Privacy
Statement

Tohu is a grade tracker for New Zealand students, at tohu.kiwi, www.tohu.kiwi and app.tohu.kiwi. In this statement “Tohu”, “we” and “us” mean that person or business. You can reach us at hello@tohu.kiwi for any queries and requests.

This statement explains what personal information Tohu collects, why, who can see it, where it is kept, and your rights over it. It applies to students, teachers, and anyone given access to someone else’s record. We follow the Privacy Act 2020, including the information privacy principles in section 22.

The short version

• Your record is yours. Every account is walled off from every other at the database level.
• Nobody else sees your record unless you let them in: a helper you choose, your school if you join it with its code, a teacher whose exam code you type, or an AI app you connect. The one exception is the Tohu site admin, explained in section 5.
• Files you send or share are deleted automatically 24 hours after you send them. A file you share by link can be opened by anyone who has the link until then.
• We don’t sell your information, show you ads, or use your grades for anything except running Tohu for you.
• If you buy something in Tohu, such as Tohu PLUS, Stripe takes the payment on its own page. Tohu never sees your card details (section 5).
• Your information is stored by cloud providers that may be outside New Zealand (section 6).
• You can see, get a copy of, correct or delete your information for any reason at any time. Email hello@tohu.kiwi.

We collect only what Tohu needs to count your record the way NZQA or your university counts it. You choose almost everything you enter; the account details are the only part we require.

We don’t ask for your National Student Number, NZQA login, date of birth, phone number, home address or photo, and you shouldn’t put them in notes or titles. Tohu uses only essential sign-in cookies, not advertising or tracking cookies. Stripe’s payment pages, which you only reach if you choose to buy something, set Stripe’s own cookies under Stripe’s policy. Tohu’s cloud services may log when certain Tohu services are used, but all analytics collected are anonymised and can never be tracked back to any one individual or group of individuals.

Most of it comes from you. Some of it comes from other people, and the law (information privacy principle 3A) says we must tell you when that happens. This statement is how we tell you, in advance, each time it can happen:

We don’t buy information about you, or collect it from your school’s, NZQA’s or your university’s systems. Tohu has no connection to them: anything a teacher puts in your record, they type in themselves.

We use your information to run Tohu for you, and for nothing else. That means:

• counting your credits, certificates, endorsements, University Entrance, Scholarship results and GPA, and showing what you still need;
• showing your deadlines, homework and results on the calendar, dashboard and transcript;
• running Tohu Exams: letting you sit a teacher’s exam, saving your answers as you type, enforcing the time limit, recording when you leave the exam window, and returning your mark;
• running schools and classes: letting the teachers at a school you joined see, verify and fix your record, and letting a class post announcements and questions;
• letting you send files to people at your school and share files by link, and deleting them after 24 hours;
• checking a file you choose for text that matches other sources or looks AI-written, through Study Solutions and Turnitin, and keeping the reports in your files;
• letting people you choose (helpers, connected apps) do what you allowed them to;
• taking payment for anything you buy in Tohu, through Stripe, and turning on what you paid for, for as long as you’ve paid for it;
• signing you in, keeping your account secure, and showing you what changed in your record and in Tohu;
• answering your questions and fixing problems you report;
• meeting our legal obligations, including responding to a lawful request from a New Zealand authority.

What we don’t do. We don’t sell or rent your information. We don’t use it for advertising or let advertisers reach you through Tohu. We don’t rank you against other students or share your results with NZQA or a university, or with your school unless you join it on Tohu with its code. We don’t use your record to train AI models. What an AI app you connect does with your information is up to that app (section 5).

If we want to use your information for a new purpose, we’ll tell you first and, where the law requires, ask you.

Every account in Tohu is an island: the database itself refuses to show one account’s rows to another. These are the only ways across.

Teachers, through Tohu Exams. A teacher sees nothing of yours until you turn on exam mode and type their code. They then see the name on your account, your answers (including while you’re writing), your start and hand-in times, pauses, the log of times you left the exam window, how many times you played each recording on the paper, and, on a Zero Trust exam, whether you’re writing it in Safe Exam Browser. They never see the rest of your record, your email, or your other subjects. Any co-teacher the exam’s owner adds sees the same. The leave log is a record the teacher reads, not a finding that you cheated: a notification can steal focus as easily as a search can. After you hand in, you can’t reread the paper until your teacher releases the mark. Released marks are written into your record and locked so only the teacher can change them; you can still ask for a correction (section 9). Through an exam alone, a teacher sees only what is related to the exam they set up and run — the rest of your record stays out of their sight unless you have also joined their school, below.

Your school, if you join it. A school on Tohu is set up by the Tohu site admin, who adds its teachers. You join it by typing the code your school gives you, at sign-up or in Settings; nobody can join you to a school but you. Joining sets the school name on your record to the school’s own, and it stays that way while you are a member. While you are a member, every teacher at that school can see your whole Tohu record (subjects, standards, results, school tests, homework, Scholarship, courses and degrees), your name and your email address, and can change any of it, much as a helper can. Each change they make is logged and shown to you as “[your school] changed your record”, with the teacher’s name. Results you enter yourself are marked unverified until a teacher enters or checks them; teachers see which. Once a teacher has verified a result, only a teacher at the school can change or remove it while you are a member; you can still ask for a correction (section 9). They can’t see your password, can’t edit the log of what they did, and can’t join you to anything. You can leave the school at any time in Settings, which ends their access at once; what they already entered stays in your record. Teachers at the same school can also see each other’s names and email addresses, and the exams each has set.

