Security & Privacy
How we protect athlete information
What the JAG Athlete Portal holds, who can see it, and the security measures behind it. Written for schools, clubs and organisations.
Purpose and scope
This statement explains what information the JAG Athlete Portal holds about athletes and practitioners, who can see it, and the security measures protecting it. It applies to the live portal at athletes.justagame.co.nz.
Game Based Limited, trading as Just A Game (NZBN 9429053576958), is responsible for the portal. We handle personal information under the New Zealand Privacy Act 2020 and its Information Privacy Principles. The demo site at demo.justagame.co.nz is separate and contains only invented people and data.
Information we hold
We collect only what the programme needs to run, track progress and report to your organisation. We do not collect date of birth, home address, photographs, health or medical records, or payment details.
| Who | Information held | Where it comes from |
|---|---|---|
| Athletes | Name, athlete number, username, sport, gender (optional), school year (optional), group and organisation | Entered by practitioners or JAG, or imported from the organisation's CSV |
| Athletes with a login | Email address (or username) and a password stored only as a salted hash | Provided when the login is created |
| Athletes | Test scores, levels, AXP points, attendance and self-directed activity | Recorded during programme sessions, by practitioners or by the athlete |
| Athletes | Goals, reflections and the sports they play | Written by the athlete in their own journey |
| Practitioners and organisation admins | Name, email address, role, school or organisation, password hash | Provided when the account is set up |
We use this information to run the programme, show athletes their own progress, give practitioners group views, and produce reports for the organisation.
Who can see what
Access depends on role, and each role sees only what it needs.
| Role | What they can see and do |
|---|---|
| Athlete | Their own results, AXP, levels, goals and reflections. They do not see other athletes' scores. Group leaderboards are off unless a practitioner turns them on. |
| Practitioner | Athletes in their assigned groups, and the programme tools for those groups. |
| Organisation admin | Groups and athletes within their own organisation, and their organisation's settings and reports. |
| JAG system admin | The whole portal, so we can set up groups, support organisations and keep the system running. |
Groups are set up by JAG with your organisation, so we keep control over how athletes are organised. Practitioners and organisation admins cannot see other organisations' data.
Security measures in place today
These measures were reviewed against the portal's code in October 2026.
| Area | What we do |
|---|---|
| Passwords | Stored only as salted hashes using PBKDF2-HMAC-SHA256 with 260,000 iterations. We cannot read anyone's password. |
| Temporary passwords | New athlete logins and resets get a unique random password, never a shared default. It works only for the first sign-in: the user must choose their own password before using the portal. Re-issuing logins never changes an existing password; only a deliberate reset by an administrator does. |
| Sessions | Sign-in uses a random 256-bit token held on the server. The browser cookie is marked Secure, HttpOnly and SameSite, and lasts up to 14 days. Sessions also expire on our servers after 14 days, so a copied token stops working. Signing out ends the session, and so does a password reset. |
| Two-step sign-in | Practitioners and organisation admins can turn on a second sign-in step using a code from an authenticator app on their phone. It is required for JAG system administrators. Each code works once, and backup codes are provided in case a phone is lost. |
| Action log | The portal keeps a log of security-relevant actions by staff, such as sign-ins, password and two-step resets, exports of athlete information, and deletions. It records who did what and when, and which athlete number or record it concerned, but not athlete names or scores. Entries are kept for two years and can be viewed by system administrators. |
| Sign-in protection | Repeated failed sign-ins temporarily lock that login (and, at a higher threshold, that network address) for 15 minutes, which makes password guessing impractical. |
| Encryption in transit | The portal is served over HTTPS only, with HTTP Strict Transport Security set for one year. |
| Browser protections | The portal blocks being embedded in other sites, stops content-type guessing, limits referrer information, denies access to the camera, microphone and location, and uses a Content-Security-Policy so pages can only load scripts, styles and fonts from the portal itself. |
| Safe handling of input | Text entered by users is escaped before display, and database queries use parameters rather than joining user text into commands. |
| Access control | Role-based access, with practitioners and organisation admins limited to their own groups or organisation. |
| Notification emails are sent over an encrypted (TLS) connection. | |
| Demo separation | The public demo uses its own database containing only invented people, sends no emails, and cannot change any real data. |
Hosting, service providers and where data is stored
The portal runs on Render, a cloud hosting provider, in its Ohio data centre region, in the United States. That means portal data is stored and processed offshore. The data is held on an encrypted persistent disk, so it is kept when the portal restarts or is updated. Render takes an automatic snapshot of the disk every 24 hours and keeps each for at least seven days, so we can recover from data loss or corruption. In addition, the portal takes its own backup of the whole database about once a day and restore-tests it (the copy is reopened and checked) before relying on it. A copy is kept on the disk, and another is uploaded to a private, encrypted-at-rest bucket with Backblaze B2 in its US West region, so we can recover even if the disk or the hosting account were lost. We have rehearsed restoring from a backup (most recently in October 2026) and keep a written recovery procedure. Backups hold personal information and are handled the same way as the live data. Render reports that it holds SOC 2 Type II and ISO/IEC 27001:2022 certifications (Render compliance).
