Privacy

Privacy information for the beta

This page describes the implementation observed in the current codebase. It is not a claim that a school has approved the service.

Information handled

Without an account, progress, draft sessions, device identifiers, synchronisation outbox data, design preferences and page-feedback notes can be stored in the browser. Page feedback is local-only and is not a support request.

When a student creates an optional account, Firebase Authentication handles the email address and password. The Grid stores a display name, email address, account type and timestamps, plus learning progress, question attempts and answers, draft sessions, marking records, AI feedback and related request metadata in Cloud Firestore.

AI-assisted features

For some signed-in written responses and follow-up questions, the server sends the answer or question together with relevant question and marking context to OpenAI for marking or explanation. Passwords and Firebase credentials are not included in those marking prompts. Students should not place unnecessary personal or sensitive information in answers.

Service providers and locations

The beta uses Cloudflare Pages for static website hosting; Google Firebase and Google Cloud for authentication, App Check, functions and Firestore; and OpenAI for the AI-assisted features described above. Functions are configured for the Sydney region (australia-southeast1), and project operations documentation records Firestore in that region. This does not mean every service provider process is confined to Australia.

Analytics, cookies and browser storage

No marketing analytics provider was found in the current implementation. Firebase Authentication uses persistent browser storage when a user signs in, and reCAPTCHA Enterprise may use browser technologies needed for abuse protection. The app also uses local storage and IndexedDB for progress, drafts and offline behaviour.

Students and minors

The service is designed for secondary students but does not ask students to submit unnecessary sensitive information. A purchaser must be 18 or otherwise legally authorised. A parent, guardian or school should decide whether a minor may create an account under the requirements that apply to them. Students should not enter health information, private family information or other unnecessary personal details in answers or feedback.

Retention, deletion and access

The current beta does not publish a fixed retention period. Signed-in students can request irreversible account-and-learning-data deletion after recent password reauthentication; the server removes the student and user records before deleting Authentication. A limited deletion-lock record containing the account UID, deletion status and timestamps remains so deletion can finish safely and a deleted account is not accidentally restored. Its retention period is not yet fixed. Firestore rules generally allow signed-in students to read their own records, while server records cannot be deleted directly by the client. A verified operator contact and documented deletion process are required before wider release.

Changes and questions

This information should be updated whenever data flows, providers or account controls change. Privacy questions require the public contact listed above once it is supplied.