Classes. You can join a class at your school with its code, and a teacher at your school can add you to one; either way you’re told, can leave it, and its teachers see your name and email address. A class can hold the exams your teachers post. The class sees its teachers’ announcements. When you ask a question you choose who sees it: the whole class, which shows your question, your name and the replies to everyone in it, or only your teachers. You can change that later, and delete what you posted.

Files you send or share. Teachers, and students with Tohu PLUS, can upload a file and share it by link. Anyone who has the link can open and download the file without signing in, along with any note you added, your name, and your school if you’re in one, until the file expires. Only share a link with people you mean to see it, because they can pass it on. If you’re in a school, you can also send a file to your school’s teachers or to classmates in your classes, and your teachers can send files to you; the people you send to see the file, your name and your note. Every file is deleted 24 hours after it’s sent, or sooner if you delete it or turn its link off. A copy someone has already downloaded is theirs, and Tohu can’t take it back.

Files, notes and Turnitin Reports on your assessments. These are yours alone. Unlike the rest of your record, helpers, your school’s teachers and the Tohu site admin can’t see them, even while they are in your record. When you get a Turnitin Report on a file, it goes to Turnitin through Study Solutions (section 6). Your teachers don’t see the report or its scores unless you choose to share them.

Helpers you invite. You can let someone, such as a parent, friend or tutor, fix things in your record. While the session lasts they can see and change your display name, school, terms, subjects, standards, grades, homework, courses and degrees. They can’t see your email or password, can’t extend their own access, and can’t edit the log of what they did. You can end it at any time in Settings.

The Tohu site admin. One administrator account, hello@tohu.kiwi, can open any student’s record and can see every exam on Tohu. It also sets up schools, adds and removes their teachers, and can see each school’s members. We use this only to fix faults, answer support requests, keep Tohu secure, and meet legal obligations. The admin can also change the email you sign in with, set a new password (which signs you out on every device), or delete your account. Every change the admin makes, including to your email or password, is logged and shown to you as “Tohu changed your record”. The admin never sees your current password. You will always be notified if your record is updated or modified.

AI apps you connect. If you connect Claude (Anthropic) or ChatGPT (OpenAI) in Settings, that app can read and change your whole record through Tohu’s connector, for as long as it stays connected. Those companies are overseas and handle your information under their own privacy policies, not ours. They may not be required to protect your information in a way that, overall, provides comparable safeguards to those in New Zealand’s Privacy Act. By connecting an app after reading this, you authorise Tohu to disclose your record to it (information privacy principles 11(1)(c) and 12(1)(a)). You can disconnect it any time in Settings, which stops all further access. Information the app already received stays with that company under its policy. Connecting to third-party AI services through the MCP protocol is entirely at your discretion.

Payments. If you buy something in Tohu, such as the Tohu PLUS subscription or credits, you pay on Stripe’s own checkout page. Tohu sends Stripe your email address and a reference to your Tohu account, so the payment can be matched to you; you give your card details to Stripe directly, and Tohu never sees or stores them. Stripe then tells Tohu what you bought and whether it’s paid, renewing, cancelled or refunded, and Tohu turns on what you paid for. You manage cards, receipts and cancelling on Stripe’s own page, reached from PLUS in Tohu. What you’ve bought is part of your record, so a helper, your school’s teachers or the Tohu site admin, while they are in your record, can see which paid features you have; only you can buy or cancel anything. The site admin can also add credits to your account or take them away, for example to fix a problem with a purchase.

Our service providers store and run Tohu for us (section 6). They may only use your information to provide that service.

When the law requires or allows it. We may disclose information where another New Zealand law requires it (section 24 of the Privacy Act). We may also disclose it where that’s necessary to avoid prejudice to the maintenance of the law by a public sector agency, such as the Police. The same applies where it’s necessary to prevent or lessen a serious threat to public health or safety, or to someone’s life or health (information privacy principle 11(1)(e) and (f)). Where we can lawfully tell you, we will.

If Tohu changes hands. If Tohu is sold or transferred as a going concern, we may disclose your information where that’s necessary to complete the sale (information privacy principle 11(1)(i)). The new operator would have to keep to this statement, and we’d tell you beforehand so you can delete your account.

Tohu runs on cloud services. They hold and process information on our behalf and may not use it for their own purposes, so under section 11 of the Privacy Act we remain responsible for it, as if we held it ourselves.

Because these providers are overseas, your information is stored and processed outside New Zealand. All are established providers that encrypt data in transit and at rest and contractually limit how they use customer data. Copies may also exist briefly in their backups and logs.

