Chirp Literacy Privacy Policy

1. Scope & Our Privacy Responsibility

This Policy applies to everyone who uses Chirp Literacy — tamariki learners (through the account of the authorised school/kura or whānau who manage their profile), caregivers, specialists, and school administrators. Sky Bison Code Design complies with the New Zealand Privacy Act 2020 and its 13 Information Privacy Principles (IPPs) in how we collect, use, store, and disclose personal information. This Policy is written to be clear and practical; it is not a certification, legal opinion, or a claim that Chirp has been independently audited against every possible standard.

2. What We Collect & Why (Data Minimisation)

We collect only what is reasonably necessary to deliver and operate Chirp Literacy for the authorised school/kura or whānau account. We do not ask for unrelated sensitive identifiers such as government ID numbers, health records unrelated to literacy instruction, or financial account details beyond what a payment processor requires.

2.1. Student learning records (minimised)

Linked to a learner's profile and controlled by the authorised school/kura or whānau: progress and completion logs, phonics/module scores, response-accuracy and latency measures, and stage progression across Kākano, Tupu, Māhuri, and Rākau. A learner's first name or a display alias, locale, and in-app settings (theme, learning mode, accessibility preferences) are also needed to operate the profile itself. Voice capture and initial processing for spoken practice happen on the learner's own device; a recording is only uploaded to our servers if an adult deliberately chooses to save it — for example, when creating a custom character pack or a custom phrase recording. A–Z tile customisations, saved A–Z Board Themes and custom sentence stories are also stored server-side under the owning licence, so they appear on devices using that licence. Pictures and recordings are optional: they are uploaded only when an adult chooses to save them, and are managed by a parent, caregiver, or specialist on the learner's behalf. They are not required for Chirp's core lessons.

2.2. Adult account, billing, and support information

Caregiver, specialist, or school contact details (name, email); school licence and billing records (order, invoice, and payment status); support correspondence you send us; and technical/security logs (such as sign-in timestamps and error diagnostics) used to operate and secure the Service.

2.3. How information is collected

Most information is collected directly from the caregiver, specialist, or school who creates and manages an account, always under that school's or whānau's oversight. Some information (such as in-app activity logs) is collected indirectly as a learner uses the Service. Information marked as required in a form (for example, a learner display name, or billing details needed to complete a purchase) is necessary to create a profile or process an order; if it is not provided, we may be unable to create the profile, deliver the licence, or process payment. Optional information (such as a custom avatar or voice recording) can be skipped without affecting core access.

3. Ownership, Control & Individual Rights

Schools/kura and whānau retain ownership and control of their student data and user-created content (custom phrases, character packs, recordings). Sky Bison Code Design receives only a limited right to host and process that information for the purpose of providing, securing, supporting, and legally operating Chirp — we do not claim any broader ownership over it.

Under New Zealand law, privacy rights belong to the individual learner, not automatically to a caregiver. A caregiver or guardian does not automatically receive a child's personal information in every circumstance; requests made on a child's behalf are assessed lawfully, taking into account the child's age, maturity, and best interests, before information is released.

4. No Commercial Exploitation

Student reading profiles and literacy records are never sold, rented, monetised, supplied to data brokers, or used for third-party advertising, behavioural advertising, cross-service tracking, unrelated marketing, algorithmic profiling, or to train third-party AI models.

Where we use service providers to host data, process payments, send email, or provide customer support, they act only under our instructions and confidentiality obligations, and receive only the minimum information needed to perform that specific function. They are processors, not advertisers, and are not permitted to use student data for their own purposes.

5. Safety by Design & ST4S-Aligned Controls

Chirp has no open third-party social-networking features, no public learner profiles, no open chat, no public comments, and no stranger-to-student messaging of any kind. Access is governed by strict role and access controls built on least-privilege principles: authentication is required for every account, access can be revoked at any time, and child-facing learning functions are kept separate from adult account/settings functions (protected by a parental gate). We periodically review these controls as part of ongoing security practice.

We use the Safer Technologies for Schools (ST4S) framework and New Zealand Ministry of Education guidance as design and procurement benchmarks when building and evaluating Chirp. This Policy does not claim ST4S certification, ST4S endorsement, or a completed ST4S assessment. Schools may request Chirp's current ST4S assessment or readiness information directly from our privacy contact below.

