Privacy Policy

1. Who We Are

Hootbrook Learning (“Hootbrook”, “we”, “us”) is an Australian education technology company that provides adaptive learning for primary-school children preparing for selective school entrance tests.

We are committed to protecting the privacy of our users, especially the children who use our platform.

2. Information We Collect

Account information

• Parent email address and display name
• Child display name, year level, and target exam
• Passwords (stored as salted hashes — we never store plaintext passwords)

Learning data

• Question responses (answers given, correctness, time taken)
• Session history (start/end times, questions attempted)
• Concept mastery scores and learning progress
• XP, badges, and streak data

Payment information

Payments are processed by Stripe. We store a Stripe customer ID and subscription status but never store credit card numbers, CVVs, or full card details on our servers.

Technical data

• First-party analytics events stored in our own database (page views, feature usage) — used only for product improvement, never sold or shared
• Error logs via Sentry for debugging — we scrub authentication data and known identifier patterns before sending, and we do not record sessions, screens, or keystrokes

We do not use PostHog, Mixpanel, Amplitude, Google Analytics, TikTok Pixel, or any third-party behavioural analytics. No advertising SDKs are embedded in the learning app.

AI-powered features

Some features use AI to respond in real time — for example journal reflections, the writing coach, the homework and school-report photo helpers, and the in-app chat. When one of these features is used, the text your child or you type, or the photo you upload, is sent to our AI provider (Anthropic, in the United States) to generate a response. This content is used only to provide the feature — never to show advertisements.

Advertising measurement

We advertise Hootbrook to parents, and we need to know which ads actually help a family find us. On our public marketing pages only — the home page, pricing, about, contact, help, sign-in, sign-up, the free assessment, and account setup — we load the Meta (Facebook) pixel. It records that one of those pages was viewed, and that you finished the free assessment or started a subscription.

The pixel never loads inside the child learning experience. It is not on the dashboard, lessons, practice, reviews, games, the journal, or any other screen a child uses, and it is not in the iOS app at all.

When we tell Meta that an assessment or subscription milestone happened, the only personal detail included is the parent's email address, hashed with SHA-256 before it leaves our servers — the address itself is never transmitted. Meta uses that hash to match the event against an account it already holds. We never send a child's name, year level, answers, mastery scores, or any other learning data to Meta.

To limit how Meta uses your information for advertising, visit your Meta ad preferences. Most browsers and content blockers can also block the pixel outright, and doing so does not affect how Hootbrook works.

3. How We Use Your Information

• To provide personalised adaptive learning for your child
• To generate progress reports and readiness scores for parents
• To improve question quality through anonymised calibration analytics
• To process subscription payments via Stripe
• To send essential account and subscription emails

We do not sell or rent personal information. The only thing we share with an advertising platform is a hashed parent email attached to a marketing milestone, as described under Advertising measurement above — never a child's data. We do not show advertisements to children.

4. Children's Privacy

Hootbrook is designed for children aged 5–12. We take extra care with children's data and comply with the Australian Privacy Act 1988, the UK Age-Appropriate Design Code (Children's Code), and the US Children's Online Privacy Protection Act (COPPA) where applicable:

• Parent-created accounts only. Children cannot self-register. A parent creates the account, provides consent, and manages the child's profile.
• No direct contact information from children. Children never enter an email address, phone number, home address, or payment details.
• Parental gate on anything that leaves the app. Purchases, external links, and contact flows require a parent to solve a gate before proceeding.
• Data minimisation. We collect only what is needed to run the learning service. Alongside the basics (display name, year level, target test), this can include question responses and mastery scores, session history, declared interests, mood check-ins, journal entries, any exam outcomes you choose to share with us, study-squad display names, and device identifiers used to keep accounts secure.
• No behavioural advertising, ever. We do not show ads to children, we do not profile children for marketing, and we do not share children's data with ad networks. Our advertising pixel runs only on public marketing pages aimed at parents and never loads on a screen a child uses.
• No session recording. We do not record screen interactions, keystrokes, mouse movements, or video of children using the app.
• Parental access + deletion. Parents can view, export, or request immediate deletion of their child's data at any time by emailing support@hootbrook.com.
• Verifiable parental consent. By creating an account, the parent affirms they are the child's parent or legal guardian and consents to Hootbrook's collection of the data described above for the sole purpose of providing the learning service.