AI apps you choose to connect are different: they aren’t our providers, and section 5 explains how sharing with them works. Importing credits or courses is not connecting an app: Anthropic reads the document for us, as our provider, and sees only what you give it to import, not your Tohu record. Filling in a scholarship from a link is the same, and sends even less: only the text of the web page you linked to, with nothing about you. A Turnitin Report is the same: Study Solutions and Turnitin read the one file you chose, for us, and see nothing else in Tohu.

Security. The database enforces who can see each row, so a fault in a page can’t show you someone else’s record. Passwords are stored scrambled by our login provider and nobody at Tohu can read them. All traffic is encrypted. Tohu has no master key around these rules (even your school’s and the admin’s access in section 5 goes through them, and their changes are logged). There are four exceptions, all running inside our database provider rather than in Tohu itself. One is an automatic clean-up every hour, and all it can do is delete shared files whose 24 hours are up, and files left behind by something you deleted. Another records what you’ve bought, and only when Stripe sends a message signed as coming from Stripe. The third signs you in to Safe Exam Browser for a Zero Trust exam, and only when you press Open in Safe Exam Browser: that makes a one-time link that works for five minutes, and Safe Exam Browser opening it signs you in there and opens that exam. To make sure a Zero Trust exam is only written in Safe Exam Browser, the link also leaves a secret in Safe Exam Browser’s own cookies, which Tohu’s database checks; it lasts twelve hours at most and is gone when Safe Exam Browser closes. Safe Exam Browser runs on your device and sends Tohu nothing else, and nothing to its makers. Pages showing your record are never cached, and exam files and the files you send sit in private storage, reached only through links that expire. The fourth makes Turnitin Reports. It only ever acts on a file you chose: it sends that file, records the scores, copies the two reports into your files, and gives your Turnitin Report back if it fails. No system is perfectly secure, so please use a strong password you don’t use anywhere else.

How long we keep it. We keep your record while your account exists, because a record of NCEA and university study is meant to last years. Things you delete are removed straight away, apart from copies in our providers’ backups, which expire within 30 days. Files you send or share are the exception to keeping things: they are deleted automatically 24 hours after you send them. If an account has not been signed into for more than 12 months, we may email you and notify you of its permanent deletion.

Deleting your account. To delete your account and account information, email hello@tohu.kiwi — we’ll delete your record within 7 days and confirm when it’s done. Your answers and marks on any teacher’s exam are deleted with your account. A connected AI app is not: it keeps what it already received under its own policy. The log of changes a helper, your school or the admin made to your record is deleted with your record, and so are your school and class memberships, everything you posted in a class, any files you sent that haven’t expired yet, your files and notes on assessments with your Turnitin Reports, and Tohu’s record of what you bought. You’re taken off Tohu’s email list in Resend too. Stripe keeps its own record of your payments, which it must hold for a time by law; deleting your Tohu account doesn’t cancel a subscription, so cancel it from PLUS first.

If something goes wrong. If a privacy breach is likely to cause anyone serious harm, we’ll tell the Privacy Commissioner as soon as practicable (section 114 of the Privacy Act). We’ll also tell you as soon as practicable (section 115), explaining what happened and what you can do. If we can’t reach everyone affected, we’ll give public notice instead. If you’re under 16 and we believe telling you directly would be against your interests, the Act lets us tell a parent or other representative instead (section 116).

Most people using Tohu are secondary school students. The Privacy Act requires us to collect information fairly and without intruding unreasonably, particularly from children and young people (information privacy principle 4). That’s why we collect only what Tohu needs, and never ask for your date of birth, contact details or photo. You need to be 13 or older to make an account. If you’re under 18, we encourage you to tell a parent or caregiver you use Tohu and show them this statement, and to ask them before buying anything in Tohu. Your record still belongs to you. We won’t give a parent, caregiver or school access to it unless you invite them as a helper, you join your school on Tohu with its code, or the law requires or allows it (for example, the breach rule in section 7 for students under 16). Your privacy rights in section 9 are yours, whatever your age.

Under the Privacy Act you can:

• ask whether we hold information about you, and get a copy of it (information privacy principle 6);
• ask us to correct it if you think it’s wrong (principle 7). This includes a mark your teacher released, even though Tohu locks it so only the teacher can change it in the app. Send the request to us and we’ll take it up with the teacher. If the mark isn’t corrected, you can give us a statement of the correction you want. We’ll attach it to the mark so the two are always read together. If we correct something or attach a statement, we’ll tell anyone we’ve disclosed it to, such as that teacher, where reasonably practicable;
• complain if you think we’ve mishandled it.

The Privacy Act doesn’t give a general right to have information deleted. It does say we can’t keep it longer than we need it (principle 9), and we’ll delete your account whenever you ask (section 7).

Most of your record you can see and fix yourself in Tohu. For anything else, email hello@tohu.kiwi — we’ll confirm your identity, usually by replying to the email address on your account. We’ll respond as soon as reasonably practicable, and no later than 7 days after we receive your request (section 44). If a request is very large or needs consultation, the Act lets us extend that time; we’ll tell you if we do and why (section 48). Requests are free.

If you’re not happy with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.

If we change this statement, we’ll update the date at the top. If the change affects how your information is used or shared, we’ll tell you in Tohu’s “What’s new” panel before it takes effect.