6. Security & Storage

We apply reasonable technical and organisational safeguards appropriate to the information involved, including encrypted transport, controlled hosting environments, access logging and monitoring where applicable, regular backups, confidentiality obligations on staff and contractors, secure development practices, and secure deletion processes. No system can guarantee absolute security, and we do not make that claim.

Where information is processed by an overseas provider, we disclose this before or as required and rely on Privacy Act 2020 IPP 12 safeguards — such as the provider being subject to comparable privacy law, or acting only as our agent for storage/processing — before that transfer occurs. Schools may request current hosting and subprocessor information from our privacy contact.

7. Retention & Deletion

We keep student learning records only for as long as the authorised school/kura or whānau account or licence needs them to deliver the Service, or as required by law. When a deletion request is actioned, the record is removed from active systems immediately; it will then age out of encrypted backups in the ordinary course of our backup lifecycle rather than being retained indefinitely. We have not fixed a precise number of days for this process, as backup cycles and legal obligations can vary. A narrow set of records may be retained for longer only where required for legal, security, or dispute-resolution purposes. Where appropriate, we may de-identify information instead of deleting it outright, so it can no longer be linked to an individual learner.

8. Access, Export, Correction & Deletion Requests

A school privacy officer, an authorised school administrator, or a caregiver may request access to, export of, correction of, or permanent deletion of information at any time by emailing admin@chirp.org.nz with: the organisation or account name; the learner profile identifier or display name concerned; the type of request (access, export, correction, or deletion); and a contact we can use to verify your identity and authority to act for that account or learner.

We will verify your identity and authority before acting on a request. Exports will be provided in a commonly usable format wherever reasonably practicable. Corrections will be made, or, where we disagree with a requested correction, a statement of the correction sought will be attached to the record as required by law. Deletion requests will receive written confirmation once completed. Requests made under the Privacy Act 2020 are generally responded to within 20 working days, subject to any lawful extension or refusal grounds available to us.

Because privacy rights belong to the individual learner, requests made on a child's behalf by a caregiver or another lawful representative are handled in a way that considers the child's best interests, consistent with New Zealand Office of the Privacy Commissioner guidance.

If you are not satisfied with our response, you may escalate your concern to the New Zealand Office of the Privacy Commissioner at privacy.org.nz.

9. Disclosure, Use, Cookies & Business Transitions

We use information only for the purpose it was collected, or a directly related purpose, such as showing a learner's own progress to their authorised school/kura or whānau. We disclose information only where the Privacy Act 2020 permits — for example, where required or authorised by law, or where necessary to prevent a serious threat to health or safety.

If Chirp Literacy is ever transferred to a new operator or provider, we will take reasonable steps to ensure student and account data continues to be protected under equivalent privacy commitments, and affected schools/whānau will be notified of any material change in who is responsible for their information.

Chirp uses cookies and local/browser storage for small preferences and caches, such as light/dark mode and the High Frequency Word tray selection; a parental-gate tab session; a checkout draft without personal information; and cached content and a queued progress outbox for limited continuity until reconnect. A–Z customisations, saved Board Themes and sentence stories are not stored only on the device. We do not use third-party advertising cookies or trackers.

10. Privacy Incident & Breach Response

If we become aware of a privacy incident, we contain it, investigate its cause, preserve relevant evidence, and assess the harm it may cause — giving particular weight to the vulnerability of child users — before taking remediation steps and notifying the affected school/kura or whānau and, where appropriate, the individuals concerned.

Where a breach has caused, or is likely to cause, serious harm, Sky Bison Code Design will notify the New Zealand Privacy Commissioner and affected individuals as soon as practicable, as required by the Privacy Act 2020. Consistent with Office of the Privacy Commissioner expectations, we aim to notify within 72 hours of becoming aware that a breach is notifiable, while continuing our investigation; this is our operational target and not a restatement of the Act's own wording. Notification may be lawfully delayed or withheld where notifying itself could prejudice a child's safety or interests, or where another statutory exception applies. Where a school is involved, we coordinate with that school's privacy officer throughout the response.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or how Chirp operates. Material changes will be reflected by an updated "Last updated" date at the top of this page.

12. Contact Us

For privacy questions, or to make an access, export, correction, or deletion request, please contact:

Sky Bison Code Design
Email: admin@chirp.org.nz
Location: Auckland, New Zealand