Privacy

What this site does with your data

Short version: your work is saved in your own browser, there are no trackers or analytics of any kind, and the only thing that leaves your device without you asking is an error report when something on the site breaks — with every value stripped out of it. The detail is below, in plain English.

✓

The three things worth knowing

  • Your NZQA files are never uploaded. When you import your Record of Learning, your admission slip or an exam timetable, the file is read inside your browser and never leaves your device. No copy is sent anywhere, including to us.
  • There is no analytics. No Google Analytics, no pixels, no session recording, no A/B testing, no advertising identifiers. Nobody is counting your clicks. When a page breaks, a description of the fault is sent so it can be fixed — that is the one exception, it is described in full below, and it contains nothing about you.
  • Signing in is optional. Without an account, everything stays on this device. With one, your study record is copied to your own row in a database so a second device can read it.

What is stored on your device

In your browser's localStorage , under keys beginning ncea. — which you can inspect yourself in your browser's developer tools:

  • Your name and school, if you enter them, and your profile photo if you set one. The photo is resized and stored as text on this device; it is not uploaded to any image host.
  • Your subjects, standards, credit statuses and grades — including anything imported from NZQA, and anything you type in yourself.
  • Your internals and their due dates, and the exam dates you confirm.
  • Your exam timetable, if you import or add one: subjects, dates, times, rooms, exam codes and notes. Your NSN and your name are never saved from an admission slip.
  • Study progress: which flashcard sits in which Leitner box, quiz scores and history, review flags, your streak, and which topics you have marked as reviewed.
  • Preferences: theme, level (Level 2 or Level 3), revision-session settings, which panels you have expanded, and whether you have dismissed a prompt.

Clearing your browsing data for this site deletes all of it. There is a Download a copy button on Account & settings, and taking a backup before you clear anything is worth the ten seconds.

Cookies

One, named ncea_consent . Its value is the word ack , it lasts a year, and its only job is to remember that you have seen the notice about data being saved in your browser. It is a cookie rather than a localStorage entry for one reason: clearing site data wipes localStorage, and somebody who has just cleared their data should not be shown the same notice again.

No tracking cookies. No third party sets a cookie on this site.

When something breaks

This site runs entirely in your browser, so when a page fails there is no server log anywhere — the error happens on your device and disappears with the tab. That meant faults went unnoticed for weeks, because most people reload, see it still broken, and quietly stop using the site.

So when an error occurs, five things are sent, and this is the whole list:

  • The error's message with every value removed. Numbers, web addresses, email addresses, anything that looks like an ID, and quoted text are replaced with placeholders before it is sent. The one thing in quotes that is kept is a single word naming part of the site's own code, like 'closest' below, because that is what says what went wrong. Your name, if you have entered one, is stripped out by name. What is left is the shape, like TypeError: Cannot read properties of null (reading 'closest') . If the error came from the site's own code, the file and line it happened in are added, such as js/pages/progress.js:653 — a place in the site's published code, not anything about you.
  • The page path it happened on, such as /chemistry/thermochemistry . Never the query string.
  • Which kind of failure it was — an exception, a failed download, and so on.
  • The site's version number, so it is possible to tell whether a fix worked.
  • Whether this browser tab has already reported the same fault, so that one person hitting reload forty times can be told apart from forty different people.

What is never sent: your name, your email, your NSN, your results, any part of your NZQA file, the contents of any page, a stack trace, a device fingerprint, an advertising ID, or anything that could be used to recognise you on a return visit. No identifier of any kind is attached, so two reports from the same person cannot be linked together. Errors from browser extensions, or from any other website's code running in the page, are not reported at all.

Reports are grouped by fault rather than stored one per occurrence, they are readable only by the site's administrator, and the code that does all of this is js/monitoring.js — it is short, and it is worth reading if you would rather check than take our word for it.

If you create an account

Accounts are handled by Supabase, which stores your email address and a securely hashed password — this site never sees or stores your password, not even hashed, and nothing you type into the password field is written to your device.

When you are signed in, the study record described above is copied to a single row belonging to your user id, along with the time of the last sync and a label for the device that made it (for example “Mac · Chrome”), so you can tell which device saved last. A database rule restricts every row to the account that owns it.

You can delete it: Delete my synced data on Account & settings removes the row. Signing out leaves your local copy alone.

If you connect Spotify

Entirely optional, and used for one thing: showing what is playing and letting you pause or skip while you revise. It uses Spotify's PKCE flow, which is designed so that no secret key exists in the browser at all. The access and refresh tokens are stored on your device only, and are never sent to this site's own storage or to any server of ours.

Permissions requested: read your currently playing track and playback state, read your profile, and control playback. You can revoke access at any time at spotify.com → Account → Apps, or with Disconnect on Account & settings.

Who else the page talks to

This site is a static site: there is no server of ours running any code. The page is allowed to contact only the hosts below, and that restriction is enforced by a Content-Security-Policy header rather than by good intentions:

  • Supabase — only if you sign in.
  • Spotify — only if you connect it. Album art is loaded from Spotify's image host.
  • jsDelivr and esm.sh — code libraries (maths typesetting, animation, the Supabase client). Like any CDN, these see the request for the file, which includes your IP address; they receive nothing about your study data.
  • Google Fonts — the typefaces. Same caveat: a request for a font file.
  • Vercel — the host. Standard server logs.

Video links open YouTube in a new tab. Nothing is embedded, so YouTube is not contacted until you choose to click.

Age, and who this is for

This site is for NCEA students, most of whom are under 18. That is exactly why it is built the way it is: the less that leaves the device, the less there is to lose. No personal data is sold, shared, or used for advertising — there is no mechanism here that could do any of those things.

Your choices, in one list

  • See everything held about you: Download a copy, on Account & settings. It is the whole record, in a readable file.
  • Delete the local copy: clear site data in your browser, or Reset to blank on Progress.
  • Delete the synced copy: Delete my synced data, on Account & settings.
  • Stop using Spotify: Disconnect, and revoke at spotify.com.
  • Use it with nothing stored at all: a private window works. The site will warn you that nothing will be kept.
ℹ

Changes, and how to check this is true

This page is updated whenever the site's handling of data changes, and the date below changes with it. Everything stated here corresponds to code you can read: js/store.js , js/consent.js , js/auth/session.js , js/nzqa-import.js , js/spotify/auth.js and the header list in vercel.json .

Last updated 29 September 2026 · Study Hub v1.34.0