Privacy
Last updated 24 October 2026
cprtools is run by Martin Turberville Smith in New Zealand. It's built to know as little about you as possible. There are no accounts, and we don't ask for your name.
In short
- We don't keep your email address.
- The only cookies are the ones that let you into the apps.
- There's no advertising and no analytics tracking, and we don't sell or share your information.
- Your course provider doesn't receive any information about you from cprtools.
If you use an access code
When you enter a code from your course provider, we check it and give your browser a pass that lasts 90 days. The pass is a cookie that records which code you used and when it expires. It doesn't contain anything about who you are.
We count how many passes each code gives out each month. That's a single number per code, and it isn't linked to you.
If you sign in with a Health NZ email
We use your email address only to check it's a Health NZ address and to send you the sign-in email. We don't store it.
- The email is sent by Resend, our email delivery service in the United States. Like any email service, Resend keeps a record of the messages it sends (the address, the subject and whether it was delivered) for a short time.
- To stop repeat emails, we keep a scrambled form of your address for 60 seconds. It can't be turned back into your address.
- While you're typing the code, your browser holds a short-lived cookie for up to 15 minutes. It holds a scrambled form of the code, not the code itself.
- Your pass records the domain of your email address (for example tewhatuora.govt.nz), not the address itself. We count passes per domain each month.
Cookies
We use only these two cookies. Both are needed for the site to work, so there's nothing to opt out of.
| Cookie | What it's for | How long |
|---|---|---|
cprt_pass | Lets you into both apps. It's shared across cprtools.nz and its two apps. | 90 days |
cprt_hnz | Checks the 6-digit code when you sign in with a Health NZ email. | 15 minutes |
The apps don't store anything else in your browser, and they don't save your practice results.
The Manual Defib Trainer and your microphone
The Manual Defib Trainer listens for your callouts. Turning your speech into text is done by your browser's own speech service, which sends the audio to the company behind your browser: Google for Chrome, Microsoft for Edge or Apple for Safari. Their privacy policies cover that. cprtools never receives or records your audio, only the text your browser hands back, and that's used on your device and then discarded.
Hosting
cprtools runs on Cloudflare. Like any website host, Cloudflare handles your IP address and basic details of each request, for example to deliver pages, block attacks and limit repeated sign-in attempts. Cloudflare operates around the world, so this may happen outside New Zealand.
If you email us
If you write to support@cprtools.nz, we keep your email so we can reply and help. It's stored with our email provider, Fastmail, and isn't used for anything else.
Your rights
Under the New Zealand Privacy Act 2020 you can ask to see or correct personal information we hold about you. Because we keep so little, there's usually nothing to find, but we're happy to check. Email support@cprtools.nz.
If you're not happy with how we've handled your information, please tell us first. You can also contact the Office of the Privacy Commissioner.
Changes
If we change how cprtools uses information, we'll update this page and the date at the top.