Privacy Policy

This Privacy Policy explains what personal information Korva Academy collects, how we use it, and the choices you have. Korva Academy is bound by the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Operated by a Western Australia sole trader, ABN 14554829654.

1. What we collect

From parents

• Email address — used to log in, send essential account notifications, and receive payment receipts from Stripe.
• Password (hashed) — never stored in plain text; Korva staff cannot read it.
• Name (optional) — only if you choose to provide it.
• Billing data via Stripe — Korva does NOT store card numbers. Payment is handled entirely by Stripe; we only retain a Stripe customer ID so we can show your invoices and manage your subscription.
• Consent timestamp — when you confirmed at registration that you are the account holder (18+) and agreed to the subscription terms.

From player profiles (created by the parent account)

• A nickname or label chosen at creation (e.g. "Star", "Pixel"). This is the only identifier we store for a player profile.
• Optional 4-digit PIN set by the parent, used only at the profile-picker page.
• Anonymised practice answers — questions attempted, accuracy, time per question, mistake history, daily streak.
• Chat messages with the Fo tutor, when the player uses the Socratic-hint feature.

2. What we do NOT collect

• We do not collect children's real names, surnames, ages, birthdays, schools, postal addresses, phone numbers, photos, or location data.
• We do not use marketing trackers or advertising cookies. Cookies are limited to: session authentication, CSRF protection, and Flask preferences.
• We do not sell, lease, or share personal information with third parties for marketing — ever.

3. How we use the information

• To deliver the practice service — generating questions, scoring them, showing progress.
• To send essential account communications (billing receipts handled by Stripe; service-status emails if there's an outage; replies to support requests you initiate).
• To debug and improve the service — aggregated, de-identified usage helps us see which question types are too easy or too hard.
• To meet legal and tax obligations.

4. Third parties we share data with

• Anthropic — to generate practice questions and tutor responses. We send the question prompt and the player's anonymised question text. We do NOT send the player's nickname, parent email, or any other identifying data. Anthropic's privacy policy: anthropic.com/legal/privacy.
• Stripe — to process subscription payments. The parent's email and payment information goes to Stripe; nothing about the player is shared. Stripe's policy: stripe.com/au/privacy.
• Our hosting provider — typical web-server logs (IP, user-agent, request path, response code) for security and performance monitoring.

We do not use Google Analytics, advertising pixels, Facebook tracking, or any other behavioural-tracking system.

5. Data retention

• Active-account data is kept while your account is active.
• On account deletion (one-click from your dashboard), data is hard-deleted within 30 days. We may retain aggregate, de-identified statistics.
• Raw text of writing responses is automatically deleted within 24 hours of being scored — we keep the score, the AI feedback summary, and the word count only.
• Stripe retains payment records as required by Australian tax law; you can request those records from Stripe directly.

6. Your rights

• Access — you can see your account data and player practice activity any time on the dashboard.
• Correction — update your email, name, or player profiles from the dashboard.
• Deletion — the "Delete account" button in Settings hard-deletes the parent account, all player profiles, all sessions, all chats, and all mistake history.
• Data export — email privacy@korvaacademy.com.au and we will send a JSON dump of all data associated with your account within 14 days.
• Complaint — if you believe we've mishandled your data, contact us first; if not resolved within 30 days you may contact the Office of the Australian Information Commissioner (oaic.gov.au).

7. Children's data — specific protections

See our Child Safety page for the full list. Highlights:

• Player profiles use nicknames, never real names, ages, or schools.
• The Fo AI tutor is system-prompted to discuss only ACER-style practice content; if a player shares personal information, Fo redirects without acknowledging or storing it.
• Parents control all settings, including PIN protection.
• No marketing emails are ever sent. Korva does not display children's email anywhere because children do not have email accounts in our system.

8. Cookies

Korva uses only essential cookies (session, CSRF). We do not show a cookie banner because we do not track you and do not share with third parties for marketing. If we ever add analytics or marketing tooling, this policy will be updated and a cookie banner will appear.

9. Changes

If we materially change this policy, we will email account holders at least 14 days before the change takes effect.

Contact

Privacy questions: privacy@korvaacademy.com.au. General support: hello@korvaacademy.com.au.