Who we are
Champ is run by Champ Limited (NZBN 9429053962515), a New Zealand company. Champ was designed and built in Aotearoa New Zealand by 2 parents. We are the "agency" under the Privacy Act 2020, which means we are responsible for looking after the information in Champ. Our privacy officer is Jan-Paul de Groot, one of the 2 parents who run Champ; write to him at hello@champ.kiwi for anything to do with privacy. Champ Limited is a company, not a registered charity.
The short version
- A child's profile can only be seen by the people on that child's team: the parents and carers, and the people they have invited. Nobody else, including us, looks at it in the ordinary course of running Champ. The one narrow exception is a meeting guest: a team member can invite someone outside the team to a single calendar entry, and that person's private link shows the child's first name, the meeting's subject, time, place and who is attending by first name and role, and nothing else. The parents are told whenever a guest is added.
- The parents hold the keys to their child's profile. They decide who joins and what each person can see, can see who has opened each document, and can remove anyone at any time.
- We never sell information, never use it for advertising, and never use it to train artificial intelligence.
- You can ask for a copy of everything held about you or your child, ask for it to be corrected, or ask for a profile to be deleted. You can delete your own account yourself, at any time, from Settings.
What we collect
About people who use Champ (parents and carers, and everyone on a child's team): your name, email address, password (stored scrambled, we cannot read it), a photo if you add one, your phone number and address if you choose to share them with your teams, the organisation you work for if you tell us, a record of what you add and change in Champ, and which documents you open (see the access log below). If you switch on 2-step sign-in, we store which method you chose and what is needed to check your codes, never a code in readable form. If you turn on notifications on a phone or computer, we store the address that device gives us for sending them, and nothing else about the device.
About children: what the child's team chooses to put in the profile. That can include the child's name, date of birth, school or early learning centre and class if added, a photo, written descriptions of the child (what helps, what is hard, background), goals and progress notes, documents such as reports and plans, meeting notes and recordings (see below), moments and photos (which can be marked as a good day or a hard day, and a hard day can be shared with the parents only), messages between team members, to-dos from meetings, funding and support records with their key dates, letters and receipts, and, where the team turns that section on, Keep track: medication details with a log of doses, and short entries about eating, sleep or other things the family chooses to keep track of. Some of this is health information, which the law treats as especially sensitive, and so do we. Alongside the Privacy Act, we follow the Health Information Privacy Code 2020 for it; the code applies the same 13 rules to health information, with some extra care about who it is shared with.
Recorded meetings: a team member can record a meeting or conversation on their phone so that Champ can write it up. Before it starts, Champ announces out loud to the room that it is about to record, and notes who was there. The person recording is responsible for making sure everyone present is comfortable with that. The audio is sent to a transcription service (Deepgram) to be turned into text, and the text is then summarised by Anthropic's AI into draft notes. The audio file is deleted from Champ as soon as the transcript exists, usually within minutes. The transcript and the notes are kept on the child's profile, where a parent, or the person who recorded the meeting, checks the notes before the team sees them. Anyone at the meeting can ask for the recording to be deleted instead, and the people who manage the profile can delete it at any time.
Recordings and transcripts added from elsewhere: a team member can also add a recording or transcript they already have, for example one saved by Teams, Zoom or Google Meet. They confirm that everyone knew the meeting was being recorded. For a video, Champ takes out just the sound on the person's own device before it is sent, where the device can. It is then handled exactly like a recording made in Champ: audio goes to Deepgram and is deleted from Champ as soon as the transcript exists, and a transcript file is read and deleted straight away.
Contacts outside Champ: a team can keep the details of people who are not on Champ, such as a doctor's rooms, a NASC coordinator or a taxi company: a name, a role, a phone number, an email address and a note. Those people are not told and get no access. Anyone who would like their details removed can ask the family, or email us.
Files emailed to Champ: people already on a child's team can email a file to add@champ.kiwi. Email from anyone else is ignored and nothing is kept. Only the attached files are kept, never the email itself. ImprovMX forwards the email and Resend receives it. If the sender is on more than one child's team, they choose the child for each file. Anthropic's AI then reads each file only to check that the name and date of birth in it match that child; if they do not, the file goes back to the sender and the parents never see it. Every file waits for a parent to add it. A file a parent turns down is deleted straight away, and a file nobody sorts is deleted after 14 days, with nothing kept.
