Privacy Policy

1. About This Policy

PrepPath (“we”, “us”, “our”) operates the website preppath.com.au and the PrepPath application (together, the “Service”). We are committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Policy explains what information we collect, why we collect it, how we use and store it, and your rights regarding that information. By using the Service you agree to the practices described in this Policy.

2. Information We Collect

Account information. When you create an account we collect your email address and a hashed password. We do not store your password in plain text.

Practice data. When you complete a quiz we record your score, the subject and year level practised, the difficulty level, and a timestamp. For logged-in users we also record which individual questions were answered and whether each was answered correctly, so the Service can personalise future sessions.

Usage data. Our hosting infrastructure (Amazon Web Services) may automatically log standard technical information such as your IP address, browser type, and pages visited. This data is used solely for security monitoring and service reliability and is not used to identify you personally.

Communications. If you contact us by email we retain that correspondence to respond to your enquiry and to improve the Service.

We only collect personal information that is reasonably necessary to provide the Service.

We do not collect payment card details directly. If payment processing is introduced, it will be handled by a PCI-compliant third-party provider (such as Stripe) and we will never see or store your card number.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Personalise practice sessions — skipping questions you have already mastered and repeating questions you found difficult
• Display your session history and progress
• Respond to your support enquiries
• Send you transactional emails (e.g. password reset) and a periodic summary of your child's practice and progress. These progress emails are part of the Service; every one includes a one-click unsubscribe and you can turn them off anytime in your account settings. We do not sell your data or send third-party advertising, and we will always ask for separate consent before any unrelated marketing.
• Detect and prevent fraud, abuse, or security incidents

Some content is AI-generated. If you use the optional AI Tutor, the practice question and what you type are sent to third-party AI providers to produce a response. These providers may retain that input and use it to train or improve their own models. We never send your name, email, or account details — but do not type personal or identifying information into the AI Tutor. See sections 5 and 7.

We do not sell your personal information to third parties. We do not use your data for advertising purposes.

4. Children's Privacy

PrepPath is designed to be used by school-age children under parental or guardian supervision. We do not knowingly collect personal information from children under 13 without verifiable parental consent.

Parents or guardians may request access to or deletion of their child’s data at any time.

If you are a parent or guardian and believe your child under 13 has created an account without your consent, please contact us at support@preppath.com.au and we will promptly delete the account and all associated data.

We recommend that parents create accounts on behalf of younger children and supervise their use of the Service.

5. Data Storage and Security

Your account and practice data are stored on Amazon Web Services infrastructure located in Sydney, Australia (ap-southeast-2 region). One exception applies: if you use the optional AI Tutor or other AI-assisted features, the text you submit to those features is sent to third-party AI providers that may process it on servers located outside Australia. Aside from this, your personal information is not transferred overseas. We take reasonable steps to ensure any overseas processing is limited to generating your requested response.

We implement reasonable technical and organisational security measures including encrypted data transmission (HTTPS/TLS), hashed password storage via Amazon Cognito, and access controls limiting who can view your data.

No method of transmission over the internet is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

In the event of a data breach that is likely to result in serious harm, we will comply with our obligations under the Notifiable Data Breaches scheme.

6. Data Retention

We retain your account and practice data for as long as your account is active. If you request deletion of your account, we will delete or anonymise your personal information within 30 days, except where we are required to retain it by law.

7. Disclosure to Third Parties

We may share your information only in the following limited circumstances:

• Service providers. Amazon Web Services (hosting and authentication) and Stripe (payment processing, where applicable). These providers process data on our behalf and are bound by confidentiality obligations.
• AI providers. When you use the AI Tutor or other AI-assisted features, the content you submit is sent to third-party AI providers (which may be located overseas) solely to generate your requested response. We do not send them your name, email, or account identifiers.
• Legal requirements. If required by law, court order, or government authority.
• Business transfer. In the event of a merger or acquisition, your data may transfer to the new owner, who will be bound by this Policy.

8. Your Rights

Under the Privacy Act 1988 you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and personal data
• Complain about a breach of the APPs

To exercise any of these rights, email us at support@preppath.com.au. We will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

9. Cookies, Local Storage and Analytics

PrepPath uses browser localStorage to remember your quiz settings and, for guest users, which questions you have already seen. We do not use advertising or cross-site tracking cookies.

We use PostHog, a third-party product-analytics service, to understand how the Service is used and to diagnose problems. This includes usage events (such as which pages are visited and which features are used) and session recordings that replay on-screen interactions such as navigation and clicks. Session recordings are configured to mask personal information: email addresses, names, and anything you type (including your answers) are hidden in the recordings. PostHog may process this data on servers located overseas, including in the United States. We use it only to operate and improve the Service — never for advertising — and we do not sell it.

10. Changes to This Policy

We may update this Policy from time to time. When we do, we will update the effective date at the top of this page. For significant changes we will notify registered users by email. Continued use of the Service after changes are posted constitutes acceptance of the updated Policy.

11. Contact Us

For any privacy-related questions or requests, please contact us at: