Privacy policy

Last updated 21 October 2026

This policy explains how Week by Week handles personal information under the New Zealand Privacy Act 2020. A plain-language summary is on our privacy & safety page.

1. Who we are

Week by Week is provided by DXBE Limited (company number 8479537, NZBN 9429050841509), trading as Week by Week, 70 Somerset Terrace, Stoke, Nelson 7011, New Zealand (“we”, “us”). Our Privacy Officer is Michael Zwiener. Contact: hello@week-by-week.com.

2. Our approach

We collect as little as we can. Students use Week by Week under a nickname. Students don't need to give their real name, phone number, date of birth, photo, exact address or an email address of their own to create an account. A student under 16 who signs up on their own gives us a parent's or caregiver's email address, so we can ask that adult if it's OK. If they make a CV, they can choose to add contact details for employers: if a student chooses to add a name, email address, phone number or town for their CV, they are saved with their account so they appear on the CV on any device they log in on, are included when they download their data and deleted with their account, and are not included in anything sent to the AI coach. (A town entered under “Your answers” is separate: it is sent to the AI coach for local suggestions.)

3. What we collect

Students

• Account details: nickname, username, age, optional year level, the school they joined through (if any), and a password and recovery code that we store only as salted hashes. For under-16s who sign up on their own, or move to their own plan after their school's plan ends, we also store a parent's or caregiver's email address and a record of when they agreed, with the network (IP) address and browser details they agreed from. We use that email only to ask for their OK and for payment notices. Our email to them names the student's nickname and age.
• Content: what the student chooses to enter – answers, chat messages, wins, skills, plans, check-ins (including a self-rated mood), the town they live in and messages sent to other students through Connect – and what the AI coach creates from it.
• Microphone and read-aloud (optional): if a student taps the microphone, their browser's own speech service turns their voice into text. The audio goes to the browser's maker, for example Google (Chrome), Microsoft (Edge) or Apple (Safari). We receive only the text, not the recording. The microphone isn't offered in the demo, or before a parent or caregiver has agreed. In Dialog mode, after a first tap, the microphone listens for each answer until Dialog is switched off or the page is closed. Read-aloud prefers the voices built into the device. Otherwise the browser may use an online voice, which sends the text being read out to the company behind it.
• School reports (optional): if a student uploads a school report (PDF or photo), our AI provider reads it once. We keep only a summary: subjects, results, the gist of teachers' comments, strengths and interests. We ask the AI to leave names out, and we don't store the file. The student can delete the summary at any time.
• Safety checks: an automated AI filter checks chat and Connect messages for inappropriate content before they are sent. A blocked message isn't saved; we keep only an excerpt of up to 300 characters and a count of warnings, so a person in our team can review it. The filter also looks for signs that someone needs help, so the app can show help numbers. A second automated AI check does the same for much of what people write, such as answers, wins, check-in notes, goals, habits, limits, mentor details and the step for the week. It only shows help numbers – it doesn't block anything, alert anyone or keep a separate copy of the text.
• Usage: when the account was created and last used, and how many AI credits each action used.

School staff

Name, work email address, username, password (as a salted hash), any email address they add to receive warnings about their school's AI credit pool, and the orders and settings they make for their school.

Payments

Individual subscribers and schools that pay by card do so through Stripe (section 6): Stripe collects the payer's email address and card details, and we receive only a reference number. A school that requests a yearly plan gives us a billing email address for its accounts team and its purchase order number, if it uses one; we use them to send and match its invoices. If a school pays an invoice by bank transfer, the money goes straight to our New Zealand bank account, not through Stripe, and our bank statement shows us the payer's name, their account number and the payment reference. We use these details only to match the payment to the invoice, and we keep them with our accounting records (section 7).

Schools we contact

To offer Week by Week to schools, we use the Ministry of Education's public Schools Directory: school name, type, region, roll, published email address, phone number, website and, where listed, the principal's name. Because this information is publicly available, we do not send a separate notice when we collect it (Privacy Act 2020, IPP 3A), but we tell you here. Each email we send says where we found the address and includes a one-click unsubscribe. We keep a record of addresses that unsubscribed so we never email them again.

Website visitors and enquiries

If you contact us or ask for a pilot, we collect your name, role, school, work email and message.

Technical information and cookies

Our hosting provider processes IP addresses and request data to deliver the service, prevent abuse (for example by limiting login attempts) and keep short-term logs. The Week by Week app uses two cookies, both strictly necessary. One keeps you logged in. The other, kept for up to a year, marks a device you have logged in from before, so other people's wrong guesses are less likely to lock you out of your own account. Neither is used for anything else. Our website sets no cookies. To count visits, our website and app use Cloudflare Web Analytics, which works without cookies, doesn't follow you across other sites and doesn't build a profile of you. The demo, the sign-up page and the page for joining with a school code use Cloudflare Turnstile to tell people from bots. The app's login screen and home screen show photos loaded from Unsplash, so Unsplash receives your IP address. We do not use advertising trackers.