Files Champ makes: a parent can make a 1-page summary of their child, choosing what goes on it, or make a funding pack before a review or application. Champ makes these as PDFs from what is already on the profile and never sends them anywhere. A funding pack is kept in Documents, seen only by the parents, so they can see exactly what they shared.
Technical information: the usual records a website keeps to work and stay secure, such as when you were last in Champ and the type of device you used. Champ's administrator can see when each account was last active so that unused accounts can be tidied up. Inside Champ, on any page about a child, we do not use analytics or tracking cookies of any kind; the only cookies are the one that keeps you signed in and, if you tick "Remember this device for 30 days" when signing in, one that lets that device skip the second step of 2-step sign-in for 30 days. On the public pages (the home page, help, privacy, terms and the demo) we use Google Analytics to count visits and see which pages people read, so we know whether Champ is reaching families. It sets a cookie, IP addresses are anonymised, and advertising features are switched off. If you would rather not be counted, a tracking blocker in your browser stops it and Champ works exactly the same.
The demo: anyone can try Champ with a demo account. The child in the demo is fictional; nothing in it describes a real person. We keep the name and email address you sign up with for the length of the demo (14 days), and delete the demo and everything in it when it ends, unless you start your own Champ from the demo, and then your account carries on as a normal one.
Tips emails: if you have not been in Champ for a week or more, we may send you a short, friendly email with one small suggestion for getting more from it, for example adding a sentence to a profile or inviting one person. We send at most one a month, never more than two if you do not come back, and none if you have turned off emails or tips. To decide who gets one we use only whether you have an account and how far you have got (for example, that a profile has no text yet or no team); the email names a child by first name only, to people already on that child's team. A demo account gets one such email, a week in. Every email has a link that stops them, and Settings has a switch. We keep a note of which tips were sent so that none is repeated, and the administrator can see it.
Donations: if you donate through our Givealittle page, Givealittle collects your details under its own privacy policy. We see the donor name, amount and any message you choose to leave, and we use them only to say thank you and keep our accounts.
Why we collect it
For one reason: so that the people around a child can share what they know and keep it when someone leaves. Everything in Champ exists to support that child. We do not use the information for anything else, and we do not analyse it across children to build products, research or statistics without asking first.
Information about you that someone else adds
Much of what is in Champ is added by someone other than the person it is about: a parent types in a GP's email address, a therapist adds a report, a colleague records a meeting you were at. The Privacy Act asks us to make sure people know when that happens, and Champ is built to do it. Anyone invited to a team receives an email saying who invited them and to which child's team, and can say no. The parents are told whenever someone joins, adds something or records a meeting.
Usually a parent or carer starts their child's profile. Sometimes someone who works with the child, such as a teacher, therapist or specialist, starts it for the family, and Champ asks them to invite the parents straight away. Once a parent joins, they hold the keys: they can see everything on the profile and decide who stays, and the person who started it becomes an ordinary team member like anyone else. So nothing is held about a child that their parents cannot see. If you believe information about you or your child is in Champ and you do not know why, email hello@champ.kiwi and we will find out for you.
Who can see it
Each child has a team. The parents (or carers) who hold the keys invite people to the team and give each person one of 3 levels of access: manages everything, can add and update, or can see everything. They can also limit a person to particular parts of the profile or particular documents, and switch the Keep track section (medication, eating, sleep) on only for the people who need it. The Team tab shows every person with access. There are no hidden viewers.
Champ keeps a log of who opened which document on a child's profile, and when. The parents can see it, so they always know who has looked at what. It shows a person's name, the document and the time, and nothing else. If a document is deleted, its lines in the log go with it. If someone deletes their account, the log shows them as "Former team member".
An organisation, such as a practice or school, can have a supervisor who is able to see which children their staff work with. To open a child's profile, a supervisor must join the team, where they appear like anyone else and the parents are notified. The same rule applies to us: if we ever need to open a profile to help you with a problem, we do it by joining the team visibly, with your permission, and leave when we are done.
Where it is stored and who helps us
Champ runs on services provided by other companies, which is normal for software. They store and process information on our instructions and are not allowed to use it for their own purposes.
- Supabase stores the database and uploaded documents. Your Champ data is held in the Sydney, Australia region. Australia's privacy law is broadly comparable to New Zealand's.
- Netlify runs the website itself.
- Google Analytics counts visits to the public pages only (see Technical information above). It never runs on a page about a child.
- Resend sends Champ's emails (invitations, notifications, sign-in help and 2-step sign-in codes) and receives the calendar invites people forward to a child's private calendar address, and the files emailed to add@champ.kiwi. From an invite Champ keeps only the subject, time, place and join link; from a file, only the file; never the email itself.
