How Phonicspal handles personal information.

1. Who we are

This Privacy Policy explains how Phonicspal Pty Ltd (ACN 703 020 320, ABN 45 703 020 320) ("Phonicspal", "we", "us", or "our") collects, uses, discloses and protects personal information when you use our platform and related services (collectively, the "Service").

We are an Australian company. As a small business we may not be legally required to follow the Privacy Act 1988 (Cth), but we have chosen to manage personal information in line with it, the Australian Privacy Principles (APPs), and the Notifiable Data Breaches (NDB) scheme. We also comply with the Spam Act 2003 (Cth) for electronic messages.

Contact us at team@phonicspal.com for privacy enquiries, access/correction requests, or complaints.

2. Who this Policy applies to

This Policy applies to teachers, school staff, tutors, homeschool parents, and school administrators who use the Service, and to visitors to our website. Where the Service is used to support students, this Policy also applies to the student information entered by those users.

For student personal information, we act as a service provider to the school or teacher. We process student data on the school's or teacher's instructions and do not use it for our own independent purposes (such as marketing or profiling).

3. Information we collect

3.1 Account and profile information

When you create an account (through our sign-in provider, Clerk), we collect your name, email address, phone number (if you add one), and profile picture. We also store your role (for example teacher or homeschool parent), title, year levels, state or territory, school, phonics programme, handwriting style and your settings.

3.2 School information

School name, suburb, state, postcode, sector, and type. We use this to set up your account (for example your school's handwriting style and term dates), to match your phonics programme, and for school plans.

3.3 Content you create and share

Lesson plans, word selections, sound settings, uploaded images, saved lessons, printables, games, custom stories, and feedback (including screenshots and attachments).

• Public stories. New accounts start with story sharing on, and your first name and last initial shown on your public stories. You can turn either off in your account.
• Share links. When you share something with a link, anyone with the link sees a preview with your first name, last initial and profile picture, until you turn the link off.
• Invites. Your invite link (for example phonicspal.com/r/sarah-jones) contains your name, so anyone you send it to can see it. A friend who joins through it, or through a share link you made, sees who invited them, for example "Sarah J. invited you". You see each friend who joined that way by their first name and last initial, and where they're up to (joined, on their free month, or subscribed). You never see their email address, card or payment amounts. We keep a record of who invited whom and the rewards we gave, to apply the rewards and stop misuse.
• Invited by an affiliate. If the person who invited you is one of our affiliates (see 3.10), we pay them a share of what you pay us in your first 12 months. We work it out from your payments, refunds and disputes with Stripe. They see you the same way as any other inviter, plus what they earned from your payments, so they can tell that you have paid. They never see your email address, card or invoices.

3.4 Student information (entered by teachers)

Student names, class and group memberships, and the animal avatar each student is given. Teachers may also record progress flags, Phonics Check results and notes, activity results and learning notes for individual students. We rely on the school or teacher to have the authority (including any required parent or guardian consent) to provide this information.

We do not ask for student dates of birth, addresses, government identifiers, photos, voice recordings or login details.

3.5 Payments and billing

We use Stripe to take payments for paid plans. You enter your card, Apple Pay, Google Pay or Link details on a checkout page run by Stripe, not on our website. Your card number goes straight to Stripe. We never see it and never store it.

• What Stripe collects: your name, email address, billing address, payment details, the amount and date of each payment, and details about your device and connection (such as your IP address and browser), which Stripe uses to process payments and detect fraud.
• What we send Stripe: your name, email address and your Phonicspal account number, so a payment is linked to the right account.
• What we keep: your Stripe customer number, your plan (yearly or monthly), your subscription status, your renewal or end date, whether you have claimed the foundation offer, and when. Your invoices stay in Stripe, and you can see them in Manage Billing.
• Stripe's own use: Stripe handles payment data for us, and also uses it for its own purposes, such as preventing fraud, meeting its legal obligations (including anti-money-laundering checks) and improving its services. In Australia, Stripe's payment services are provided by Stripe Payments Australia Pty Ltd (ACN 160 180 343). If you save your details with Link, Stripe's checkout wallet, that is a separate service between you and Stripe. Read Stripe's privacy policy.

3.6 Usage data and analytics

• Product analytics (PostHog): pages visited, features used, clicks, events, time in the app, and session recordings (visual replays of how you use the Service). PostHog data goes through our own domain. Your account (Clerk ID, name, email, role, year levels, state, school and progress settings) is linked to your analytics so we can see how teachers use each tool. We don't send your class records to PostHog, but when you click a button on a class page, PostHog can record the button's label, which may include a student's first name (for example "Change avatar for Ava").
• Page view analytics (Vercel): which pages are visited and how fast they load. Vercel's analytics uses no cookies and doesn't identify you.
• Advertising measurement (Meta): our website and sign-in and sign-up pages use the Meta Pixel, which tells Meta (Facebook and Instagram) which pages you visit. When you create an account or finish setting it up, we also send Meta your email address and account number in a scrambled (hashed) form. Hashing turns them into a code, but Meta can match that code to a Facebook or Instagram account, so it isn't anonymous. Meta uses this to tell us whether our ads worked and to show our ads to people like our users. Meta doesn't run inside the app, and never receives student information.
• Purchases (Meta): when you start a paid plan, including if you start one again after cancelling, our servers send Meta a purchase event. It holds your email address and account number, hashed the same way, the amount you paid, the currency and a reference number for the payment. We don't send renewals. Your card details stay with Stripe (see 3.5), and Meta never gets them. Meta uses the event to tell us which ads led to a purchase and to show our ads to people more likely to buy.
• Device information: browser type, operating system, screen size, and approximate location worked out from your IP address.

3.7 Content our tools write and draw

Some features use language and image models from Google (Gemini) and, as a backup when Google's service fails, OpenAI. We send them the settings for your request (sounds, high-frequency words, word lists, levels, themes and genres) and anything you type into it, such as story characters or notes.

Class list imports. If you import a class list from a PDF, photo or Word file, the file is sent to Google (or OpenAI as the backup) to read the students' names, which come back to your class. If you'd rather not, type or paste the names instead. Your class records are not added to these requests automatically, but anything you type into a request is sent, including a child's name. Use a made-up name for story characters.

We use ElevenLabs to record the words in our word library. None of your information is sent to ElevenLabs.

3.8 Forms, surveys and feedback

When you contact us, join a waitlist, answer a survey or send feedback, we collect what you enter, such as your name, email, phone number, role and message. Contact form messages are emailed to us and not stored in our database. Waitlist and survey answers are stored. Feedback is stored with any screenshot you attach, which may show whatever was on your screen.

3.9 Security logs

Our hosting and security tools log IP addresses and browser details to protect the Service from abuse, for example by limiting repeated requests. When our own team edits shared content, we log who did it, when, their IP address and browser.

3.10 Ambassadors and affiliates

Ambassadors are people we give Pro to for free. We record that we gave it, when, and why.

Affiliates are teachers we pay to tell others about Phonicspal, under a written agreement. If you are one, we keep:

• your legal name, your ABN (or why you don't need one), whether you are registered for GST, and the contact details on your account;
• which version of the agreement you accepted, when, and whether your place is active, paused or ended;
• for each payment a friend makes: the Stripe invoice it came from, the amount after GST, your share, and when it can be paid;
• for each payout: the amount, the GST, the date and the bank reference.

We use this to pay you, keep the tax records the law requires, and apply the agreement. Your bank account details are not stored in Phonicspal. They stay with our bank and in our emails with you.

4. How we collect personal information

• Directly from you: when you create an account, configure settings, upload content, pay for a plan, submit feedback, or enter student information.
• Automatically: through your use of the Service via analytics tools, cookies, browser storage and server logs.
• From Stripe: whether a payment succeeded, your subscription status and your renewal date.
• From your sign-in provider: Clerk gives us your profile information when you sign in (including from Google if you sign in with Google).

5. How we use personal information

We collect and use personal information for these purposes (in line with APP 6):

• To operate, maintain, and improve the Service, including the tools that write stories and sentences and draw pictures.
• To provide accounts, sign you in, and give support.
• To make and deliver the educational content and activities you ask for.
• To track student learning progress on the teacher's behalf.
• To take payments, apply the foundation offer, issue tax invoices, remind you before renewals, and keep billing records the law requires.
• To send emails you need to use the Service, and news, tips and digests unless you turn them off.
• To run our affiliate programme: work out and pay each affiliate's share, and keep tax records (see 3.10).
• To ensure security, prevent fraud, and enforce acceptable use.
• To understand how the Service is used and improve it (including session recordings to find usability problems).
• To measure our advertising and reach people who might want Phonicspal (using Meta, as set out in 3.6).
• To comply with laws and enforce our Terms.
• To identify the source of materials offered for resale. Worksheets you print or save as a PDF carry a hidden code derived from your account. The code does not contain your name or email, and only we can match it to an account.

We do not sell personal information. We do not use student data for marketing, advertising, or building user profiles for commercial purposes.

6. Decisions made by computer programs

Some decisions about your account are made by our systems following set rules, without a person checking each one:

• The foundation price. Whether you can claim it, worked out from when your account was created and whether you've already used it.
• Your plan. Whether you have Pro or Free, from your plan with Stripe, a school plan that covers you, or a free period we've offered, and when you reach a Free plan limit, from your usage records.
• Fair use and security. Our checks, and those of Stripe and Cloudflare, use your IP address and approximate location, device and browser details, account and payment details. They can send a sign-up from outside Australia to a waitlist, slow or stop repeated requests, or decline a payment.
• Affiliate earnings. What an affiliate earns, and when it can be paid, is worked out from their friends' payments, refunds and disputes. We don't pay for a friend who appears to be the affiliate themselves (for example, the same card), using the same checks as invite rewards.
• Email. If emails to you bounce or are marked as spam, we stop sending you news and tips.

Some features also suggest things from what you've recorded, such as words and sounds to teach next, or students who may need more practice after a Phonics Check. These are suggestions. You decide what to do with them.

If you think a decision about you is wrong, email team@phonicspal.com and a person will look at it.

7. Children and student information

Phonicspal is designed for teachers in Australian primary schools, tutors and homeschool families. Students (typically Prep to Year 2, ages 5 to 8) use activities under adult supervision and don't have accounts. We:

• Process student personal information solely as a service provider to the school or teacher, on their instructions.
• Collect only the student data needed to deliver the Service (names, class and group memberships, learning progress and notes).
• Do not send student records to analytics, advertising or email providers (PostHog may record a button label that includes a student's name, see 3.6). Weekly recap emails, sent through Resend, can include your class names and the sounds each class is learning, but no student names. Class records are not added to requests to Google or OpenAI. Student names only reach them when a teacher imports a class list from a file, or types a name into a request (see 3.7).
• Do not display advertising to students or use student data for marketing.
• Rely on the school or teacher to obtain any parent or guardian consent required. Some schools and education departments require a consent form before student details go into an online service.
• Remove a student from use when the teacher deletes them. Their record stays in our database, hidden, for 30 days, then it is deleted permanently with their results and notes. If the teacher, the school or the student's parent asks, we delete it sooner.

When a child opens a shared slide or QR link, they don't sign in and we don't ask who they are. We record anonymous usage of those pages with all text hidden.

Schools and teachers should enter only what they need, such as a first name, and should not enter sensitive information about students (for example health information, disability details or government identifiers).

8. Cookies, browser storage, and tracking

The Service uses these cookies and browser storage:

• Sign-in cookies (Clerk): essential for keeping you signed in. Cannot be disabled without losing access.
• Analytics (PostHog): session identifiers and event data stored in cookies and browser storage. PostHog runs only on our live site and goes through our domain. Session recordings capture page interactions (clicks, scrolls, form interactions). Anything you type is always hidden, and on every page inside the app the on-screen text is hidden too. Class and Phonics Check pages are not recorded at all.
• Advertising (Meta Pixel): a cookie on our website and sign-in and sign-up pages that lets Meta measure our ads.
• Preferences and saved work: settings such as whether the menu is open, and work in progress, kept in your browser so it's there when you come back. Some classroom features, such as partner reading, keep student names in your browser on that device.
• Share links: a short-lived cookie that remembers what someone shared with you while you sign up.

You can control cookies in your browser settings. Blocking sign-in cookies will stop you signing in. Blocking cookies alone may not stop analytics, because PostHog also uses browser storage; a content or tracker blocker in your browser can stop PostHog and the Meta Pixel without affecting the rest of the Service. The scrambled sign-up and purchase details we send Meta (see 3.6) go from our servers, so browser settings don't stop them. We don't currently respond to browser "Do Not Track" signals. You can manage how Meta uses your information in your Facebook or Instagram ad settings.

9. Email

In line with the Spam Act 2003 (Cth):

• When you create an account, product news, teaching tips, digests and share notices are switched on. You can turn each kind off at any time under Email Preferences in your account.
• Every one of these emails includes an unsubscribe link, which works straight away.
• Emails you need to use the Service (such as sign-up, security, receipts, renewal reminders, failed payments, and changes to our Terms or prices) are sent whatever your email settings.

