Still Got It

Version 1 · Effective 28 Oct 2026

Still Got It – Privacy Policy

The short version

• We collect the minimum needed to run Still Got It: a display name, an email address, and your browser's timezone.
• Accounts are for teachers, and for adults. There are no pupil logins, and we hold no records about individual pupils.
• You must not put anything that identifies a pupil into Still Got It.
• Your account and everything you create is stored in Australia. Some of our service providers are elsewhere — see Appendix A.
• We never sell your data. We show no advertising.
• The teachers you share a class or a curriculum with can see your display name and your email address.
• You can ask us to delete your account and your data at any time, by emailing [email protected].

1. Who we are

Still Got It is operated by State Machines Limited, a company registered in New Zealand (the "we", "us" or "our" in this policy).

If you have any questions about this policy or how we handle your information, please contact us at:

[email protected]

2. Who this policy covers

This policy applies to everyone who uses Still Got It. Still Got It is a tool for teachers, and accounts are for adults. You must be 18 or over.

It applies whether you signed up yourself or your access was arranged for you by your school or another organisation. In either case, the information in your account is held by us and handled as described in this policy.

3. What we collect

3.1 Your account

• Display name — shown to you, and to the teachers you share a class or a curriculum with
• Email address — used to sign you in, to send you account email, and to identify your account
• Password — stored only as a secure hash; we never store the password itself and cannot read it
• Timezone — sent by your browser, and used to work out what "today" means for your classes
• Google account identifier — if you sign in with Google (see 3.3)

3.2 Technical records

• Sign-in records — the IP address and browser user agent for each sign-in, kept with that sign-in record
• Emailed link records — the IP address and browser user agent at the time a password reset or email confirmation link was issued

We keep these so that we can see how an account was accessed if something looks wrong, and so that a reset link can be traced to the request that asked for it.

3.3 Signing in with Google

If you sign in with Google, we ask Google only for your name, your email address, and confirmation that the address belongs to you. We do not ask for access to anything else in your Google account, and we cannot see your mail, your files, or your contacts.

We store the account identifier Google gives us, so that we can recognise you on your next sign-in even if your email address changes. We also store the email address and the name, as described in 3.1.

3.4 What you create

The classes, curricula, concepts, problems, taught dates, and class grades you enter are stored against your account. These are your Content under our Terms of Service, and they stay yours.

3.5 Problem generation

When you ask for problems to be generated with AI, we keep a record of the call: which model was used, the reply that came back, and some technical metrics. We use this information to monitor quality and keep usage within limits.

3.6 If you contact us

If you email us, we keep what you send — your email address and the content of your message — in order to reply.

4. No pupil data

Pupils do not have accounts and cannot sign in, and grading is recorded for a class as a whole rather than for individual pupils.

Our Terms of Service require you not to enter anything that identifies a pupil — not in a class name, a concept, a problem, a curriculum, or a note you type when asking for problems to be generated. If we become aware that information identifying a pupil has been entered, we may remove it.

Because we hold no pupil information, there is no pupil data for us to sell, profile, target, or share.

5. How we use your information

5.1 Operating Still Got It

We use the information we collect to:

• operate Still Got It and keep your account working
• choose what your classes should review, and show it to you
• send you account email — confirming your address, and resetting your password
• understand how Still Got It is working and make it better
• investigate problems, including anything a teacher reports to us
• comply with our legal obligations

We may occasionally email you about Still Got It itself — a significant change, or a new feature. If we do, you will have an opportunity to unsubscribe from further promotional emails.

5.2 Automatic problem generation

Problems may be written by an AI model that is not ours. When you ask for problems to be generated, we send the model provider the curriculum name and locale, the concept name, description and metadata, and any note you enter to steer the generation. We do not send your name, your email address, your class names, or anything else that identifies you or your account.

The generation request may go to a model router such as OpenRouter, or directly to a model provider. The providers we use are listed in Appendix A.

5.3 Lawful basis (United Kingdom)

• Performing our contract with you — creating and running your account, storing the classes, curricula, concepts and problems you create, showing them to the teachers you share them with, generating problems when you ask for them, and sending you the account email described in 5.1.
• Our legitimate interests — keeping the sign-in and emailed-link records described in 3.2, so that we can look into anything that appears to be wrong; and using your Content and information about how you use Still Got It to understand how it is working and to improve it.
• Complying with a legal obligation — the disclosures described in section 7, where the law requires them of us.
• Your consent — the occasional email about a significant change or a new feature. Unsubscribing withdraws that consent.