- ImprovMX forwards email for champ.kiwi: email to hello@champ.kiwi goes to a Google mailbox that we read, and email to add@champ.kiwi goes on to Resend. It passes the email through and does not keep it.
- Deepgram turns meeting recordings into text. Audio is sent only for that purpose and is not kept by them or used to train their models under the terms of our agreement with them.
- Anthropic provides the artificial intelligence that drafts plain-language summaries of documents, drafts meeting notes and suggested to-dos from transcripts, checks that a file emailed to Champ is about the child it was sent for and, when a parent asks, a first draft of the About sections. Text is sent to Anthropic only for that purpose. Under Anthropic's commercial terms it is never used to train their models, and it is deleted from their systems within 30 days (kept longer only if it were flagged as breaking Anthropic's usage rules).
Some of these companies are based in the United States. We choose services that commit contractually to protecting information to a standard at least as strong as New Zealand law requires.
How long we keep it
A child's profile stays as long as their team wants it, because the whole point is continuity as people and services change. The parents can delete it at any time from the About page; deletion removes the profile, its documents and its history straight away, apart from backups, which roll off within 7 days. Meeting audio is deleted as soon as it has been transcribed. Files emailed to Champ that a parent turns down are deleted straight away, and files nobody sorts after 14 days. Demo accounts are deleted 14 days after they start. Email sign-in codes stop working after 10 minutes. The access log is kept for as long as the profile, and goes when the profile is deleted.
You can delete your account from Settings at any time. When you do, everything about you goes: your name, email address, phone, address, photo and sign-in, and your name in every profile's timeline. Nothing is kept that points back to you, apart from backups, which roll off within 7 days. The things you added to a child's profile, such as documents, meeting notes and photos, stay on that profile, because the family relies on them; they are shown as from "Former team member" and go only if the whole profile is deleted. Your name may still appear inside things other people wrote, such as meeting notes; if you would like it removed, ask the parents or email us. If you are the only parent holding the keys to a profile, Champ first asks you to invite another parent or carer, or to delete the profile. We keep a simple count of people leaving Champ: the date, and whether the person was family or worked with children, with no name, no email and nothing about any child.
If Champ ever closes, we will give the parents on every profile at least 90 days' notice and a way to download everything first. After that, everything is deleted: the database, the documents and the backups. Nothing is sold, handed on or kept.
Your rights
Under the Privacy Act you can ask to see the personal information we hold about you, and about a child you are a parent or guardian of, and ask for it to be corrected. In Champ you can do most of this yourself: everything on a profile is visible to its parents and editable, and a parent can download the whole profile, documents included, from the About page at any time. For anything else, email hello@champ.kiwi. We will respond within 20 working days, and usually much sooner. If you are not happy with how we handle a request, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.
Children
Champ is used by adults about children. Children do not have their own accounts. Where a child is old enough to have a view about what is written about them, we encourage teams to involve them; the About section is a good place for a child's own words. A young person can also ask us directly to see what is held about them, and we will work out with them and their parents how best to do that.
Keeping it safe
Information travels encrypted between your device and Champ, and is stored encrypted. Access rules are enforced inside the database itself, not only on the screen, so a person cannot reach a profile they are not on even by mistake. Passwords are never stored in readable form. Anyone can switch on 2-step sign-in in Settings, so that signing in needs a 6-digit code as well as a password: from an authenticator app on their phone, or sent to their email. An email code works once, stops working after 10 minutes and is stored only in scrambled form. 2-step sign-in is a choice for parents and carers, and required for anyone who is not family and is on the teams of 2 or more children, for organisation supervisors and for the people who run Champ. There are no recovery codes to keep safe: if someone cannot do the second step, the Champ team helps only after checking it is really them, logs it, and emails them to say it happened. Only the 2 people who run Champ can reach the systems behind it, each with 2-step sign-in, and we look at a family's information only when that family asks us to help with something. Backups are taken automatically every day and kept for 7 days. If we ever became aware of a breach that could cause harm, we would tell the people affected and the Privacy Commissioner promptly, as the law requires, and tell you plainly what happened and what we are doing about it. Our security page has more detail for the IT and privacy teams of practices, services, schools and other organisations.
Changes to this page
When we change this policy we update the date at the top and, for anything that matters, tell the parents on every profile, and anyone else it affects, by email before it takes effect.