Privacy
Statement

Tohu is a grade tracker for New Zealand students, at tohu.kiwi, www.tohu.kiwi and app.tohu.kiwi. In this statement “Tohu”, “we” and “us” mean that person or business. You can reach us at hello@tohu.kiwi for any queries and requests.

This statement explains what personal information Tohu collects, why, who can see it, where it is kept, and your rights over it. It applies to students, teachers, and anyone given access to someone else’s record. We follow the Privacy Act 2020, including the information privacy principles in section 22.

The short version

• Your record is yours. Every account is walled off from every other at the database level.
• Nobody else sees your record unless you let them in: a helper you choose, a teacher whose exam code you type, or an AI app you connect. The one exception is the Tohu site admin, explained in section 5.
• We don’t sell your information, show you ads, or use your grades for anything except running Tohu for you.
• Your information is stored by cloud providers that may be outside New Zealand (section 6).
• You can see, get a copy of, correct or delete your information for any reason at any time. Email hello@tohu.kiwi.

We collect only what Tohu needs to count your record the way NZQA or your university counts it. You choose almost everything you enter; the account details are the only part we require.

We don’t ask for your National Student Number, NZQA login, date of birth, phone number, home address or photo, and you shouldn’t put them in notes or titles. Tohu uses only essential sign-in cookies, not advertising or tracking cookies. Tohu’s cloud services may log when certain Tohu services are used, but all analytics collected are anonymised and can never be tracked back to any one individual or group of individuals.

Most of it comes from you. Some of it comes from other people, and the law (information privacy principle 3A) says we must tell you when that happens. This statement is how we tell you, in advance, each time it can happen:

We don’t buy information about you, or collect it from your school, NZQA, or your university. Tohu has no connection to their systems.

We use your information to run Tohu for you, and for nothing else. That means:

• counting your credits, certificates, endorsements, University Entrance, Scholarship results and GPA, and showing what you still need;
• showing your deadlines, homework and results on the calendar, dashboard and transcript;
• running Tohu Exams: letting you sit a teacher’s exam, saving your answers as you type, enforcing the time limit, recording when you leave the exam window, and returning your mark;
• letting people you choose (helpers, connected apps) do what you allowed them to;
• signing you in, keeping your account secure, and showing you what changed in your record and in Tohu;
• answering your questions and fixing problems you report;
• meeting our legal obligations, including responding to a lawful request from a New Zealand authority.

What we don’t do. We don’t sell or rent your information. We don’t use it for advertising or let advertisers reach you through Tohu. We don’t rank you against other students or share your results with your school, NZQA or a university. We don’t use your record to train AI models. What an AI app you connect does with your information is up to that app (section 5).

If we want to use your information for a new purpose, we’ll tell you first and, where the law requires, ask you.

Every account in Tohu is an island: the database itself refuses to show one account’s rows to another. These are the only ways across.

Teachers, through Tohu Exams. A teacher sees nothing of yours until you turn on exam mode and type their code. They then see the name on your account, your answers (including while you’re writing), your start and hand-in times, pauses, and the log of times you left the exam window. They never see the rest of your record, your email, or your other subjects. Any co-teacher the exam’s owner adds sees the same. The leave log is a record the teacher reads, not a finding that you cheated: a notification can steal focus as easily as a search can. After you hand in, you can’t reread the paper until your teacher releases the mark. Released marks are written into your record and locked so only the teacher can change them; you can still ask for a correction (section 9). Teachers can only see the information related to the exam they set up and run — any other details you enter into your Tohu account can’t be seen by teachers (e.g., other internals, externals, results, not run by teachers, can’t be seen by teachers).

Helpers you invite. You can let someone, such as a parent, friend or tutor, fix things in your record. While the session lasts they can see and change your display name, school, terms, subjects, standards, grades, homework, courses and degrees. They can’t see your email or password, can’t extend their own access, and can’t edit the log of what they did. You can end it at any time in Settings.

The Tohu site admin. One administrator account, hello@tohu.kiwi, can open any student’s record and can see every exam on Tohu. We use this only to fix faults, answer support requests, keep Tohu secure, and meet legal obligations. Every change the admin makes is logged and shown to you as “Tohu changed your record”. You will always be notified if your record is updated or modified.

AI apps you connect. If you connect Claude (Anthropic) or ChatGPT (OpenAI) in Settings, that app can read and change your whole record through Tohu’s connector, for as long as it stays connected. Those companies are overseas and handle your information under their own privacy policies, not ours. They may not be required to protect your information in a way that, overall, provides comparable safeguards to those in New Zealand’s Privacy Act. By connecting an app after reading this, you authorise Tohu to disclose your record to it (information privacy principles 11(1)(c) and 12(1)(a)). You can disconnect it any time in Settings, which stops all further access. Information the app already received stays with that company under its policy. Connecting to third-party AI services through the MCP protocol is entirely at your discretion.

