Privacy Policy

Last updated: 3 May 2026

Tuplora is committed to protecting the privacy of children, parents, and any other users of our service. This Privacy Policy explains what information we collect, how we use it, and the rights you have under the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth).

Plain-English summary: We collect the minimum data needed to run the app. All data is stored on Australian servers (AWS Sydney via Supabase). We never sell your data. We never run advertising inside the app aimed at your child. You can request deletion at any time.

1. Who we are

Tuplora (ABN 13 640 935 468) ("we", "us", "our") provides this education product. Throughout this policy, "Tuplora" refers to the operator of the service.

If you have any questions about your privacy, you can contact us at: enquiries@tuplora.com.au

2. What information we collect

From the parent

First and last name
Email address
Mobile number (optional)
Postcode
How you heard about us (optional)
Marketing communications preference

About the child

First name only
Year level (3 to 6)
School name
State of residence
Lesson activity (questions answered, correct/incorrect, time spent)

We do not collect: child's last name, date of birth, photographs, address, voice recordings, or any other identifying information about the child beyond what is listed above.

Automatically collected

Browser type and approximate device information (for compatibility)
IP address (for security and abuse prevention)
Activity timestamps within the app

3. How we use your information

We use the information we collect to:

Provide a personalised learning experience for your child (route to the right curriculum, track mastery, manage the study/reward loop)
Allow parents to view their child's progress through the parent dashboard
Send essential service emails (account confirmation, password reset, important changes to the service)
Send marketing communications, but only if you have opted in. You can opt out at any time.
Improve the app and curriculum based on aggregate, de-identified usage patterns
Comply with legal obligations

4. Data hosting and Australian residency

All personal information is stored on servers physically located in Australia (AWS Sydney region, via our backend provider Supabase Inc.). We have specifically chosen this configuration to keep your data subject to Australian law and minimise cross-border data transfers.

Some technical service providers we rely on (e.g. our website hosting provider WebCentral) may have limited access to operational logs in the course of providing services. These providers do not have access to your account contents.

5. Children's data

Tuplora is designed to be used by children with parental supervision. Parents create the account and remain in control of the child's data. Children do not log in independently; they use a single shared account with their parent.

We do not allow children to share content with other users, do not run third-party advertising in the app, and do not enable communication features between children.

Where applicable, parents can exercise rights on behalf of their child including access, correction, and deletion.

6. Cookies and tracking

We use the following types of tracking:

Type	Purpose	Optional?
Essential cookies	Login session, app state	No (required for the app to function)
Local storage	Cache progress and preferences in the browser	No
Meta Pixel	Measure effectiveness of our marketing on Facebook and Instagram	Active only on signup-related pages, not on lesson pages

You can disable cookies in your browser settings. The app may not function correctly with cookies disabled.

7. Sharing your information

We do not sell personal information to anyone, ever.

We share information only with:

Service providers who help us operate the app (e.g. Supabase for backend hosting, WebCentral for website hosting). These providers are contractually bound to handle your data responsibly.
Law enforcement, when required by Australian law (e.g. valid warrant or court order).
A successor entity in the event of a sale, merger, or acquisition of our business — and only with continued protection of your data under the same standards.

8. Your rights under the Privacy Act

Under the Australian Privacy Principles, you have the right to:

Access — request a copy of the personal information we hold about you and your child.
Correct — ask us to correct any inaccurate information.
Delete — request deletion of your account and all associated data. We will action this within 30 days.
Opt out — unsubscribe from marketing communications at any time using the link in any marketing email.
Complain — lodge a complaint with us, or with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, email enquiries@tuplora.com.au.

9. Security

We protect your information using:

Encryption in transit (HTTPS/TLS for all communications)
Encryption at rest for stored data
Row-level security on database tables — only your account can access your data
Industry-standard password hashing (we never store passwords in plain text)
Regular security reviews of our infrastructure

No system is perfectly secure. If we become aware of a data breach affecting your information, we will notify you and the OAIC where required by the Notifiable Data Breaches scheme.

10. Data retention

We keep your account data for as long as your account is active. If you don't log in for 24 months, we will email you and may delete inactive accounts after a 30-day notice period. You can request immediate deletion at any time.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email and post a prominent notice on the app. Continued use of the app after the change constitutes acceptance of the updated policy.

12. Contact

For privacy questions: enquiries@tuplora.com.au

For all other support: enquiries@tuplora.com.au