3 Big Things tool — instantly, from your settings.

Under the Privacy Act 2020 you can also ask us what personal information we hold, for a copy of it, to correct it, or to delete information we no longer need. Just contact us below — we respond within 20 working days, as the Act requires, normally at no charge.

Keeping your information safe

Everything travels over an encrypted (HTTPS) connection, and access is locked down so that you can only ever reach your own rows — this is enforced in the database, not just the screens. Your results are also kept separate from your identity, so a set of results on its own can't be tied back to a person. To be straight with you: we don't separately encrypt results at rest — the protection comes from that own-rows-only rule, the identity separation, keeping data in one region, and your ability to delete it yourself. No system is ever completely secure, but if a breach ever posed a risk of serious harm we'd tell you and the Office of the Privacy Commissioner, as the law requires.

Changes to this policy

We may update this policy from time to time. The current version is always the one on this page, and the date at the top shows when it last changed.

Questions or complaints

For anything about your privacy, contact our Privacy Officer, Trudi Ashcroft, at contact@3bigthings.co.nz or 0800 324 484 — 3 Big Things Ltd, 1 Ara O Ngati Koata, Richmond, New Zealand. Please give us the chance to put things right first. If you're not satisfied, you can raise it with the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.