Papa Science
Privacy Policy
Last updated 5 September 2026 · Version 2026-09-05
Draft — revised after legal review on 5 September 2026 and awaiting final sign-off. It describes what Papa Science actually does today, but it has not yet been approved by a qualified reviewer.
Papa Science is a science practice tool for NSW primary students. A grown-up creates the account; children use it to learn. This page explains what we hold, why we hold it, and who else can see it. It is written to be read, not to be survived.
Who we are
Papa Science is a small independent product built and run from Thornleigh, New South Wales, Australia. It is not a large company — it is a handful of people making a science practice tool, and you can reach us directly at xpandservices@proton.me.
What we collect
From the grown-up
- Email address and a password, which we store only as a one-way hash — we cannot read it.
- Optionally a 4-digit passcode, also stored as a hash.
- Notification preferences, and the email address for the parent summary if you turn it on.
About each child
- The name or nickname you enter — this can be a first name or anything you prefer.
- Their school year, chosen avatar, pacing preference, and optionally their ICAS exam date.
- Optionally a PIN, stored as a hash, if you set one for switching between children.
We do not ask for a child’s surname, date of birth, school, address, photograph or contact details, and there is nowhere to enter them.
What happens as they learn
This is the bulk of what we hold: which lessons and sections they have opened and completed, which questions they answered and what they chose, quiz and practice scores, timed exam sittings, flagged questions, bookmarks and notes, stickers and badges earned, vocabulary encountered, review scheduling, and when they were last active.
We keep it because it is the product — it is how the app knows what to suggest next, what to revisit, and what to show you on the parent screen.
Technical information
- Cookies that keep a child signed in and remember which paper and learner is active. They are essential to the app working; there are no advertising cookies.
- A keyed hash of the network address used for sign-in and email requests, to stop someone hammering the login or using us to send unwanted email. It is an HMAC made with a secret only we hold: we store that hash rather than the address, and we do not log the raw address.
- Web-push subscription details, only if push notifications are enabled.
Not true yet — engine work outstanding. Sign-in and email rate limiting already store a hash rather than an address, but the password-recovery table still keeps the raw address in its request_ip column for its own hourly limit. The paragraph above is only accurate once that column moves to the keyed hash as well.
What we do not do
- We do not sell your data, or a child’s.
- We do not show advertising, and there are no advertising or tracking cookies.
- We do not record sessions or replay what a child does on screen.
- We do not send analytics events containing names or email addresses — the code rejects them.
Who else can see it
Running Papa Science means a few other companies handle some of this information on our behalf. This is the whole list — what each one gets, why it gets it, and which country it is in.
| Service | Country | What it receives | Why |
|---|---|---|---|
| Neon — our database | Australia (Sydney) | Everything listed above: the grown-up’s email address, the hashed password, passcode and PIN, each child’s name or nickname and settings, and the whole learning history. | It is where the app’s data lives. |
| Vercel — hosting | United States | Every request your browser makes, which carries the network address, the page asked for and the sign-in cookie. Vercel also keeps short-lived request logs. | It serves the site and runs the app’s server code. |
| Resend — email delivery | United States | The grown-up’s email address and the contents of what we send: verification codes, password recovery, account approval, and — if you turn the weekly summary on — a child’s name or nickname with that week’s minutes, sessions, accuracy and topics. | We do not run our own mail server. |
| PostHog — product analytics | United States | A learner’s internal id and the name of something that happened, such as opening a lesson. No names, no email addresses, no answers. Session recording and automatic click capture are switched off in our setup. | To see which parts of the app get used, and which confuse people. |
| Sentry — crash reporting | United States | The technical detail of a crash: the page, the error and our own internal ids. Network addresses and browser headers are switched off in our setup, and there is no session replay. | So we find out when something breaks instead of waiting to be told. |
| Linear — our issue tracker | United States | Only when someone reports a problem with a question or a lesson: the category, the question’s id, the page it was on and whatever was typed in the note box. No name, no email address, no learner id. | So a reported mistake reaches whoever has to fix it. |
| YouTube, and Vimeo for one video | United States | When a child presses play, their browser asks YouTube or Vimeo for that video, which tells them the network address and which video was wanted. We use YouTube’s no-cookie player and load nothing from it until play is pressed. | Some lessons include a short explainer video. |
| Your device’s push service (Apple, Google or Mozilla) | Depends on the device | The subscription address the browser issues, and the text of the notification. Only if you turn notifications on. | It is the only way a browser can deliver a notification. |
Two other services touch our own material rather than your family’s: an image generator we use to draw diagrams, and YouTube’s catalogue lookup for video details. Both run on our machines while we write lessons, and neither is given anything about a family.
What that means for information leaving Australia
Only the database is in Australia. Vercel, Resend, PostHog, Sentry and Linear are in the United States, so using Papa Science does involve some information about your family being disclosed overseas. We would rather say that plainly than leave you to work it out. For analytics there is no Australian option at all — the provider offers the United States or the European Union.
The database in Sydneyis the only place a child’s record and their full learning history live. What crosses a border is thinner: email addresses and the text of the emails we send (which, for the optional weekly summary, includes a child’s name and that week’s figures), the technical detail of requests and crashes, and analytics events made of an internal id and the name of something that happened.