6. What we do not do

• We do not sell your information to anyone, ever.
• We do not advertise in Still Got It, and we do not share your information with advertisers.
• We do not share your information with anyone for their own purposes.
• We do not hold information about individual pupils (see section 4).

7. Who else sees your information

Other teachers. When you share a curriculum, or add a teacher to a class, the other members of that class or curriculum can see your display name and your email address, along with the content you shared. This is how a shared class shows who is teaching it.

Service providers. The providers listed in Appendix A hold or process information in order to run Still Got It. They are required to protect it and may only use it to provide their service to us — never for their own purposes.

Legal requirements. We may disclose information where we are required to by law, by a court order, or to protect someone's safety.

Business transfers. If State Machines Limited is acquired by or merges with another company, account information may transfer as part of that transaction. We would notify you, and the new owner would be required to honour this policy.

8. How we keep your information secure

• All data is encrypted in transit (HTTPS/TLS).
• Passwords are stored as secure hashes. We never store the password itself.
• Access to personal information is limited to the people who need it to run the service.
• We use reputable, security-certified infrastructure providers.
• We review our security practices regularly.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify you and, where required, the relevant authority — including the New Zealand Privacy Commissioner under the Privacy Act 2020 — as soon as practicable.

9. Where your information is stored

Still Got It's database is hosted in Australia. Account email is sent through a provider in the United States, and problem generation goes to providers in the United States. Neither holds your account or the classes and curricula you create.

If your information is stored or processed outside your own country, it is protected by contractual arrangements that require the same standards of protection that apply where you are. Appendix A lists our data processors and their locations.

10. How long we keep your information

We keep your information for as long as your account is active, or as long as we need it to run the service.

• Accounts are deleted after 2 years of inactivity, or immediately on request.
• Sign-in and emailed-link records, including the IP addresses in them, are kept with your account and deleted when your account is deleted.
• Content you have shared with other teachers stays available to them after your account is gone, as set out in section 4.4 of our Terms of Service.

11. Your rights

Depending on where you are, you may have the following rights over your personal information:

• Access — ask for a copy of what we hold about you
• Correction — ask us to correct anything inaccurate or incomplete
• Deletion — ask us to delete your personal information
• Portability — ask for your information in a machine-readable format
• Objection — object to certain kinds of processing
• Withdrawal of consent — where we rely on your consent, withdraw it at any time; this does not affect anything done before you withdrew it

To exercise any of these, email [email protected]. We will respond within 20 working days.

12. Deleting your account

Email [email protected] with the subject line "Delete my account". We will delete your account and your personal information within 10 business days.

Content you have shared with other teachers may remain available to them.

13. Cookies

Still Got It sets one cookie, which keeps you signed in between pages. It is not readable by scripts in your browser and it is not used to track you.

We set no advertising cookies and no third-party cookies.

14. Legal compliance

This policy is written to comply with:

• New Zealand Privacy Act 2020 — as a New Zealand company, this is our primary legal framework
• Australian Privacy Act 1988 — for our Australian users, and because our data is held in Australia
• UK General Data Protection Regulation and Data Protection Act 2018 — for our users in the United Kingdom

If you have a complaint about how we have handled your personal information and we have not resolved it to your satisfaction, you can contact the relevant authority where you are:

• New Zealand: Office of the Privacy Commissioner — privacy.org.nz
• Australia: Office of the Australian Information Commissioner — oaic.gov.au
• United Kingdom: Information Commissioner's Office — ico.org.uk
• United States: your state attorney general's office

15. Changes to this policy

We may update this policy from time to time. When we make material changes, we will notify you by email, or by a prominent notice in the app, before the changes take effect. The date at the top of this policy shows when it was last updated.

16. Contact us

For any question, concern, or request relating to your privacy or this policy:

Email: [email protected]

We aim to respond to privacy enquiries within 5 business days.

Appendix A: Third-Party Providers

These providers may hold or process information in the course of running Still Got It. All are required to protect it and may only use it for the purpose listed.

This list will be updated as providers change. Material changes will be communicated as described in section 15.

State Machines Limited, New Zealand