Privacy Policy

Who we are

Budget Bird is made by Budget Bird Limited, a small New Zealand company run by Harry Cosslett (company number 7198873, NZBN 9429047206724, 1264 Fergusson Drive, Upper Hutt 5018). In this policy, "we" means Budget Bird Limited.

This policy explains what personal information we collect, why, and what we do with it, under the Privacy Act 2020 and its Information Privacy Principles.

Harry is responsible for privacy at Budget Bird (the Privacy Act calls this the privacy officer). Email him at harry@budgetbird.co.nz or use the contact page.

Teachers and schools are in charge

Budget Bird is used by teachers, and by schools with a Budget Bird for Schools licence. The teacher decides to run a class, chooses any reflection questions, and controls the class's results. We hold that information so we can provide Budget Bird to the teacher and their school. The only other thing we use it for is improving Budget Bird, using gameplay without names (see "Students" below).

If you're a parent or caregiver with a question about a particular class, the school is usually the best place to start. You're also welcome to contact us directly, and we'll help.

Students

To join, a team types in the class code from their teacher and picks a team name. That's all. Behind the scenes, the device gets a random sign-in ID so the game can save the team's progress. There's no account, no password and no email address.

For each team, we store:

• the team name;
• the budget decisions the team made, in order, and how the game turned out;
• answers to any reflection questions the teacher chose to ask;
• whether the team's device is still connected, so the teacher can see who's in;
• the kind of device it played on (say, a Chromebook running Chrome) and the size of its screen and window, so we can make sure the game displays properly. Nothing that could pick out a particular device.

A team is often a few students sharing one device, and we don't record who is in it. Nothing we ask for identifies a student. But team names and reflection answers are free text, so students could type something personal. Teachers should ask students to use made-up team names and to leave personal details out of their answers.

The device also keeps a small note of the class and team in its own browser storage, so a team that refreshes the page can carry on where they were.

We keep gameplay data: the decisions teams make and how their games turn out. It describes what happened in the game, not who played it. We use it, without team names or class names, to improve Budget Bird and the way it teaches. For example, it shows us a question that confuses students, or a choice that's too easy.

Who sees student information

The class

Team names appear on the lobby and results screens, so everyone in the class can see them.

The teacher

The teacher sees each team's results in the class report. With a Budget Bird for Schools licence, the report also shows each team's reflection answers, and the teacher can download a class summary and the teams' decisions.

Budget Bird

Budget Bird can see class data when it's needed: to help a teacher who asks for support, to fix problems, and to improve the game and its questions. It isn't used for anything else.

Other schools, through the New Zealand comparison

Results from finished classes are combined into New Zealand-wide averages, so a class can see how its choices compare. These are totals and averages only. They never include team names, answers, or which school or class the results came from.

The school, through its school page

A school's page shows how many classes, students and hours have been played. It never shows team names or answers.

Teachers

When a teacher creates an account, we collect:

• their name and email address, plus either a password (held by Google's sign-in service, which we can never read) or their Google sign-in;
• optionally, a profile photo and the subjects they teach;
• the classes they create: class names, settings, questions, and the results their classes produce;
• when they last signed in, and how they found us if they followed a referral link.

We use this to run Budget Bird, keep your classes and reports, help you when you ask, and send service emails about your account. We also use it to work out which school you belong to (see below).

Your profile photo is stored at a web address that isn't published anywhere, but anyone who has that address can view it. It appears only in your own account.

Schools and school leaders

If your verified email is on your school's email domain (for example @yourschool.school.nz), or your school has added your exact address, your teacher account is linked to that school. We never link schools through personal email providers like Gmail or Outlook.

Teachers linked to a school can see the school licence and billing details, including who bought it and the accounts contact.

A teacher can share the school page with a principal or a colleague. Anyone who has the link can view it. It shows the school's totals, the names of its three most recent classes, teachers' initials, and the name of the teacher who shared it. It never shows email addresses, photos or student information.

When a school buys a licence, we collect the buyer's name, role and email address. If the school pays by invoice, we also collect its legal name and invoice email, and optionally a PO number, accounts contact and address. We record which version of the terms the buyer agreed to, and when.

Payments

Stripe handles payments. Card numbers are entered on Stripe's own checkout page and never reach us. We see only that a payment went through, plus the details we need for a receipt or invoice. Stripe handles that information under its own privacy policy.

