Privacy Policy

Last updated: 1 November 2026

1. About This Policy

This Privacy Policy explains how Word Labs ("we", "us", "our") handles personal information in connection with the Word Labs service available at wordlabs.app.

Word Labs is operated by Nicholas Deeney, an Australian primary school teacher and sole trader trading as Word Labs Education, ABN 62 528 046 944. This policy is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It is also designed to enable NSW government schools to meet their obligations under the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) and its Information Protection Principles (IPPs) when using Word Labs.

We are aware that many of our users are primary school students (ages 9–12). We take the privacy of children seriously and have designed the service to collect the minimum information necessary for it to function.

2. Who This Policy Applies To

• Teachers — educators who create an account to manage classes and view student progress
• Students — children who use the word games (added to the platform by their teacher)
• School administrators — staff who manage the school's subscription
• Website visitors — anyone browsing wordlabs.app

3. Information We Collect

3.1 Teacher accounts

• Email address (used for login and account communications)
• School name (entered during onboarding)
• Subscription status and billing history (managed via Stripe — see Section 8)
• Which classes a teacher is on, and a record of who added or removed them and when, so a class shows who has had access

3.2 Student records

3.3 SOLO maths tracker records

Some classes also use the SOLO Tracker, our maths activity at wordlabs.app/solo. It is available only to schools that have asked for it: Word Labs switches it on for a school on request, and until then teachers and students at that school see a notice and no maths tracker data is collected. It keeps more than a score, because teachers use it to see how a student worked, not only whether the answer was right. Everything below is stored in the same Australian database as the rest of the student's record, is linked only to the student's first name and class, and is deleted with the class (Section 9). "The student's teachers" means the teachers at the student's school who are signed in to Word Labs, the same people who can see the rest of the class's results.

• Answers and time per question — for every practice (Know), assessment (Show), pre/post test, unit review and challenge question: the question, the answer the student gave, whether it was correct, and how many seconds it took. The student's teachers see every attempt. When a student has failed the same assessment three or more times with very quick answers (most answers under 4 seconds), the teacher's view adds a likely guessing note so they can step in. The note is worked out from those timings each time the page loads and is not stored. Students can see their own results.
• Work in progress — while a student is partway through a lesson, practice or assessment, the app saves where they are up to and what they have entered so far, so the teacher can see unfinished work and the student can carry on where they left off. Each save overwrites the last.
• Reflections and working typed by the student — short text a student types at the end of a lesson or assessment (for example what they found tricky), and in Beyond SOLO lessons their typed working, explanations and exit reflections. Read by the student's teachers, who can add a reaction (an emoji), a stamp or a short note that the student sees. Never shown to other students.
• Workbook pages — the drawings, placed shapes and typed text on the student's digital workbook pages and whiteboards, stored as pen strokes and text, not as images. Read by the student's teachers, who can stamp or write a note on a page. Never shown to other students.
• Questions a student writes for the class — in some Beyond SOLO lessons a student can write their own maths question. It is shown to classmates, with the student's first name, only after a teacher has approved it.
• "Right now" status — while a student has SOLO open, about once a minute the app sends which page they are on (for example "Unit 32 · Know · Q3"), whether the SOLO tab is on screen, and how many seconds since they last typed, tapped or moved the mouse. The student's teachers see this as Active, Idle, Away (another tab) or Not on SOLO, and only while the student is using SOLO. Each update overwrites the last, and the record is deleted automatically within 24 hours of the last update. No keystrokes, other tabs, websites or screen contents are recorded.
• Progress ticks and test results — which content points the student has passed and their pre/post test and unit review results. Seen by the student's teachers and the student.

3.4 Technical data

Using Word Labs sends a device's IP address and browser details to the services below, students' devices included. These are the only places they go:

• Supabase (Sydney) — our database, which every page connects to. Supabase's hosting and CDN provider, Cloudflare, carries these connections and receives the same details, and keeps its own logs under its own schedule. When a class code is not recognised, and when the feedback form is sent, we keep a shortened hash of the IP address, never the address itself, to limit guessing and repeat sending. After a failed login we keep a short-lived hashed form of the name, readable only by the database service role, to limit guessing. Hashes are removed by routine clean-up once they are more than two days old.
• Vercel — our hosting provider logs them for security and performance. This data is not linked to individual user accounts and is deleted within 30 days.
• GitHub Pages — only for devices using the copy of the website for school networks that block Vercel. GitHub keeps its logs under its own schedule.
• YouTube (Google LLC) — only in the SOLO maths tracker. The player loads only when the student taps Watch here, and a YouTube link opens only if the student chooses it. YouTube keeps this information under its own schedule.
• Other websites — a lesson resource link opens only if the student chooses it, and that website then receives these details as any website does.
• Stripe — teachers only, when they use checkout or manage a subscription.

4. How We Use Personal Information

We use personal information only for the purposes for which it was collected:

• Teacher email — to enable login, send account-related emails (password reset, subscription receipts), and to respond to support requests
• School name — to identify the school in the dashboard and on invoices
• Student first names — to display in the teacher dashboard so teachers can identify their students' results
• Student scores and progress — to show teachers which students need support (heatmaps, intervention flags)
• In-game currency and badges — to power the student reward system within the platform
• SOLO answers, timings, work in progress, reflections and typed working — to show the student's teachers how each student worked through a maths outcome, where they are stuck, and whether quick repeated attempts suggest guessing, so the teacher can step in
• SOLO workbook pages — to give students a place to show their working and let the teacher check and comment on it
• SOLO "right now" status — to let the teacher see, during a lesson, who is working, idle or on another tab without walking to every screen. It is used for nothing else and is deleted within 24 hours

We do not use personal information for advertising, profiling, or any purpose beyond operating the service.

5. Children's Privacy

Students use Word Labs under the supervision and authority of their school. The school (through the teacher) is the data controller for student records. Word Labs acts as a data processor on the school's behalf.

A teacher sees a class and its students only if they are on that class. A teacher already on a class can add another teacher from the same school as a co-teacher.

Teachers are responsible for ensuring they have appropriate authority to add students to the platform, consistent with their school's privacy policies and any applicable parental consent requirements. A plain-language Parent Privacy Summary is available for schools to share with families.

We do not knowingly collect information directly from children without teacher involvement. Students do not create accounts — they are added by their teacher using only a first name.

5.1 NSW government schools — IPP 2 (Direct Collection)

Under the PPIP Act s.9 (IPP 2), where a student is under 16, personal information should be collected from a parent or guardian. In practice, NSW government schools collect student names from parents at enrolment. The teacher then enters the student's first name into Word Labs under the school's existing authority. No information is collected directly from children — only from the teacher acting on behalf of the school.

Schools using Word Labs should include it in their standard third-party application consent process (e.g. the annual ICT usage notification sent to parents at enrolment). The Parent Privacy Summary may be shared with families as part of this process.

6. Where Data Is Stored

All student and teacher data is stored in Australia using Supabase (PostgreSQL), hosted in the Sydney region (ap-southeast-2). This meets data sovereignty requirements for Australian government schools, including NSW.

Subscription and payment data is handled by Stripe, which stores data in the United States. Stripe does not receive any student data — only teacher/school name, email, and billing information.

6.1 Transborder disclosure — PPIP Act s.19 (IPP 12)

Student records are stored only in Australia. All student records (names, codes, scores, character data, and SOLO answers, reflections, workbook pages and status) are stored exclusively in Supabase's Sydney data centre. No student record is stored by any overseas sub-processor.

In transit, student records pass through Cloudflare, Supabase's hosting and CDN provider. The connections to and from Cloudflare are encrypted, and Cloudflare does not cache student records by default. For a school outside Australia, that transit may pass through a Cloudflare edge in the school's own region.

The website is served through Vercel's global content delivery network, which receives each visiting device's IP address and browser type, students' devices included, as any website host does (see Section 7). Student records do not pass through Vercel: the browser talks to Supabase directly.

Teacher billing data (email and school name) is shared with Stripe (US) for payment processing. Word Labs takes reasonable steps (per s.19(2)(g)) via Stripe's contractual data processing agreement to ensure this data is handled consistently with the IPPs. Anthropic (US) receives teacher-typed word lists (including the words and morphemes a teacher chooses to translate) and teacher-drawn shop item images, with the name and description the teacher gives the item, for analysis and redrawing. Anthropic never receives any student record. This happens only for schools that have asked for AI features to be switched on. API data is not used to train models under Anthropic's Commercial Terms of Service. Google Cloud (US/global) provides text-to-speech audio for read-aloud buttons, the Spelling Check-In and EALD pronunciation features — only the word or lesson text being read is sent, no student data. Resend (US) delivers transactional emails to teachers — no student data is involved.

7. Disclosure of Personal Information

We do not sell, rent, or share personal information with third parties for marketing purposes. Disclosures are made only where directly related to the purpose of collection and within the reasonable expectations of the individual, consistent with IPP 11 (PPIP Act s.18). We may share data with:

• Supabase Inc. — our database and authentication provider (data stored in Australia).
• Cloudflare, Inc. (United States) — hosting services and CDN for the Supabase API; student records are stored in Sydney and are not cached by Cloudflare by default. See Sections 3.4 and 6.1.
• Stripe Inc. — payment processing for subscriptions (teacher/billing data only, no student data)
• Anthropic PBC (US) — receives teacher-typed word lists (including the words and morphemes a teacher chooses to translate) and teacher-drawn shop item images, with the name and description the teacher gives the item, for analysis and redrawing. Anthropic never receives any student record. Analysed words and their analyses are kept in a word cache in Sydney and reused for any school that asks for the same word. The cache is shared content: it holds no student, class, teacher or school reference, a teacher's edit to an analysis stays there for Word Labs to review, and it remains after a school leaves. This happens only for schools that have asked for AI features to be switched on. API data is not used to train models under Anthropic's Commercial Terms of Service.
• Google Cloud (Google LLC) — text-to-speech audio generation for read-aloud buttons in the activities and the SOLO maths tracker, the Spelling Check-In assessment and EALD pronunciation features. Only the word or lesson text being read is sent — no student data is involved.
• YouTube (Google LLC) — some lessons link to maths videos on YouTube. In the SOLO maths tracker a student can choose "Watch here" to play the video beside their work, using YouTube's privacy-enhanced player (youtube-nocookie.com). The player only loads when the student taps the button. YouTube receives the device's IP address and browser details, as it would if the video were opened on youtube.com. No names, codes, scores or other student data are sent to YouTube.
• Resend Inc. — transactional email delivery (feedback forms, school quote requests). Only teacher email addresses are involved — no student data.
• Vercel Inc. (US, CDN edge globally) — website hosting and global content delivery (CDN). Receives the IP address and browser type of every device that visits, students' devices included, in web request logs. These are not linked to user accounts and are deleted within 30 days. No student data.
• GitHub Pages (GitHub, Inc., US, CDN edge globally) — a copy of the website for school networks that block Vercel. Receives the IP address and browser type of devices that use the copy. No student data.

We may disclose personal information if required by Australian law or a valid court order.

8. Payment Data

Word Labs uses Stripe to process subscription payments. We do not store credit card numbers or bank account details. Payment information is handled entirely by Stripe and is subject to Stripe's privacy policy.

Schools that pay by purchase order (invoice) will have their school name and invoice contact email stored in our records for accounting purposes.

9. Data Retention

• Active accounts: data is retained for as long as the subscription is active
• After cancellation: data is retained for 90 days to allow recovery, then permanently deleted
• Deleted classes: all student records (names, codes, scores, character data, SOLO answers, reflections, workbook pages and status) are cascade-deleted immediately when a teacher deletes a class
• SOLO "right now" status: overwritten about once a minute while the student uses SOLO and deleted automatically within 24 hours of the last update
• SOLO work in progress: overwritten each time the student continues that lesson, practice or assessment
• Teacher account deletion: classes only that teacher is on, and their student records, are permanently deleted on request. Classes shared with a co-teacher stay with them. If they are the school's last teacher, all of the school's data is deleted too
• Backups: Supabase keeps database backups for 7 days. A deleted record stays in those backups until they age out, then it is gone.