4. Why we collect it

• to provide the AI coach and the features students use;
• to let schools manage access, see engagement and pay for the service;
• to measure AI usage fairly against the credits included in each plan, and to warn schools – and us – when a school's credit pool is running low;
• to keep the service safe and secure, and to improve it;
• to reply to enquiries and, for schools, to send offers (each with a one-click unsubscribe) and invoices.

We do not sell personal information and we do not use it for advertising.

5. Who can see it

• The student sees their own content in the app, including what the AI coach creates from it. Our team can add private notes to an account to guide the AI coach's tone and suggestions. The student doesn't see these notes in the app. To ask what we hold about them, see section 10.
• The student's school sees the nickname, age, year level, date joined, last activity and AI credits used. The school's dashboard doesn't show student content. Staff can set a temporary password for a student who is locked out. The student can see the reset in their account. If a student keeps their account with a personal plan after their school's plan ends, the account moves out of the school and the school no longer sees it.
• Other students (Connect): if a student uses Connect, the people they connect with see their nickname, the interests they share and the messages sent to them. Connect is for ages 13 to 30, and people only meet others in their own age group (13–15, 16–17 or 18–30). If someone reports a conversation, our team sees its last 30 messages.
• Our team can access the system to run and support it. We look at student content only when the student asks for help, to investigate misuse or a safety or security issue, or when the law requires it.
• Service providers that process information for us (section 6).
• We may disclose information when the law requires it, or where we believe on reasonable grounds that it is necessary to prevent or lessen a serious threat to someone's life, health or safety (IPP 11).

6. Service providers and overseas disclosure

We use the providers below. Some store or process information outside New Zealand. We share information with them only so they can provide their service to us, and we rely on their contractual commitments to protect it in a way that is comparable to the Privacy Act (IPP 12).

Under Anthropic's commercial terms, information sent through our service is not used to train their models.

7. How long we keep it

• Student accounts and content: until the student deletes the account, 7 days after their school removes it (the account is locked at once, and the school can undo the removal until then), or 12 months after the school stops using Week by Week, unless the student has kept their account by choosing a personal plan. Each free demo is a new, empty account that stops working after 24 hours, and we delete it automatically about a day later. If someone signs up and keeps what they did in the demo, we copy it to their new account and delete the demo account. After a school's plan ends, its students can still log in and read their content for at least 120 days; AI features and editing are paused.
• A parent's or caregiver's email (for an under-16 who signs up on their own): kept while the student's account exists, and deleted with it.
• Excerpts of blocked messages: 90 days.
• Reported Connect conversations: if an account is deleted, a conversation that was reported is kept for 90 days after that, with the messages from both people and the report, so our team can look into it. The deleted account's username is replaced by a random code, but its Connect nickname and messages stay in the conversation. After 90 days the conversation is deleted automatically. A conversation nobody reported is deleted with the account.
• Records we need for billing, tax and accounting are kept for 7 years, without any link to a student once the account is deleted.
• Backups: we copy our database so we can recover from a failure. Information from a deleted account can stay in a backup for up to 3 months, until it expires. If we restore from a backup, we delete those accounts again.
• School contacts and enquiries: up to 3 years after our last contact. Unsubscribe records: for as long as we send emails, so we can honour them.

8. Security and privacy breaches

We use encrypted connections (HTTPS), store passwords and identifiers only as salted hashes, limit who in our team can access data, limit login attempts and keep student content separate from what schools can see. If a privacy breach is likely to cause serious harm, we will notify the Privacy Commissioner and the people affected as soon as practicable, as the Privacy Act requires.

9. Young people

Students who join through their school are 13 or older. Anyone aged 13 or older can also sign up on their own. If you're under 16, we ask for a parent's or caregiver's email address and send them a link to agree. Until they agree, the AI coach stays off and you can't pay. We keep their email address for this and for payment notices. We collect as little as we can about the people who use Week by Week. Students use a nickname and don't need to give their real name. We encourage schools to tell parents and caregivers that they use Week by Week, and we give schools a template letter for that.

10. Your rights

You can ask to see the personal information we hold about you (IPP 6), ask us to correct it (IPP 7) or ask us to delete it. Students can do most of this in the app or through their school; anyone can contact our Privacy Officer at hello@week-by-week.com. Because we don't know students' identities, we will ask for the username and may ask the school to confirm a request. We respond within 20 working days.

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Office of the Privacy Commissioner.

11. Changes

We will update this policy when our practices change and tell schools about significant changes before they take effect.