Emails

We email teachers about their account:

• a welcome email;
• a summary after a class, which includes the top three team names;
• a one-off reminder if you haven't run a class yet;
• billing emails such as invoices, renewal reminders and receipts.

Now and then we also send news about Budget Bird. Every email except billing has an unsubscribe link, with separate switches for class updates and for news. Unsubscribing never affects the service. Billing emails can't be switched off while a school has a licence.

If a teacher emails the school page to a colleague, we send it for them. We don't send it to anyone who has unsubscribed.

Analytics, cookies and advertising

We don't set any cookies of our own. Your sign-in is remembered in your browser's storage. Google Analytics and Meta set their own cookies, and only on the live site.

Our own records (teacher and public pages only)

On our own servers, we record which Budget Bird pages are visited and what's clicked on the school and purchase pages, including when a shared school page is opened from a teacher's link, and when the Budget Bird for Schools offer is shown or clicked in the teacher app. We use a random ID kept in your browser's storage (not a cookie). We also keep how a teacher first found us: the campaign tags in the link and the referring site's address. This helps us understand how schools decide to buy, and make that easier. It's never used for advertising and never recorded on student pages. Visits that never lead to an account or a purchase are kept for up to two years.

Google Analytics (teacher and public pages only)

Shows us which pages are used and where people get stuck, so we can improve Budget Bird. It records page visits and actions against a random ID in a cookie.

For signed-in teachers, we also send the account's internal ID, never the email address.

It never runs on student pages: not on the join screen, in the game or on the reflection questions. Students' devices never load it.

Meta Pixel and Conversions API (teacher and marketing pages only)

Lets us measure whether our Facebook and Instagram ads work, for example whether someone who saw an ad went on to sign up.

For signed-in teachers, Meta receives a scrambled (hashed) copy of the email address, so it can match the action to the ad.

It never runs on the join screen or in the game. Meta never receives student information, class results, reflection answers, or a readable email address.

Google Fonts and YouTube

Our typeface loads from Google Fonts. The video on the teachers page uses YouTube's privacy-enhanced mode and doesn't load until you press play.

If you'd rather not be measured, browser tracking protection or an ad blocker stops these tools, and Budget Bird works just the same. You can also use Google's opt-out and your Meta ad settings.

Other companies we use, and where data is stored

We use these providers to run Budget Bird:

• Google Firebase and Google Cloud: hosting, sign-in, the database, file storage and our server code.
• Stripe: card payments and invoices.
• SendGrid (Twilio): sending emails, and telling us whether they were delivered or opened.
• Google Analytics and Meta: as described above.

Our database, file storage and server code are in Google Cloud's Sydney, Australia region. Some processing happens elsewhere: the small parts of our server code that receive messages from Stripe and SendGrid, and handle email unsubscribes, run in Google's US data centres, and Stripe and SendGrid are based in the United States. Each provider is a major company bound by contract to protect the information, and we choose providers whose protections are comparable to New Zealand's.

We don't sell personal information, and we don't share it with anyone else unless the law requires it.

Keeping it safe

Everything travels over encrypted connections. Security rules control who can read the database, and only Budget Bird can see account data. No system is perfect. If we ever have a privacy breach that's likely to cause serious harm, we'll tell the people affected and the Privacy Commissioner, as the Privacy Act requires.

How long we keep things

We keep a teacher's account, classes and reports while the account exists, so teachers can go back to earlier classes and see how their students compare over time. We don't delete them automatically.

We keep gameplay data so we can keep improving Budget Bird, as described under "Students". It doesn't identify anyone, and we use it without names. Results in the New Zealand averages are anonymous totals that can't be traced back to a class.

We keep billing records for seven years, as New Zealand tax law requires.

Your rights

Under the Privacy Act 2020 you can ask to see the personal information we hold about you (Information Privacy Principle 6), and ask us to correct it if it's wrong (Principle 7). Email harry@budgetbird.co.nz and we'll reply within 20 working days. We may need to check it's really you first.

Teachers can also ask us to close their account. Once it's closed, you can't sign in and we stop emailing you.

Students don't have accounts, so we usually can't tell which team was which student. If a student or parent wants to see or correct something, the teacher can help us find the right class and team.

If you're not happy with how we've handled a privacy matter, please tell us first and we'll try to put it right. You can also complain to the Office of the Privacy Commissioner.

Changes to this policy

We'll update this policy when the way Budget Bird works changes. If a change matters, we'll update the date at the top and email account holders before it takes effect.