Privacy
What we keep, and why.
The Practice is a game, not a bank. We keep as little about you as we can, we never sell it, and you can ask us to delete it at any time. This page says exactly what we collect, in plain words.
Last updated 11 November 2026.
Who we are
The Practice (thepracticegame.com) is a browser game made in Kirikiriroa Hamilton, Aotearoa New Zealand, by Colab Accounting Limited, which is responsible for the information on this page. We follow the New Zealand Privacy Act 2020. For anything on this page, email [email protected].
What we collect
If you make an account
- Your email address, to send your 6-digit sign-in codes and, if you asked to join, to tell you when you're let in. Nobody else in the game sees it.
- Your nickname. It shows on the classmates board.
- Your game save: where you're up to, your scores, your in-game bank balance and choices, and your best scores in the phone games. It's kept so you can carry on from any device.
- When you joined and when you last played.
We don't use passwords. Sign-in codes work for 10 minutes and are stored scrambled (hashed), so even we can't read them.
If you fill in "Keep me posted"
Your email, and anything else you chose to give: your name, what you do (student, grad, firm, teacher or other), your organisation and your note. We use it to email you about the game, and nothing else.
If you send a bug report or vote on the roadmap
What you wrote, where you were in the game and your screen size, and, if you ticked it, a screenshot of the game screen. Roadmap votes and notes are kept with your account.
If you just visit
We use Google Analytics (through Google Tag Manager) to count visits and see which parts of the site and game people use: pages viewed, buttons pressed, and milestones like finishing a week. We never send your name, email or anything you type to Google. Google Analytics sets cookies and sees your IP address; Google signals (advertising features) is off. You can block it with your browser's privacy settings or an ad blocker, and the game still works.
Cookies and browser storage
- Your game, on your device. If you play without an account, your save lives only in your browser's storage. Clearing your browser data deletes it.
- Staying signed in. When you sign in, your browser keeps a sign-in token, plus a 7-day sign-in cookie so a server update doesn't sign you out.
- Analytics cookies from Google Analytics, as above.
- Cloudflare may set a security cookie, and runs a bot check (Turnstile) on our sign-in, Keep me posted and bug report forms to stop spam. It looks at your browser, not your identity.
Who else handles it
We don't sell, rent or share your information for marketing. A few services help us run the site, and they only handle what they need to:
- Cloudflare: our site goes through Cloudflare, which protects it from attacks and runs the bot check.
- Google: Google Analytics, as above.
- Our email provider: to deliver sign-in codes and the emails you asked for.
- Our server host: where the game and its database run.
Some of these companies are overseas (mostly in the United States). They're large providers with their own privacy and security commitments, and we only share what each one needs.
How long we keep it
- Your account and game save: until you ask us to delete them, or we remove an account that's been unused for a long time.
- Keep me posted: until you ask to be taken off the list.
- Bug reports: as long as they're useful for fixing the game. If you delete your account, your reports stay but no longer point to you by name.
- Sign-in codes: 10 minutes.
- Analytics: Google keeps it for up to 14 months.
Your rights
You can ask to see what we hold about you, to correct it, or to delete it. Email [email protected] from the address you used and we'll sort it, usually within a few days. Deleting your account removes your email, nickname and saved game for good.
If you're not happy with how we've handled your information, tell us first and we'll try to put it right. You can also complain to the Office of the Privacy Commissioner.
Keeping it safe
Everything travels over an encrypted connection (HTTPS). Sign-in codes and sign-in tokens are stored hashed. Only the people who run the game can open the admin page, and they need their own sign-in.
Younger players
The Practice is made for students, including secondary students taking NCEA accounting. If you're under 16, check with a parent, caregiver or teacher before you make an account. We don't knowingly collect more than an email and nickname from anyone.
Changes
If we change what we collect, we'll update this page and the date at the top. If it's a big change, we'll email people with accounts.