10. Your Rights (APP 12 & 13)

Under the Australian Privacy Act, you have the right to:

• Access personal information we hold about you or your students
• Correct inaccurate information
• Request deletion of your account and all associated data
• Complain about how we handle your information

To exercise any of these rights, contact us at nick@wordlabs.app. We will respond within 30 days.

11. Data Breaches (Notifiable Data Breaches Scheme)

Word Labs is subject to the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988. In the event of an eligible data breach that is likely to result in serious harm, we will:

• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable (within 30 days of becoming aware)
• Notify affected individuals (schools/teachers) directly by email
• Take immediate steps to contain the breach and prevent recurrence

12. Cookies and Local Storage

Word Labs uses browser storage — not advertising cookies — as follows:

• Supabase session cookie — stores your login session (teacher auth token). Required for the service to work. Expires when you sign out or after the session timeout.
• sessionStorage — stores the student's current game session (name, class). Cleared automatically when the browser tab is closed.
• localStorage — stores minor UI preferences (e.g. whether the storage notice has been dismissed).

We do not use advertising cookies, tracking pixels, or any third-party analytics scripts. No student data is ever written to cookies.

If a student chooses "Watch here" on a SOLO video, YouTube's privacy-enhanced player may store its own browser data while the video plays. Students who don't use "Watch here" can open the same videos on youtube.com instead.

13. Security

We implement the following security measures:

• All data in transit is encrypted via HTTPS/TLS
• All data at rest is encrypted by Supabase
• Database access is controlled by Row Level Security (RLS) policies — teachers can only access classes they are on, and only within their own school
• Teacher authentication uses Supabase Auth (bcrypt-hashed passwords)
• Students use randomly generated codes (not passwords) — no sensitive credentials are issued to children

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify teachers by email and update the "Last updated" date at the top of this page. Continued use of Word Labs after notification constitutes acceptance of the updated policy.

15. Contact Us

For privacy questions, data requests, or complaints, contact:

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

For matters involving NSW government schools, complaints may also be lodged with the NSW Information and Privacy Commission (IPC) — phone 1800 472 679.

16. Schools Outside Australia

Word Labs is an Australian service. Wherever a school is, its student records and teacher accounts are stored in Australia, in Supabase's Sydney data centre. Teacher billing data is held by Stripe in the United States (see Section 6). For a school outside Australia, that transit may pass through a Cloudflare edge in the school's own region.

Australian law, including the Privacy Act 1988 (Cth), and the Australian Privacy Principles govern how Word Labs handles this information.

A school outside Australia is responsible for confirming that storing student data in Australia is permitted under its own law, and for obtaining any parent consent its law requires.

The Privacy Contact is Nicholas Deeney, nick@wordlabs.app.

16.1 United States schools: Children's Online Privacy Protection Act (COPPA)

For US schools, Word Labs collects from children under 13 only the items listed in Sections 3.2 to 3.4 of the Word Labs Privacy Policy. These include a device's IP address, which goes only to the recipients named in Section 3.4: Supabase and its hosting and CDN provider Cloudflare, Vercel, GitHub Pages, YouTube, whose player loads only when the student taps Watch here, and any other website a student chooses to open from a lesson link. Word Labs uses them solely to provide the service to the school, never for advertising or profiling, does not disclose them except to the sub-processors listed in Section 7 of that policy, and, on the school's request, deletes all records Word Labs holds; sub-processors' transient logs and backups expire on their own schedules, set out in Sections 3.4 and 9 of that policy. The school or teacher, by adding a student, confirms they are authorised by the school to consent on the parent's behalf for educational use, and that parents have been given the Privacy Policy.

US schools can give parents this paragraph as a one-page Direct notice for US schools (PDF).

16.2 UK and EU schools

We do not yet offer a GDPR data processing agreement; contact us before adding students from the UK or EU.