3 Big Things Ltd is a New Zealand psychology practice. Our online tools include Learning What Helps, a free anxiety education programme for young people, and Wellbeing Defenders, a wellbeing check-in for adults. Some of what these tools hold is health information, so we handle it in line with the Privacy Act 2020 and the Health Information Privacy Code 2020.
This page explains in plain language what we collect, where it is kept, who can see it, and how we have checked that the protections work.
The short version
- Nobody else can see a young person’s activity. Not their school, not their parents, and not our staff.
- What students type freely is never saved. Brain dumps, worry notes and similar spaces stay on the device and disappear.
- Information is stored in Sydney, Australia, encrypted, with certified providers.
- Schools only ever see how many people are using it, never names or individual results. Small groups show as “fewer than 10”.
- Under-14s need a parent or caregiver’s approval before their account starts.
- Accounts are deleted automatically after 2 years of inactivity, or straight away on request.
- Independent security testing. Tested by New Zealand security firm Carapace in September 2026, with no significant vulnerabilities found. The minor findings have been fixed and a retest has been requested.
What we collect, and what we never collect
We store (Learning What Helps):
- email address, first name, and date of birth (used only to check whether a parent needs to approve)
- which screens and modules have been completed, so students can pick up where they left off
- two short confidence ratings (start and end) and how useful they found each tool
- the structured choices they make for their personal plan, such as their go-to tools and the safe adults they name
- for under-14s, the parent or caregiver’s email address, so we can ask for approval
We never store or send:
- Anything typed into the free-writing spaces. This text exists only on the student’s device while they use it. There is no field in our database for it and no way for it to be sent to us.
- Individual answers in the Wellbeing Defenders check-in. These are scored on the person’s own device. We keep only the result (a band and an average score), which can’t be turned back into the answers.
No advertising, and nothing tracks young people. The teen programme loads nothing from outside services. On the adult pages we use Plausible, a cookie-free analytics service that doesn’t identify anyone, to count visits and sign-ins. We do not sell or share information.
Where it’s kept
- Supabase runs our database and sign-in, in Sydney, Australia.
- Amazon Web Services sends our emails (sign-in links, parent approval requests, account deletion warnings), from Sydney, Australia.
- Netlify hosts the website pages and code on a global content network. No personal information is stored there.
Information is encrypted in transit and at rest. Our database provider holds SOC 2 Type II and ISO 27001 certifications. The Learning What Helps programme loads nothing from outside services: its videos and audio are served from our own site.
Who can see it
- The student, and only the student. Each person can only ever reach their own information. This is enforced by the database itself on every single request, not just by what the app shows. We run an automated test before each release that attempts to read one user’s information as another user, and it must fail.
- No staff view. There is no screen at 3 Big Things for looking up an individual’s answers or plan.
- Parents and caregivers approve participation for under-14s. That approval does not give them access to anything the young person does inside the programme.
- Schools and organisations provide an access code that unlocks the programme. The code tells us which school a student came through, but the school cannot see who used it or what they did. The only thing we report back to a school is how many students are using the programme. Small numbers show as “fewer than 10”, and we never share names or individual results.
Signing in
Sign-in uses one-time email links rather than passwords, so there is no password to guess, reuse or steal.
Under-14s and parental approval
Everyone enters their date of birth. If a student is under 14, their account does not start until a parent or caregiver clicks an approval link that we email to them. The approval link is single-use, expires after 7 days, and the system decides the account’s status itself, so a student cannot mark their own account as approved.
As with any online service, a date of birth is self-declared. The approval step is a safeguard, not identity verification.
How long we keep it
- If an account has had no activity for 23 months, we email a warning. If it stays inactive, it is deleted automatically about 30 days later, 2 years after last use. This is done by scheduled software, not by someone remembering.
- Anyone can delete their account at any time, which permanently removes everything straight away, with no hidden copy. They can do this from their account settings or by emailing us.
- Anyone can download a copy of their information from their account settings, or ask us for it.
- Parent email addresses from approval requests that were never approved are deleted after 30 days.
How we check it works
- Automated tests on every change. Tests that try to access other people’s information, and that check every database table is protected, run automatically before release.
- Internal reviews. The platform has had full security and privacy reviews, including checks against the live system: an outsider with no account could read nothing, and no issues found were rated critical or high.
- Independent penetration test. New Zealand security firm Carapace tested the platform in September 2026 using the industry-standard OWASP testing methodology, with full access to the source code. They found no significant vulnerabilities and no way to gain unauthorised access to anyone’s data. They reported one low-severity issue and two informational items. All three have been fixed, and a retest has been requested.
Questions
For security or privacy questions, or to request a copy of our independent testing summary, contact us through our enquiry form, or reach us directly:
3 Big Things Ltd
Email: contact@3bigthings.co.nz. Phone: 0800 324 484.
Our website privacy policy names our Privacy Officer. If you are not happy with how we handle a privacy concern, you can also contact the Office of the Privacy Commissioner at privacy.org.nz.