Privacy Policy

Last updated: 22 March 2026

Summary for teachers and school administrators: Word Labs collects only student first names and in-game activity scores. No surnames, no email addresses, no photos, no dates of birth. All data is stored in Australia. Schools control their data and can request deletion at any time.

1. About This Policy

This Privacy Policy explains how Word Labs ("we", "us", "our") handles personal information in connection with the Word Labs service available at wordlabs.app.

Word Labs is operated by Nicholas Deeney, an Australian primary school teacher and sole trader (ABN pending). This policy is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We are aware that many of our users are primary school students (ages 9–12). We take the privacy of children seriously and have designed the service to collect the minimum information necessary for it to function.

2. Who This Policy Applies To

Teachers — educators who create an account to manage classes and view student progress
Students — children who use the word games (added to the platform by their teacher)
School administrators — staff who manage the school's subscription
Website visitors — anyone browsing wordlabs.app

3. Information We Collect

3.1 Teacher accounts

Email address (used for login and account communications)
School name (entered during onboarding)
Subscription status and billing history (managed via Stripe — see Section 8)

3.2 Student records

First name only Activity scores In-game progress

We collect only: student first name (entered by the teacher), a randomly generated 4-character login code, and in-game activity scores (correct answers, total attempts, time taken). We do not collect surnames, email addresses, dates of birth, photos, device identifiers, or any other personal information about students.

3.3 Technical data

Our hosting provider (Vercel) may log standard web server data including IP addresses and browser type for security and performance purposes. This data is not linked to individual user accounts and is deleted within 30 days.

4. How We Use Personal Information

We use personal information only for the purposes for which it was collected:

Teacher email — to enable login, send account-related emails (password reset, subscription receipts), and to respond to support requests
School name — to identify the school in the dashboard and on invoices
Student first names — to display in the teacher dashboard so teachers can identify their students' results
Student scores and progress — to show teachers which students need support (heatmaps, intervention flags)
In-game currency and badges — to power the student reward system within the platform

We do not use personal information for advertising, profiling, or any purpose beyond operating the service.

5. Children's Privacy

Students use Word Labs under the supervision and authority of their school. The school (through the teacher) is the data controller for student records. Word Labs acts as a data processor on the school's behalf.

Teachers are responsible for ensuring they have appropriate authority to add students to the platform, consistent with their school's privacy policies and any applicable parental consent requirements.

We do not knowingly collect information directly from children without teacher involvement. Students do not create accounts — they are added by their teacher using only a first name.

6. Where Data Is Stored

All data is stored in Australia using Supabase (PostgreSQL), hosted in the Sydney region (ap-southeast-2). This is important for Australian government schools and schools subject to state-based data sovereignty requirements.

Subscription and payment data is handled by Stripe, which stores data in the United States. Stripe does not receive any student data — only teacher/school name, email, and billing information.

7. Disclosure of Personal Information

We do not sell, rent, or share personal information with third parties for marketing purposes. We may share data with:

Supabase Inc. — our database and authentication provider (data stored in Australia)
Stripe Inc. — payment processing for subscriptions (teacher/billing data only, no student data)
Anthropic PBC — AI generation of custom shop item images (the "AI Polish" feature in the item creator). Only the image content is sent — no student data is involved.
Vercel Inc. — website hosting (processes web request logs)

We may disclose personal information if required by Australian law or a valid court order.

8. Payment Data

Word Labs uses Stripe to process subscription payments. We do not store credit card numbers or bank account details. Payment information is handled entirely by Stripe and is subject to Stripe's privacy policy.

Schools that pay by purchase order (invoice) will have their school name and invoice contact email stored in our records for accounting purposes.

9. Data Retention

Active accounts: data is retained for as long as the subscription is active
After cancellation: data is retained for 90 days to allow recovery, then permanently deleted
Deleted classes: all student records (names, codes, scores, character data) are cascade-deleted immediately when a teacher deletes a class
Teacher account deletion: all associated school, class, and student data is permanently deleted on request

10. Your Rights (APP 12 & 13)

Under the Australian Privacy Act, you have the right to:

Access personal information we hold about you or your students
Correct inaccurate information
Request deletion of your account and all associated data
Complain about how we handle your information

To exercise any of these rights, contact us at nick@wordlabs.app. We will respond within 30 days.

11. Data Breaches (Notifiable Data Breaches Scheme)

Word Labs is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. In the event of an eligible data breach that is likely to result in serious harm, we will:

Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable (within 30 days of becoming aware)
Notify affected individuals (schools/teachers) directly by email
Take immediate steps to contain the breach and prevent recurrence

12. Cookies and Local Storage

Word Labs uses browser storage — not advertising cookies — as follows:

Supabase session cookie — stores your login session (teacher auth token). Required for the service to work. Expires when you sign out or after the session timeout.
sessionStorage — stores the student's current game session (name, class). Cleared automatically when the browser tab is closed.
localStorage — stores minor UI preferences (e.g. whether the storage notice has been dismissed).

We do not use advertising cookies, tracking pixels, or any third-party analytics scripts. No student data is ever written to cookies.

13. Security

We implement the following security measures:

All data in transit is encrypted via HTTPS/TLS
All data at rest is encrypted by Supabase
Database access is controlled by Row Level Security (RLS) policies — teachers can only access data from their own school
Teacher authentication uses Supabase Auth (bcrypt-hashed passwords)
Students use randomly generated codes (not passwords) — no sensitive credentials are issued to children

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify teachers by email and update the "Last updated" date at the top of this page. Continued use of Word Labs after notification constitutes acceptance of the updated policy.

15. Contact Us

For privacy questions, data requests, or complaints, contact:

Nicholas Deeney
Word Labs
Email: nick@wordlabs.app

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).