We use Render as a service provider to host the portal for us. We do not let it use athlete information for its own purposes, and we remain responsible for that information under the Privacy Act.
We use an email service to send account and password emails. We do not sell personal information, use it for advertising, or share it with third parties for marketing. Aggregated, de-identified results (for example, "X% of athletes improved") may appear in reports to your organisation.
Children and young people
Most athletes in the programme are school-aged. We take that seriously, and we keep what we hold about them to a minimum.
We hold no date of birth, address, photograph or health record. School year is optional.
Athletes see only their own information. Other athletes' scores are not shown.
Goals and reflections are written by the athlete and are visible to their practitioners, so we tell athletes this in the portal.
Your organisation remains responsible for telling athletes and parents or caregivers that their information is being shared with JAG and for obtaining any consent it needs. We can supply wording for this on request.
Parents, caregivers or athletes can ask us, through the organisation or directly, to see, correct or delete an athlete's information.
Retention, deletion, access and correction
Retention: we keep athlete information while the athlete's organisation is in the programme, and for 3 years afterwards, so athletes' progress can be compared over time and we can respond to questions about earlier results. After that it is deleted or de-identified, so individuals can no longer be identified. We review for athletes past this period using a tool in the portal, and nothing is removed without a person deciding to.
Deletion: we delete an athlete's information on request, unless we are required to keep it. Ask us or ask your organisation to contact us. We can either delete everything about an athlete or de-identify them, which removes their name, login, goals and reflections but keeps their scores as anonymous data. Each deletion or de-identification is recorded in an audit log that holds the athlete's number, not their name.
Access and correction: anyone can ask to see the information we hold about them, and to have it corrected, under the Privacy Act. We can export everything held about an athlete in a single file. We aim to respond within 20 working days.
Ending the relationship: when an organisation stops using the portal, we will return or delete its athletes' information on request.
Breach response and Privacy Act obligations
If we become aware of a privacy breach that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and the affected people as soon as practicable, as the Privacy Act 2020 requires. We will also tell the organisations whose athletes are affected, so they can support them.
Our approach follows the 13 Information Privacy Principles: we collect only what we need, tell people why, store it safely, use it only for the programme, and let people see and correct it. Where we receive athlete details from a school or practitioner rather than from the athlete, we follow the new indirect-collection notice rule (IPP 3A, in force from 1 May 2026) by making this statement and our privacy policy available to athletes and caregivers.
Improvements underway
We keep reviewing and improving the portal's security, and will update this statement as we do.
Contact
Privacy officer: Simon Roseingrave, Game Based Limited t/a Just A Game, simon@justagame.co.nz. If you are not satisfied with our response you can also complain to the Office of the Privacy Commissioner.
This statement was last reviewed in October 2026 and will be reviewed at least once a year, and whenever the portal's security or data handling changes. Read our Privacy Policy.
This statement was last reviewed in October 2026 and will be reviewed at least once a year, and whenever the portal's security or data handling changes. Read our Privacy Policy.