Privacy Policy

Schools and teachers create classes and assign work; students join a class using a code their teacher gives them, then complete assessments through the Service. A student never signs up directly — an account is only ever created after a teacher shares a class join code, and it is the school's and teacher's responsibility to obtain any parental or guardian consent required by their own enrolment policies before a student under 18 uses the Service. We do not independently verify a student's age or obtain consent ourselves — we rely on the school's judgement, the same way most software a school licenses for classroom use works.

For every user (teacher or student), we collect:

• Name (as entered at signup)
• Email address
• Account role (teacher or student) and, for students, class membership
• Password — stored only as a salted cryptographic hash; we never see or store it in plain text

For teachers building assessments, additionally:

• Assessment content they author (questions, instructions, example material)
• Feedback they write for students

For students completing assessments, additionally:

• Their written responses (text, tables, equation working)
• Images they upload or paste in as part of a response (e.g. photos of working, graphs)
• Timestamps of activity (when work was started, saved, and submitted) and word counts

We do not ask for or require sensitive information (health, disability, custody arrangements, government identifiers, and similar categories) as a structured part of using the Service. However, response fields are open text and image uploads — if an assessment topic leads a student to write about or depict something sensitive, that content is stored the same way any other response is. We don't scan, read, or use response content for any purpose beyond delivering the Service (see “How we use it” below) — but if you're a teacher setting an assessment, it's worth keeping this in mind when choosing topics for younger students.

Directly from the user (or, for a student account, at the point a teacher-issued class code is used to register), through the sign-up and assessment forms in the Service. We don't buy, scrape, or receive personal information about you from any other source.

We use personal information only to operate the Service:

• To create and secure accounts, and to make sure each user only ever sees their own or their own class's data
• To let teachers build, assign, and review assessments, and students complete and submit them
• To generate the final exported document a student downloads
• To provide autosave and draft recovery while a student is working
• To respond to support requests

We do not use personal information for advertising, marketing to users, profiling, or any purpose unrelated to delivering the Service. There is no advertising in the Service at all.

The fields collected at signup (name, email, password) are required to create an account — without them, an account can't be created and the Service can't be used. Within an assessment, a teacher decides which response fields are required for their own class; a student who doesn't complete a required field can still save and submit their work (per how the Service is designed, a student is never blocked from submitting by an incomplete field), but their teacher will see it as incomplete.

We do not sell, rent, or share personal information with third parties for their own purposes. The people who can see a student's work are: that student, their teacher, and (for class-wide comments) other students in the same class seeing only class-wide feedback, never another student's individual responses — access is enforced by database-level row security, not just application logic.

We do use a small number of infrastructure sub-processors to run the Service — companies that host or process data on our behalf, under contract, never for their own purposes:

• Supabase (database, authentication, and file storage) — data is hosted in Sydney, Australia (ap-southeast-2)
• Vercel (application hosting) — see “Overseas storage and processing” below for where this runs

We may also disclose personal information where required or authorised by law, or in connection with an actual or suspected security incident (see our Incident Response Plan) where disclosure is necessary to investigate or respond to it.

Our database, authentication, and file storage (Supabase) are hosted in Sydney, Australia. Our application hosting (Vercel) is pinned to the Sydney (syd1) function region, so requests are served from Australia rather than routed overseas. We do not use any sub-processor that stores personal information outside Australia.

If we ever plan to relocate or expand our hosting, our infrastructure providers, or any staff with access to unencrypted personal information into a new country, we will give advance notice of that change on this page before it happens, updating the date at the top of this policy.

Data is encrypted in transit (HTTPS/TLS) and at rest. Access to a student's or teacher's data is restricted by database-level access-control rules keyed to their account — not just checks in the application code — so that even a bug in the Service's own code can't easily expose one user's data to another. See our Information Security Policy for more detail on how we manage this.

We keep account and assessment data for as long as an account is active. We don't yet have an automated process for deleting data after a period of inactivity — if you'd like your or your class's data deleted, see “Access, correction and deletion” below.

A teacher can already see and edit their own assessments and account details directly in the Service. A student can see and edit their own in-progress responses directly. For anything beyond that — a full export of your data, correcting something you can't edit yourself, or deleting your account and associated data — contact us at privacy@voced1.com. We aim to respond within 30 days, free of charge. A parent or guardian can make this request on behalf of a student by contacting their school, who can verify the request and pass it on to us.

If you believe we've mishandled personal information, contact us first at privacy@voced1.com — we'll investigate and respond. If you're not satisfied with our response, Australian users can complain to the Office of the Australian Information Commissioner (OAIC), and New Zealand users to the Office of the Privacy Commissioner.

The Service uses one essential cookie to keep you signed in (set by Supabase Authentication). We do not use advertising cookies, analytics trackers, or any other third-party tracking technology.

If we make a material change to this policy, we'll update the date at the top of this page and, where practical, notify account holders. Continuing to use the Service after a change means you accept the updated policy.

Privacy questions, requests, or complaints: privacy@voced1.com. Security issues or suspected data breaches: security@voced1.com.