Privacy Policy

Last updated: 25 March 2026

1. About This Policy

This Privacy Policy explains how Word Labs ("we", "us", "our") handles personal information in connection with the Word Labs service available at wordlabs.app.

Word Labs is operated by Nicholas Deeney, an Australian primary school teacher and sole trader trading as Word Labs Education. This policy is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It is also designed to enable NSW government schools to meet their obligations under the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) and its Information Protection Principles (IPPs) when using Word Labs.

We are aware that many of our users are primary school students (ages 9–12). We take the privacy of children seriously and have designed the service to collect the minimum information necessary for it to function.

2. Who This Policy Applies To

• Teachers — educators who create an account to manage classes and view student progress
• Students — children who use the word games (added to the platform by their teacher)
• School administrators — staff who manage the school's subscription
• Website visitors — anyone browsing wordlabs.app

3. Information We Collect

3.1 Teacher accounts

• Email address (used for login and account communications)
• School name (entered during onboarding)
• Subscription status and billing history (managed via Stripe — see Section 8)

3.2 Student records

3.3 Technical data

Our hosting provider (Vercel) may log standard web server data including IP addresses and browser type for security and performance purposes. This data is not linked to individual user accounts and is deleted within 30 days.

4. How We Use Personal Information

We use personal information only for the purposes for which it was collected:

• Teacher email — to enable login, send account-related emails (password reset, subscription receipts), and to respond to support requests
• School name — to identify the school in the dashboard and on invoices
• Student first names — to display in the teacher dashboard so teachers can identify their students' results
• Student scores and progress — to show teachers which students need support (heatmaps, intervention flags)
• In-game currency and badges — to power the student reward system within the platform

We do not use personal information for advertising, profiling, or any purpose beyond operating the service.

5. Children's Privacy

Students use Word Labs under the supervision and authority of their school. The school (through the teacher) is the data controller for student records. Word Labs acts as a data processor on the school's behalf.

Teachers are responsible for ensuring they have appropriate authority to add students to the platform, consistent with their school's privacy policies and any applicable parental consent requirements. A plain-language Parent Privacy Summary is available for schools to share with families.

We do not knowingly collect information directly from children without teacher involvement. Students do not create accounts — they are added by their teacher using only a first name.

5.1 NSW government schools — IPP 2 (Direct Collection)

Under the PPIP Act s.9 (IPP 2), where a student is under 16, personal information should be collected from a parent or guardian. In practice, NSW government schools collect student names from parents at enrolment. The teacher then enters the student's first name into Word Labs under the school's existing authority. No information is collected directly from children — only from the teacher acting on behalf of the school.

Schools using Word Labs should include it in their standard third-party application consent process (e.g. the annual ICT usage notification sent to parents at enrolment). The Parent Privacy Summary may be shared with families as part of this process.

6. Where Data Is Stored

All student and teacher data is stored in Australia using Supabase (PostgreSQL), hosted in the Sydney region (ap-southeast-2). This meets data sovereignty requirements for Australian government schools, including NSW.

Subscription and payment data is handled by Stripe, which stores data in the United States. Stripe does not receive any student data — only teacher/school name, email, and billing information.

6.1 Transborder disclosure — PPIP Act s.19 (IPP 12)

Student data never leaves Australia. All student records (names, codes, scores, character data) are stored exclusively in Supabase's Sydney data centre. No student data is sent to any overseas sub-processor.

Teacher billing data (email and school name) is shared with Stripe (US) for payment processing. Word Labs takes reasonable steps (per s.19(2)(g)) via Stripe's contractual data processing agreement to ensure this data is handled consistently with the IPPs. Anthropic (US) receives only word list content for AI analysis — no student or teacher personal information is involved. Google Cloud (US/global) provides text-to-speech audio for the Spelling Check-In and EALD pronunciation features — only word text is sent, no student data. Resend (US) delivers transactional emails to teachers — no student data is involved.

7. Disclosure of Personal Information

We do not sell, rent, or share personal information with third parties for marketing purposes. Disclosures are made only where directly related to the purpose of collection and within the reasonable expectations of the individual, consistent with IPP 11 (PPIP Act s.18). We may share data with:

• Supabase Inc. — our database and authentication provider (data stored in Australia)
• Stripe Inc. — payment processing for subscriptions (teacher/billing data only, no student data)
• Anthropic PBC — AI-powered word analysis for custom word lists and spelling sets, and AI generation of custom shop item images. Only word content and image data is sent — no student or teacher personal information is involved.
• Google Cloud (Google LLC) — text-to-speech audio generation for the Spelling Check-In assessment and EALD pronunciation features. Only word text is sent — no student data is involved.
• Resend Inc. — transactional email delivery (feedback forms, school quote requests). Only teacher email addresses are involved — no student data.
• Vercel Inc. — website hosting (processes web request logs)

We may disclose personal information if required by Australian law or a valid court order.

8. Payment Data

Word Labs uses Stripe to process subscription payments. We do not store credit card numbers or bank account details. Payment information is handled entirely by Stripe and is subject to Stripe's privacy policy.

Schools that pay by purchase order (invoice) will have their school name and invoice contact email stored in our records for accounting purposes.

9. Data Retention

• Active accounts: data is retained for as long as the subscription is active
• After cancellation: data is retained for 90 days to allow recovery, then permanently deleted
• Deleted classes: all student records (names, codes, scores, character data) are cascade-deleted immediately when a teacher deletes a class
• Teacher account deletion: all associated school, class, and student data is permanently deleted on request

10. Your Rights (APP 12 & 13)

Under the Australian Privacy Act, you have the right to:

• Access personal information we hold about you or your students
• Correct inaccurate information
• Request deletion of your account and all associated data
• Complain about how we handle your information

To exercise any of these rights, contact us at nick@wordlabs.app. We will respond within 30 days.

11. Data Breaches (Notifiable Data Breaches Scheme)

Word Labs is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. In the event of an eligible data breach that is likely to result in serious harm, we will:

• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable (within 30 days of becoming aware)
• Notify affected individuals (schools/teachers) directly by email
• Take immediate steps to contain the breach and prevent recurrence

12. Cookies and Local Storage

Word Labs uses browser storage — not advertising cookies — as follows:

• Supabase session cookie — stores your login session (teacher auth token). Required for the service to work. Expires when you sign out or after the session timeout.
• sessionStorage — stores the student's current game session (name, class). Cleared automatically when the browser tab is closed.
• localStorage — stores minor UI preferences (e.g. whether the storage notice has been dismissed).

We do not use advertising cookies, tracking pixels, or any third-party analytics scripts. No student data is ever written to cookies.

13. Security

We implement the following security measures:

• All data in transit is encrypted via HTTPS/TLS
• All data at rest is encrypted by Supabase
• Database access is controlled by Row Level Security (RLS) policies — teachers can only access data from their own school
• Teacher authentication uses Supabase Auth (bcrypt-hashed passwords)
• Students use randomly generated codes (not passwords) — no sensitive credentials are issued to children

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify teachers by email and update the "Last updated" date at the top of this page. Continued use of Word Labs after notification constitutes acceptance of the updated policy.

15. Contact Us

For privacy questions, data requests, or complaints, contact:

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

For matters involving NSW government schools, complaints may also be lodged with the NSW Information and Privacy Commission (IPC) — phone 1800 472 679.