5. Data Storage & Security

• Data is stored on secure, encrypted servers
• Passwords are hashed using industry-standard algorithms (bcrypt)
• All connections use HTTPS/TLS encryption
• Payment processing is handled by PCI-DSS compliant Stripe
• We apply rate limiting and access controls to all API endpoints

6. Third-Party Services

We use a small, deliberate set of third-party services. Only one of them — Meta — is an advertising platform, and it is confined to our public marketing pages:

• Anthropic (United States) — AI provider (Claude). Powers AI features such as journal reflections, the writing coach, the homework and school-report photo helpers, and in-app chat. Receives the text or photo submitted to those features to generate a response. Used only to provide the feature — never for advertising.
• Stripe — payment processing. Receives parent email + billing details. Never receives child data.
• Vercel — application hosting. Processes requests but does not persist user data beyond standard access logs.
• Turso — encrypted database hosting (our primary datastore).
• Sentry (United States) — crash and error monitoring. Configured to scrub authentication data and known identifier patterns. Session replay is disabled.
• Resend — transactional email (sign-up confirmations, weekly digest to parent email). Never emails children.
• Upstash Redis — rate limiting for API endpoints. Stores IP-derived keys for 15 minutes, no personal data.
• Meta (Facebook) — advertising measurement on public marketing pages only. Receives page views on those pages and, when a parent completes the free assessment or starts a subscription, a hashed parent email. Never receives child data and never runs inside the learning app.
• Google (United States) — optional “Continue with Google” sign-in. If a parent chooses it, Google authenticates the parent and shares basic profile details (name, email). Never receives child data.
• Apple (United States) — optional “Sign in with Apple” on the mobile app. If a parent chooses it, Apple authenticates the parent. Never receives child data.

Apart from the Meta advertising measurement described above, we do not use PostHog, Mixpanel, Amplitude, Google Analytics, TikTok Pixel, Hotjar, FullStory, LogRocket, or any comparable behavioural analytics / session-recording tool.

Overseas disclosure

Some of these providers process or store data outside Australia — primarily in the United States (Anthropic, Stripe, Meta, Resend, Sentry, Google, and Apple). By using Hootbrook you acknowledge that your information may be handled overseas by these providers for the purposes described above.

6a. iOS App Specifics

When you use Hootbrook through the iOS app (iPad or iPhone), the following additionally applies:

• The app does not display advertisements, ever.
• The app does not include third-party SDKs for analytics, attribution, or advertising.
• Outbound links and purchase flows are gated behind an adult-only challenge.
• Social sharing is disabled inside the iOS app. Sharing is available only on the web experience, where a parent can choose whether to share.
• Push notifications are opt-in, limited to learning reminders and progress updates, and can be disabled at any time from device settings or the in-app Settings → Notifications screen.
• We follow Apple's App Tracking Transparency framework. We do not track users across apps or websites owned by other companies.

7. Your Rights

Under the Australian Privacy Act 1988, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Withdraw consent for data processing
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

8. Data Retention

We retain your data for as long as your account is active. When your subscription ends, we keep your data for 90 days so you can reactivate without losing progress. After 90 days, learning data is de-identified and account data is deleted.

You can request immediate deletion of all data by contacting us.

9. Changes to This Policy

We may update this policy from time to time. We will notify registered users of material changes via email. The “Last updated” date at the top of this page indicates the most recent revision.

10. Contact Us

If you have questions about this privacy policy or wish to exercise your rights, please contact us at:

support@hootbrook.com