Last updated: 7 October 2026
The short version. Kea Academy is a homework quiz app for New Zealand families. A parent creates the account; children have profiles inside it, not accounts of their own, and never sign in.
We collect the parent's name and email address from Google or Apple when they sign in, and whatever the parent enters about their children — a first name, a year level, and the answers their child gives to quizzes.
There is no advertising, no analytics, and no tracking of any kind. We do not sell or share your family's information with anyone for their own purposes. You can delete everything from inside the app at any time.
Kea Academy is operated by Adam Sharman (“we”, “us”). We are the party responsible for the information described here — the “agency” under New Zealand's Privacy Act 2020, the “operator” under the United States' Children's Online Privacy Protection Act (COPPA), and the “data controller” under the UK and EU General Data Protection Regulation (GDPR).
For anything to do with privacy, including requests to see or delete information, contact us at admin@kea-academy.co.nz.
When you sign in with Google or Apple, we receive and store:
We never receive your password. Signing in happens on Google's or Apple's own pages, and they tell us only the details above.
If you use Apple's Hide My Email, we only ever see the relay address Apple gives us, not your real one.
Children do not have accounts, email addresses, or passwords. A parent creates each child's profile, and we store only what the parent enters or the child produces by using the app:
That is the complete list. We do not collect a child's date of birth, photograph, location, contacts, voice, or anything that identifies them outside your family's own account.
When you sign in we store a random session token — as a one-way hash, so the stored value cannot be used to sign in as you — along with your browser's user-agent string and the times the session was created and last used.
If you invite a second parent to your family, we store the email address you enter, who invited them, and when. The invite link itself is stored only as a one-way hash.
If the person you invite never joins, we have no relationship with them and no reason to keep their address — so the record is deleted within 30 days of the invite being used, revoked or expiring.
The app keeps a copy of your family's data in your browser's local storage so it works
offline, under the keys kiwiquiz_state_v1 and, temporarily,
kiwiquiz_presignin_v1. Your in-app notifications and the 4-digit parent passcode
are stored only on your device and are never sent to us.
We use four cookies, all strictly necessary for the app to function. None are used for advertising, analytics, or tracking you across sites, and there is nothing to opt out of because there is nothing optional.
| Cookie | Purpose | Lifetime |
|---|---|---|
ka_session | Keeps you signed in | 30 days, extended by use |
ka_oauth | Secures the Google sign-in round trip | 10 minutes |
ka_apple | Secures the Apple sign-in round trip | 10 minutes |
ka_join | Remembers an invite while you sign in | 10 minutes |
The “how your child compares” chart in the parent dashboard is generated from simulated figures. It does not use any other family's information, and the app says so where it appears.
We use your family's information only to provide the app: to set quizzes, mark them, show progress, keep you signed in, and sync between your devices.
For people in the UK or EU, our legal bases under the GDPR are:
Kea Academy is designed for children aged roughly 7 to 13, used under a parent's supervision. Its structure exists to keep children's data minimal and parent-controlled: the parent authenticates, the parent creates the profiles, and the child never holds credentials.
Where consent is the basis for processing a child's information, that consent is given and may be withdrawn by the holder of parental responsibility. The age at which a child can consent for themselves varies between 13 and 16 across member states; Kea Academy does not rely on a child's own consent at any age.
We use a small number of service providers who process information strictly on our instructions. They are not permitted to use it for their own purposes.
| Provider | What they do | What they see |
|---|---|---|
| Neon | Hosts our database | All account and family information described above |
| Replit | Runs the app itself | Information in transit while a request is served, and server logs |
| Sign in with Google | That you signed in to Kea Academy. Google is a separate controller for your Google account and its own privacy policy applies. | |
| Apple | Sign in with Apple | That you signed in to Kea Academy. Apple is a separate controller for your Apple account and its own privacy policy applies. |
We may also disclose information if the law requires it, or to protect someone's safety.
Both our database and the app itself are hosted in Sydney, Australia. Your family's information does not leave Australia in the ordinary running of the app.
The exception is signing in: Google and Apple operate their own sign-in services internationally, and each is a separate data controller for your account with them.
This means your family's information is disclosed outside New Zealand. Under Information Privacy Principle 12 of the Privacy Act 2020, we rely on these providers being subject to privacy safeguards comparable to New Zealand's, and on contractual protections requiring them to handle information only as instructed.
For UK and EU users, transfers outside the UK/EEA are made under the safeguards our providers offer, including standard contractual clauses where applicable.
| Information | Kept |
|---|---|
| Account, children, quizzes and results | Until you delete them, or delete your account |
| Sign-in sessions | 30 days from last use; expired ones removed when you next sign in |
| Invites to another parent | The link works for 7 days. The record, including the address you entered, is deleted within 30 days of the invite being used, revoked or expiring — whichever comes first |
| Data stored on your device | Until you delete the account, reset the demo data, or clear your browser storage |
Deleting your account removes your family's information from our database. Where another parent shares your family, deleting your own account removes you — their children's records remain theirs, and the app tells you this before you confirm.
You can, at any time and from inside the app:
Depending on where you live, you also have rights to request a copy of your information, ask us to correct or erase it, object to or restrict how we use it, and receive it in a portable form. Contact admin@kea-academy.co.nz and we will respond within the time your law allows — 20 working days in New Zealand, one month under the GDPR.
No system is perfectly secure, but the amount we hold is deliberately small — which is itself a safeguard.
If we change how we handle information we will update this page and its date. If a change materially affects your family, we will tell you in the app before it takes effect.
Please contact us first at admin@kea-academy.co.nz — most things are quickest to fix directly. You may also complain to a regulator: