Privacy Summary for Parents

All data is stored in Sydney, Australia using Supabase (a secure cloud database hosted on AWS ap-southeast-2). This meets Australian government requirements for data sovereignty.

The website is delivered by Vercel, which keeps standard web logs (IP address, browser type) for up to 30 days; these are not linked to any student. Our database provider, Supabase in Sydney, and its hosting and CDN provider, Cloudflare, receive the same details. Student records pass through Cloudflare in transit: the connections to and from it are encrypted, and it does not cache them by default. When a class code is not recognised, or the feedback form is sent, we keep a shortened hash of the IP address, never the address itself, and routine clean-up removes it once it is more than two days old. After a failed login we keep a short-lived hashed form of the name, readable only by the database service role, on the same terms.

Teachers on your child's class can see their first name, game scores, and progress via the teacher dashboard. This helps the teacher plan targeted instruction and identify students who may need extra support.

In the SOLO maths tracker, teachers on your child's class also see their answers with the time each took (with a "likely guessing" hint when several failed attempts were very quick), their typed reflections and working, their workbook pages, and, while SOLO is open, whether they are active, idle or on another tab. The teacher can add a reaction, a stamp or a short note that your child sees.

Other students in the class can see first names on the class leaderboard (top 5 by XP). They cannot see each other's detailed scores. In some SOLO lessons a maths question your child writes can be shown to classmates with their first name, but only after the teacher approves it. Classmates never see reflections, workbook pages, answers or status.

Word Labs staff (Nicholas Deeney, the developer) can access data for technical support and troubleshooting only. Data is never shared with third parties for marketing or advertising.

• Encrypted in transit — all connections use HTTPS (the same encryption banks use)
• Encrypted at rest — the database is encrypted with AES-256
• Teacher accounts are password-protected — only authorised teachers can view class data
• Row-level security — database rules ensure teachers can only see classes they are on, within their own school

Student data is kept for as long as the teacher's account is active. When a teacher deletes a class, all student data in that class is permanently deleted (including names, scores, and character data).

If a school's subscription ends and is not renewed, data is retained for 90 days to allow reactivation, then permanently deleted.

The SOLO "right now" status is overwritten about once a minute while your child uses SOLO and deleted automatically within 24 hours of the last update. Everything else in SOLO (answers, reflections, workbook pages) is deleted with the class.

Supabase keeps database backups for 7 days. A deleted record stays in those backups until they age out, then it is gone.

Under the Australian Privacy Act 1988, you have the right to:

• Access — ask what data is held about your child
• Correction — request corrections to inaccurate data
• Deletion — request your child's data be deleted at any time
• Complaint — lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

To exercise any of these rights, contact your child's teacher or email us directly at nick@wordlabs.app.

Your school acts as the data controller for student information. Your child's school decides whether to use Word Labs and is responsible for seeking your consent under its own process. You can withdraw consent at any time by telling the school, and the class teacher can delete your child's record immediately. In the United States, a school or teacher authorised by the school may consent on your behalf for educational use (see Section 16.1 of our Privacy Policy).

Schools can use our consent template, which sets out what is entered, where it is stored and who it is shared with.

If you have concerns about your child using Word Labs, please speak with your child's teacher or the school's privacy officer. You may request that your child's data be removed at any time.

Word Labs Education
Nicholas Deeney
Email: nick@wordlabs.app