Handing information to one of those companies does not hand over the responsibility. We remain accountable for how each of them treats it, and if one of them mishandles information about your family, that is ours to answer for — raise it with us the way you would raise anything else.
Founder to confirm data-processing agreements with Vercel, Resend, PostHog and Sentry are on file before this sentence goes live: “We have a written data-processing agreement with each of them covering how they may handle it.” Also confirm which region the Sentry project sits in — its address is only set in the hosting environment, so it cannot be read from the code.
Children’s information
Papa Science is intended to be set up and supervised by a parent or carer. The account belongs to the grown-up: you create it, you decide which children are on it, and you can see what each child has done.
We deliberately collect as little about a child as the product can work with. A nickname is enough — you never have to give us a full name.
How consent is given, and how we record it
The account is created by a parent or guardian. At sign-up you tick a box confirming that you are the parent or carer of the child you are about to add, that you accept the Terms of Useand this Privacy Policy, and that you consent to your child’s learning data being handled the way this page describes.
We record which version of each document you accepted and when — the version shown at the top of this page. If we change this Policy in a way that materially affects what we collect or who sees it, we ask you again at your next sign-in rather than letting an old tick carry forward.
Decisions the app makes on its own
Three parts of Papa Science decide something without a person involved:
- Which questions come back, and when. A spaced-review scheduler watches whether each question was answered correctly and sets the gap before it reappears — a wrong answer brings it back tomorrow, a run of right answers pushes it further out.
- What “practise weak spots” serves. Adaptive practice builds a session from the questions that are due for review, and from the topics the recorded answers show as weakest.
- The ICAS readiness estimate, which turns practice-paper scores into an award band. It is paused at the moment and shows nothing while we recalibrate it against real results.
All three decide what to show a child next. None of them decides anything a family is entitled to: they cannot refuse an account, close one, or change what you can use. Accounts are approved by a person, by hand.
Nothing is hidden behind them, either. The scores they work from are the same ones on the parent screen, and you can ask us for the underlying records at any time. If a suggestion looks wrong for your child, tell us and we will look at it.
How long we keep it
While you are using Papa Science we keep your family’s learning history, because that is what makes it work — it is how the app knows what to revisit and when.
If an account goes unused for 24 months, we delete it and everything attached to it. We chose 24 months rather than 12 deliberately: ICAS runs once a year and families often come back the following year for the next paper, so a shorter window would throw away a child’s history over a quiet stretch.
If you ask us to delete your data, we do it within 30 days and confirm when it is done.
Some records outlive the account for a short period where we genuinely need them — for example an email delivery log, or something we are required to keep. We do not keep a child’s learning history for years after they have stopped using the product, and we would rather say that plainly than quote a longer period we cannot justify.
Asking for your data, or its deletion
You can ask us what we hold about your family, ask for a copy, or ask us to delete it. We are a small operation and handle these by hand rather than through a button in the app, so please email us and we will confirm what we have done.
Email xpandservices@proton.me and tell us which household you are asking about. Please do not reply to an automated email from us — that address only sends and cannot receive.
If you want to complain
If you think we have mishandled information about your family, tell us. Email xpandservices@proton.me, say what happened and what you would like done about it. It goes to the same people who build the product — there is no queue to get through.
We will acknowledge a complaint within 7 days and give you a full answer within 30 days: what we found, what we have changed, and what we could not do.
Founder to confirm these two periods before this goes live — 7 days to acknowledge and 30 days to answer are our proposal, not a settled commitment. Once published they are a promise we have to keep.
If our answer does not satisfy you, or we do not answer, you can take it to the Office of the Australian Information Commissioner (OAIC), the regulator for Australian privacy law. Their site is www.oaic.gov.au, and they explain there how to make a privacy complaint. You do not need our agreement to go to them.
If there is a data breach
We are covered by Australia’s Notifiable Data Breaches scheme. If we have reason to think information about your family has been lost, taken, or seen by someone who should not have seen it, we work out how bad it is. The law gives us up to 30 days to make that assessment, and we would not expect to need anywhere near that.
If the breach is likely to cause serious harm, we notify the affected families and the OAIC as soon as practicable. What we would tell you: what happened and when, which information was involved, what we have done since, and what you should do yourself — for instance change a password you also use somewhere else.
We would rather tell you early and look disorganised than sit on it while we decide how it looks.
Keeping it safe
Passwords and passcodes are stored as one-way hashes. Sessions use signed cookies. Sign-in and email endpoints are rate limited. Data is encrypted in transit. No system is perfect, and we will not pretend otherwise — but we do not hold payment details, and we do not hold the kinds of identifying details about a child that would make a breach personally dangerous.
Changes
If we change this policy we will update the date and version at the top. If a change materially affects what we collect or who sees it, we will email the grown-up on the account and ask you to accept the new version at your next sign-in.
- 2026-09-05 — revised after legal review: processor list, complaints and breach sections, consent record, automated decisions, acceptance and boilerplate.
- 2026-09-01 — retention periods written down.
- 2026-08-31 — first full draft, replacing the placeholder page.