Privacy Policy

• A parent or guardian holds the account. For a child we keep only a first name, a year level and their practice results.
• Your data is stored in Sydney. A few service providers (email, payments, analytics and AI) process some of it overseas; section 8 lists who and why.
• We never sell your data, never show ads, and never show your child’s name or results to other families.
• You can delete your account yourself at any time, and everything we hold goes with it (section 10).

1. About This Policy

PrepPath (ABN 76 481 196 332) (“we”, “us”, “our”) runs preppath.com.au and the PrepPath application (together, the “Service”). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Policy explains what we collect, why, where it is kept, who else handles it, and your choices. It is written to be read by parents. If anything is unclear, email us at support@preppath.com.au.

2. Who Uses PrepPath

• Parents and guardians. The account holder must be a parent or guardian aged 18 or over, and confirms this when setting up the account. Children practise under that account.
• Families. A parent can add up to four children to one account. Each child gets their own progress. Only the parent can see every child’s results; a child does not see a sibling’s.
• Schools. A school can give its students access through a teacher. Section 6 covers how that works.
• Guests. Anyone can try sample questions without an account. We do not ask guests for any personal information.

3. Information We Collect

Account.Your email address, and a password that is stored only in hashed form by Amazon Cognito (we never see it). If you choose “Continue with Google”, Google tells us your email address and nothing else we keep.

About your child.A first name (or nickname) and year level for each child, and a record that you agreed to this Policy and when. If you use a family PIN, we keep it only in hashed form. We do not ask for a child’s surname, date of birth, address, school or photo.

Practice results. For each session: subject, year level, difficulty, score and date. For each question: whether it was answered correctly. This is what lets the Service show progress and choose the next questions.

Mock events.If you register a child for an event such as the OC Mock Day: the child’s first name and year level, your email, whether you want reminder emails, and the child’s answers, timings and score.

Writing. When a child asks for feedback on a piece of writing, the text is sent to an AI provider to produce the feedback (section 7). We do not keep the writing itself; we only count how many pieces were marked each month.

Problem reports. If you report a problem with a question, we keep the question, the issue you chose, your comment, and a link to your account so we can follow up.

Payments. Card payments are handled by Stripe. We never see or store your card number. We keep your Stripe customer reference and your plan status (for example: trial, paid, cancelled, and when access ends).

Emails to us. If you write to us, we keep the correspondence to deal with your request.

Technical data. Our content delivery network (Amazon CloudFront) logs standard request details, including IP address and browser type, which we keep for 14 days for security and troubleshooting. We also use anonymous product analytics (section 12).

4. How We Use Your Information

• To run the Service: sign-in, practice sessions, progress, mock papers and events
• To personalise practice, for example to skip questions already mastered and bring back ones that were missed
• To take payments and manage subscriptions
• To answer your questions and fix reported problems
• To keep the Service secure and prevent misuse
• To improve the Service, using anonymous analytics and the problem reports you send
• To send you emails (below)

Emails we send.Account and billing emails (sign-up codes, password resets, trial and subscription notices), which you receive while you have an account. We also send a weekly summary of your child’s practice, an occasional reminder if practice has stopped (at most two), emails for any event you register for, and news about PrepPath’s own features and events. Every one of these includes a one-click unsubscribe, and you can turn them off in Settings at any time. We never send advertising for other businesses.

We do not sell personal information, and we do not use it for advertising.

5. Children's Privacy

PrepPath is built for children, so we keep what we hold about them to a minimum:

• A child does not need an email address, and we do not ask a child for personal information
• The parent controls the account and can see, change or delete a child’s data at any time
• We never show a child’s name or results to other families. Where an event result compares a child with other participants, it shows only an anonymous band or percentile, and only once at least 20 children have finished
• No advertising, no selling of data, and no profiling for marketing
• Analytics and session recordings are switched off for school students and class devices

If you believe a child has an account without a parent’s or guardian’s consent, email support@preppath.com.au and we will delete it promptly.

The Office of the Australian Information Commissioner is developing a Children’s Online Privacy Code. We will update our practices and this Policy when it takes effect.

6. Schools

When a school uses PrepPath, a teacher creates a class and adds students. We keep only each student’s first name and surname initial; any full surname entered is discarded. Students sign in with a class code and a 4-digit PIN. They have no email address with us, and we send them no emails.

