Game Based Limited, trading as Just A Game (NZBN 9429053576958), runs the Athlete Adaptability Programme and the JAG Athlete Portal. This policy explains how we handle personal information on our website (justagame.co.nz) and in the portal (athletes.justagame.co.nz). We follow the New Zealand Privacy Act 2020.

Our privacy officer is Simon Roseingrave, simon@justagame.co.nz.

Athletes in the programme. Name, athlete number, username, sport, gender and school year (both optional), and the group and organisation they belong to. If an athlete has a login, their email address and password (stored only as a salted hash). During the programme we record test scores, levels, points (AXP), attendance and self-directed activity. Athletes can also write goals, reflections and the sports they play.

Practitioners and organisation staff. Name, email address, role, school or organisation, and password hash.

People who contact us. Whatever you tell us when you email or use a contact form, such as your name, email address and message.

We usually collect athlete details from the school, club or practitioner running the programme, not from the athlete directly. We also collect scores and attendance during sessions. We do not collect date of birth, home address, photographs, health records or payment details through the portal.

We use personal information to run the programme, show athletes their own progress, give practitioners group views, report results to the athlete's organisation, support users, and keep the portal secure. We do not use it for advertising and we do not sell it.

Who can see it:

We share information otherwise only if the law requires it, or to prevent a serious threat to someone's safety.

Passwords are stored only as salted hashes, so we cannot read them. The portal is served over HTTPS, access depends on role, and people see only the athletes and groups they need to. Our Security & Privacy Statement for Organisations describes these measures in more detail. Temporary passwords work for the first sign-in only, repeated failed sign-ins lock a login for a short time, sessions expire, and staff accounts can use two-step sign-in (required for our system administrators).

The portal is hosted by Render in Ohio, in the United States, so portal data is stored and processed outside New Zealand. The data is held on an encrypted disk with automatic daily backups (snapshots). We also keep a daily, restore-tested backup copy of the database in a private, encrypted bucket with Backblaze, in the United States (US West), so we can recover if the disk is lost. Render and Backblaze act as our service providers and do not use athlete information for their own purposes. We remain responsible for it under the Privacy Act.

If we have a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the people affected as soon as we can.

Many athletes in the programme are school-aged. We collect only what the programme needs, and athletes see only their own information. Goals and reflections that an athlete writes are visible to their practitioners.

We rely on the school, club or organisation running the programme to tell athletes and their parents or caregivers that their information is shared with us. If you are a parent or caregiver and have questions, or want to see, correct or delete your child's information, contact us or the organisation.

The portal sets only the cookies it needs: one to keep you signed in, and, for staff using the "view as athlete" tool, one to remember that choice. We do not use advertising or analytics cookies in the portal.

The portal serves its own fonts and scripts, so it does not load them from other companies' servers. Our public website, justagame.co.nz, is run on Squarespace, which may use its own cookies and analytics; see Squarespace's privacy policy for details.

We keep athlete information while their organisation is in the programme, and for 3 years afterwards so results can be compared over time. Then we delete or de-identify it, so individuals can no longer be identified. We also keep a log of staff actions in the portal (such as sign-ins, password resets and exports) for two years to help protect the information we hold; it records the staff member and the athlete number or record concerned, not athletes' names or scores.

You can ask us at any time to:

We aim to reply within 20 working days. Email simon@justagame.co.nz.

We may update this policy as the portal changes, and will post the new version with its date. This version was written in October 2026.