Our service providers store and run Tohu for us (section 6). They may only use your information to provide that service.

When the law requires or allows it. We may disclose information where another New Zealand law requires it (section 24 of the Privacy Act). We may also disclose it where that’s necessary to avoid prejudice to the maintenance of the law by a public sector agency, such as the Police. The same applies where it’s necessary to prevent or lessen a serious threat to public health or safety, or to someone’s life or health (information privacy principle 11(1)(e) and (f)). Where we can lawfully tell you, we will.

If Tohu changes hands. If Tohu is sold or transferred as a going concern, we may disclose your information where that’s necessary to complete the sale (information privacy principle 11(1)(i)). The new operator would have to keep to this statement, and we’d tell you beforehand so you can delete your account.

Tohu runs on cloud services. They hold and process information on our behalf and may not use it for their own purposes, so under section 11 of the Privacy Act we remain responsible for it, as if we held it ourselves.

Because these providers are overseas, your information is stored and processed outside New Zealand. All are established providers that encrypt data in transit and at rest and contractually limit how they use customer data. Copies may also exist briefly in their backups and logs.

AI apps you choose to connect are different: they aren’t our providers, and section 5 explains how sharing with them works.

Security. The database enforces who can see each row, so a fault in a page can’t show you someone else’s record. Passwords are stored scrambled by our login provider and nobody at Tohu can read them. All traffic is encrypted. Tohu has no master key around these rules (even the admin’s access in section 5 goes through them, and its changes are logged), pages showing your record are never cached, and exam files sit in private storage reached only through short-lived links. No system is perfectly secure, so please use a strong password you don’t use anywhere else.

How long we keep it. We keep your record while your account exists, because a record of NCEA and university study is meant to last years. Things you delete are removed straight away, apart from copies in our providers’ backups, which expire within 30 days. If an account has not been signed into for more than 12 months, we may email you and notify you of its permanent deletion.

Deleting your account. To delete your account and account information, email hello@tohu.kiwi — we’ll delete your record within 7 days and confirm when it’s done. Some things are kept by others and are not deleted with your account: a teacher keeps your answers and mark on their exam until they delete that exam, and a connected AI app keeps what it already received under its own policy. The log of changes a helper made to your record is deleted with your record.

If something goes wrong. If a privacy breach is likely to cause anyone serious harm, we’ll tell the Privacy Commissioner as soon as practicable (section 114 of the Privacy Act). We’ll also tell you as soon as practicable (section 115), explaining what happened and what you can do. If we can’t reach everyone affected, we’ll give public notice instead. If you’re under 16 and we believe telling you directly would be against your interests, the Act lets us tell a parent or other representative instead (section 116).

Most people using Tohu are secondary school students. The Privacy Act requires us to collect information fairly and without intruding unreasonably, particularly from children and young people (information privacy principle 4). That’s why we collect only what Tohu needs, and never ask for your date of birth, contact details or photo. You need to be 13 or older to make an account. If you’re under 18, we encourage you to tell a parent or caregiver you use Tohu and show them this statement. Your record still belongs to you. We won’t give a parent, caregiver or school access to it unless you invite them as a helper, or the law requires or allows it (for example, the breach rule in section 7 for students under 16). Your privacy rights in section 9 are yours, whatever your age.

Under the Privacy Act you can:

• ask whether we hold information about you, and get a copy of it (information privacy principle 6);
• ask us to correct it if you think it’s wrong (principle 7). This includes a mark your teacher released, even though Tohu locks it so only the teacher can change it in the app. Send the request to us and we’ll take it up with the teacher. If the mark isn’t corrected, you can give us a statement of the correction you want. We’ll attach it to the mark so the two are always read together. If we correct something or attach a statement, we’ll tell anyone we’ve disclosed it to, such as that teacher, where reasonably practicable;
• complain if you think we’ve mishandled it.

The Privacy Act doesn’t give a general right to have information deleted. It does say we can’t keep it longer than we need it (principle 9), and we’ll delete your account whenever you ask (section 7).

Most of your record you can see and fix yourself in Tohu. For anything else, email hello@tohu.kiwi — we’ll confirm your identity, usually by replying to the email address on your account. We’ll respond as soon as reasonably practicable, and no later than 7 days after we receive your request (section 44). If a request is very large or needs consultation, the Act lets us extend that time; we’ll tell you if we do and why (section 48). Requests are free.

If you’re not happy with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.

If we change this statement, we’ll update the date at the top. If the change affects how your information is used or shared, we’ll tell you in Tohu’s “What’s new” panel before it takes effect.