Privacy Policy

He Kupu Māori (hekupu.maori.nz) is committed to protecting your privacy. This policy explains what information we collect, how we use it, and your rights.

What we collect

If you use the site as a guest

We store an anonymous session token in your browser's local storage. This is used solely to remember your progress so it can be transferred to an account if you choose to register. We do not collect your name, email address, or any identifying information.

If you create an account

We collect:

• Your display name
• Your email address
• A hashed (not plain-text) password, if you register with email
• Your Google account ID and email, if you sign in with Google

Learning activity

We store your lesson progress, quiz results, vocabulary review history, and streak data. This information is used only to personalise your learning experience — we do not sell or share it with third parties.

Technical data

When you use the site, our server logs standard information including your IP address, browser type, and pages visited. These logs are used for debugging and security purposes and are retained for a maximum of 30 days.

How we use your information

• To provide and personalise your learning experience
• To send email verification and password reset emails
• To maintain your streak and progress across sessions
• To improve the site based on aggregate, anonymised usage patterns

We do not send marketing emails, show advertising, or sell your data to anyone.

Google Sign-In

If you choose to sign in with Google, we receive your name, email address, and Google account ID from Google. We use this only to create and identify your account. We request only the minimum permissions needed (email and profile). For information on how Google handles your data, see Google's Privacy Policy.

Cookies and local storage

We use a session cookie to keep you logged in, and browser local storage for the guest session token. We do not use advertising cookies or third-party tracking.

Data retention

Your account and learning data is retained for as long as your account is active. You may request deletion of your account and all associated data by contacting us. Guest session data is automatically deleted after 30 days of inactivity.

Your rights

You have the right to access, correct, or delete your personal data. To make a request, contact us at the address below.

Contact

If you have questions about this policy, please contact us via the contact page.

Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects when it was last revised. Continued use of the site after changes constitutes acceptance of the updated policy.