Privacy Policy

A parent or guardian creates and controls the account. We collect only the account, learning and technical information needed to provide, secure and improve the service.

• We do not sell personal information or use children's data for targeted advertising.
• Private handwriting uploads are not public and can be permanently deleted.
• Families may request access, correction or deletion.

AceScore is an owner-operated educational service based in New South Wales, Australia. “AceScore”, “we”, “us” and “our” refer to the operator of acescore.com.au.

Privacy enquiries, access or correction requests, complaints and deletion requests can be sent to privacy@acescore.com.au.

AceScore is designed for parents and guardians supporting a school-age child. The adult creates and manages the account, accepts the consent notice and supervises use. A child must not create or independently manage an account.

If Facebook Login is enabled, we request only its account identifier, name, optional email and profile image. We do not request friends, posts, messages, contacts or the Facebook password.

• Account details: email, name, profile image, login-provider identifier and authentication records.
• Consent: accepted version, date and time.
• Learning records: year level, questions, answers, scores, progress, practice, wrong-book records, skill estimates and submitted corrections.
• Writing: typed text, private handwriting files, parent-confirmed transcriptions, rubric results and feedback.
• Security and technical data: session cookies, request times, error and quota records, and a one-way IP-derived hash for rate limiting. Verification codes are not stored in readable form.
• Usage analytics: page views and product events. Google Signals and advertising personalisation are disabled.

• Directly from a parent or child using the parent-managed account.
• Automatically when progress or security events are recorded.
• From a chosen sign-in provider such as Google or Facebook.
• From providers that host, secure and measure the service.

We do not sell or rent personal information or build advertising profiles from children's information.

• Create and secure the account.
• Deliver assessments, practice, reports and personalised recommendations.
• Remember progress, mistakes and writing.
• Provide optional AI explanations, transcription and feedback.
• Handle support, correction and privacy requests.
• Prevent abuse, enforce quotas, diagnose failures and understand aggregate usage.

We use AWS for hosting, database, private writing storage and Amazon Bedrock; primary application and writing resources are configured in Australia. Google provides sign-in and privacy-configured analytics, Resend delivers verification codes, and Meta may provide Facebook Login.

Google, Resend and Meta may process information in the United States or other countries where they or subprocessors operate. Their own privacy policies apply.

Optional AI features may send question context, a writing transcription or necessary handwriting to Amazon Bedrock. We do not intentionally include account emails or children's names in prompts. AWS states Bedrock inputs and outputs are not used to train AWS or third-party foundation models.

AI feedback is formative, may be incomplete or wrong, and is not an official NAPLAN, ICAS or school assessment. An adult should review it.

Authentication and security cookies keep sessions working. Google Analytics may set first-party _ga cookies; advertising personalisation and Google Signals are disabled. Blocking authentication cookies prevents sign-in.

Local or session storage may preserve an in-progress activity. The acescore_locale cookie stores the selected interface language for one year and can be cleared in browser settings.

No internet service can guarantee absolute security. Eligible data breaches will be assessed and handled under applicable Australian law.

• Traffic uses HTTPS and account authentication restricts access.
• Writing files are private and encrypted in AWS S3.
• Email codes expire after 10 minutes, are single-use and stored only as salted hashes.
• Records are retained while needed for the service, until deletion or no longer required.
• Deleted data may remain temporarily in encrypted backups unless law or a security investigation requires longer retention.

A parent or guardian may request access, correction or deletion. We may verify account ownership first. Individual writing can be deleted without closing the account; full-account instructions are at /data-deletion.

Email privacy@acescore.com.au with the subject “Privacy complaint”. We will acknowledge, investigate and explain the outcome. Unresolved concerns may be taken to the Office of the Australian Information Commissioner.

We update this policy when handling practices change. Material changes affecting children or consent will be communicated and may require renewed consent. Current version effective 29 July 2026.