10. Disclosures and overseas transfers

We use trusted service providers to deliver the Service. Several hold or process personal information outside Australia, mainly in the United States. In line with APP 8, we take reasonable steps (including contracts and security reviews) to make sure they handle personal information consistently with the APPs.

Our current providers, what they do, and where they hold data:

• Clerk (United States): sign-in and accounts
• Stripe (United States, and other countries including European Union countries and India): payments, receipts, invoices and the billing page
• PostHog (United States): product analytics and session recordings
• Meta (United States): advertising measurement on our website, and the sign-up and purchase events from our servers
• Google (United States): language and image models (Gemini), and reading imported class lists
• OpenAI (United States): the backup for Google's models when they fail
• Vercel (Australia and the United States): hosting (our servers run in Sydney), file storage and page view analytics
• PlanetScale (United States): our database
• Resend (United States): email delivery
• Upstash (Australia): limiting repeated requests
• Cloudflare (United States): spam checks on our forms and sign-up
• Our accountant and our bank (Australia): billing and affiliate payment records for tax, and paying affiliates

We do not sell or rent personal information. We only disclose personal information to these providers for the purposes in this Policy, or when the law requires it.

11. Storage, security, and retention

Security

We use technical and organisational measures that fit the risk, including encryption in transit (TLS), access controls, separate development and production databases, signed tokens for sensitive actions, and regular security reviews. No method is 100% secure; we keep improving our safeguards.

Retention

• Account data: kept while your account is open, and for 30 days after you close it, then deleted (see Account deletion for what is not yet deleted automatically).
• Student data: kept while the teacher's account is open. Schools or teachers may ask us to delete it at any time.
• Billing records: Stripe keeps payment records, and we keep the record of your plan and payments, for at least five years, because tax law requires it. We keep them even if you close your account.
• Affiliate records: kept for at least five years after your last payout, for the same reason, even if your place in the programme or your account ends.
• Analytics data: kept under PostHog's and Vercel's retention periods.
• Security and audit logs: kept for two years for security and compliance, then deleted.
• Email logs: who an email went to, its subject, and whether it was delivered, opened or clicked, kept for troubleshooting and compliance.
• Backups: we keep encrypted copies of our database on a computer we control in Australia for about five weeks, and copies of uploaded files (such as pictures and feedback screenshots) there too. Deleted data stays in these backups until they are replaced. Email us if you want a file removed from our backups.

When data is deleted, we first mark it as deleted (it is hidden from everyone and excluded from the Service), then remove it permanently.

12. Account deletion

You can delete your account at any time in your account settings or by contacting us. When you delete your account:

• Any paid subscription is cancelled straight away, so you won't be charged again.
• Your sign-in record is permanently removed from Clerk.
• Your account, students, classes and content leave the app straight away. Your account, students, classes, lessons, printables and private stories are permanently deleted after 30 days.
• Your saved games and calendar entries are deleted after 30 days too. A few things aren't yet deleted automatically: uploaded files (such as pictures and feedback screenshots) and your record with Stripe. Email us and we'll delete them, apart from billing records we must keep for tax.
• Share links you made can keep showing what you shared, with your name and picture, after you delete your account. Turn them off before you delete it, or ask us to.
• Public stories you created stay in the library for other teachers, no longer linked to your name.
• Billing records we must keep for tax are kept (see Retention).

Schools may request bulk deletion of student data by contacting us at team@phonicspal.com.

13. Access, correction, and complaints

Under the APPs, you have the right to:

• Access the personal information we hold about you (APP 12).
• Request correction of inaccurate, out-of-date, or incomplete personal information (APP 13).

To make a request, contact us at team@phonicspal.com. We will respond within 30 days. We may need to verify your identity before processing a request. If we refuse access or correction, we will explain why in writing.

Complaints

If you believe we have breached the APPs or mishandled your personal information, contact us first. We will investigate and respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au/privacy/privacy-complaints.

14. Data breaches

We maintain a data breach response plan, following the steps of the Notifiable Data Breaches scheme. If we suspect a data breach, we will:

• Assess it as soon as practicable, and within 30 days.
• If it is likely to result in serious harm, notify affected individuals and the OAIC as soon as practicable.
• Take reasonable steps to contain and fix it.

If you become aware of a potential breach involving Phonicspal data, please notify us immediately at team@phonicspal.com.

15. Changes to this Policy

We may update this Policy from time to time. The updated version will be posted on this page with a new "Last updated" date and a summary of what's changed. If we change how we use your information in a way that matters, we will tell you by email or in the app at least 14 days before the change takes effect.