A teacher sees the results of students in their own classes; a school coordinator can see the whole school. Analytics are off for students. AI features are off unless the school turns them on. The school is responsible for telling parents about its use of PrepPath and for any consent it needs. The school’s agreement with us sets out how long class data is kept and how quickly it is deleted.

7. AI Features

Some features use third-party AI models: the AI Tutor (which explains a practice question and answers follow-up questions) and writing feedback. When these are used, we send the AI provider the practice question and what the child types: their follow-up questions, or the text of their writing (up to about 3,000 characters), with the writing prompt and year level. We never send a name, email address or account identifier.

We currently use Groq, Google (Gemini), Mistral, OpenRouter, NVIDIA, Cloudflare and Typhoon, and use whichever is available at the time. They process requests on servers in the United States, Europe and Asia. Some of these services may keep what is sent to them, or use it to improve their own models.

Please make sure children do not type real names, addresses or other personal details into these features. Our instructions tell the AI not to repeat any personal details it sees, but we cannot remove them from what is sent. Some practice questions and explanations are also written with AI help and then checked.

8. Where Your Data Is Stored and Who Else Handles It

Your account, your child’s profile and practice results are stored on Amazon Web Services in Sydney, Australia. We use these service providers, who handle personal information only to provide their service to us:

• Amazon Web Services (Australia): hosting, database and sign-in. Its content delivery network keeps request logs, including IP addresses, for 14 days; these logs are stored in the United States.
• Brevo (European Union): sends our emails. Brevo holds your email address, your child’s first name and year level, your plan details, and which emails you have received. It holds nothing about school students.
• Stripe (United States and elsewhere): payments.
• Google (United States): only if you choose “Continue with Google”.
• PostHog (United States): anonymous product analytics (section 12).
• AI providers (United States, Europe and Asia): see section 7.

Because some of these providers are overseas, some personal information is handled outside Australia. We choose established providers and send each one only what it needs for its job.

We may also disclose information if the law requires it. If PrepPath is sold or merged, your information would pass to the new owner under this Policy, and we would tell you first.

9. Security

We use encrypted connections (HTTPS), hashed passwords and PINs, and access controls that limit who can see your data. No system is perfectly secure, but if a breach is likely to cause serious harm we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

10. Keeping and Deleting Your Data

We keep your data for as long as you have an account. We do not currently delete inactive accounts automatically.

You can delete your account yourself: open Session History and choose “Delete my account”, or email us. Deleting the account immediately removes your profile, every child on the account with their practice history and event results, your sign-in, and your contact record with Brevo. Copies in our backups expire within 60 days. Some records stay where needed:

• Stripe keeps payment records that tax law requires
• Problem reports you sent about questions are kept to improve those questions, with no name or email address attached
• Anonymous analytics are not linked to your account and are not deleted with it

11. Your Rights

You can ask us to:

• Give you a copy of the personal information we hold about you or your child
• Correct anything that is wrong (you can change a child’s name or year level yourself in Settings)
• Delete your account and data (section 10)
• Stop sending you emails other than account and billing emails

Email support@preppath.com.au. We will reply within 30 days. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC).

12. Cookies, Browser Storage and Analytics

Apart from the analytics identifier described below, PrepPath sets no cookies. While you are signed in, your sign-in is kept in your browser’s session storage, which clears when you close the browser. Your browser’s local storage remembers quiz settings, an unfinished quiz, and which questions have already been shown.

We use PostHog, an analytics service, to see which pages and features are used and to find problems. We do not tell PostHog who you are: no name, email or account identifier is sent. PostHog stores an anonymous identifier in your browser. It also makes session recordings, replays of clicks and page changes that we watch only to fix problems. Anything typed into a form, including answers and email addresses, is hidden in recordings, and so are children’s names wherever they appear on screen. Analytics and recordings are off for school students and class devices.

The Stripe payment page and the Google and Amazon sign-in pages are on those companies’ own websites and set their own cookies under their own policies. We use no advertising or cross-site tracking cookies.

13. Automated Processing

The Service uses computer programs to choose which practice questions to show, to work out scores, estimated bands and readiness indicators, and (with AI) to write feedback on writing. These are for practice only. None of them makes a decision with legal or similarly significant effects on anyone. No placement, school entry or official result depends on them.

14. Changes to This Policy

When we change this Policy we update the effective date at the top. For significant changes we tell account holders before they take effect, by email or with a notice on the website.

15. Contact Us

For privacy questions or requests: