Who we are
Eucaly is run by Sanjeev Kumar Badrinath, trading as Eucaly Learn (ABN 95 232 698 072), a sole trader based in Melbourne, Victoria, Australia. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). If you have any question about this policy or your data, email help@eucaly.au.
What we collect
We collect the minimum account, subscription and learning-progress information needed to create parent accounts, support child profiles, save practice activity and keep the app working safely across supported tablets.
Specifically, this includes: the parent's email address (from Sign in with Apple or Google); each child profile's name, year level, optional 4-digit PIN and chosen avatar; practice answers, scores and completion timestamps; per-skill mastery and progress signals; gamification state (level, day streak, badges); and subscription state including the platform receipt for Apple or Google in-app purchases.
How we use it
We use collected information to deliver practice sessions, personalise progress reporting, maintain subscriptions, improve reliability, respond to support requests and protect the service from misuse or unauthorised access.
We also use practice history to compute features such as NAPLAN readiness band estimates and to enforce free-tier limits (such as the 3 practice tests per rolling 7-day window after the trial ends). These features are derived from data already collected; they do not introduce additional data collection.
Children's privacy
Eucaly is designed for children with parent-managed accounts, and we rely on parental consent before collecting personal information from children under 13 (consistent with COPPA in the United States and the Australian Privacy Principles at home); we do not serve targeted ads to children and we limit child data use to core educational and account-support purposes.
Sharing and third parties
We share data only with service providers that help us operate the app, and only under terms that require those providers to protect the information appropriately.
The providers we rely on are: Supabase (cloud database and authentication — account login, learning-progress storage), Apple and Google (Sign-In identity tokens and in-app purchase processing), Google Gemini (the AI model behind the optional AI Writing Assessment), Resend (transactional email delivery, described below), and PostHog (product and website analytics, described below). Writing samples submitted to AI Writing Assessment are sent to the AI provider for grading and are not used to train third-party models. We do not sell or rent personal information.
Product analytics. We use a third-party product analytics service to understand how parents use the app so we can improve reliability and the parent experience. The data sent is limited to: the parent's Eucaly user ID, the parent's email address (used as an account identifier), the sign-in provider, the platform (iOS, Android or web), and aggregate parent-account events such as sign-in, paywall views, subscription start, subscription restore, test started/completed (domain and year level only), game started (game ID only), and game demo events (game demo shown, game demo watched full, game demo dismissed, game first play after demo) which record the game ID, a child profile identifier, and aggregate counts or timings. We do not send child names, individual answers, or any free-text content to our analytics provider. Practice scores and band estimates sent are aggregate, parent-account-level numbers — not attributable to a specific child. You can request deletion of your analytics data by emailing help@eucaly.au.
Where your data is stored
This section is our cross-border disclosure under Australian Privacy Principle 8.
- Account and learning data (Supabase) is stored in Sydney, Australia (AWS ap-southeast-2).
- Analytics data (PostHog, both in-app and website) is processed and stored in PostHog's European Union cloud.
- Transactional email (Resend) is sent from and delivery metadata is held in Tokyo, Japan (ap-northeast-1).
- Writing submissions sent to the AI Writing Assessment are processed by Google's Gemini service, which may process data outside Australia.
- Sign-in and purchases are processed by Apple and Google on their own global infrastructure under their own privacy policies.
We send transactional emails from Eucaly <noreply@eucaly.au> via a third-party email delivery service. There are two email types:
- A one-time welcome email after signup, confirming how Eucaly works and when to expect your first weekly report.
- A weekly report (Sunday evening AEST) summarising the past week's practice for each child on your account.
The data sent to that service is limited to: your email address, your display name (if provided by Apple or Google), and the contents of the email itself — for the weekly report that means each child's first name, year level, and per-week aggregate statistics (test counts, streak length, mastery focus areas). We never send individual answers, individual questions, or writing submissions through email.
You can stop the weekly report at any time: toggle Weekly report email in the Eucaly app under Parent settings → Notifications, or click Unsubscribe at the bottom of any email (one-click RFC 8058 — the same one-click chip Gmail and Outlook surface above the message). The welcome email is sent once and cannot be opted out of in advance.
Website analytics
Our marketing pages at eucaly.au use a third-party website analytics service for basic page-view and click analytics. Recorded data is limited to: the page URL, page title, referrer, an anonymous session identifier, and an approximate country derived from your IP address.
We also record which links and buttons you click on our marketing pages — captured automatically using element selectors — and create an anonymous profile so we can see whether the same visitor returns. We do not record what you type, your scroll patterns, your screen contents, or any in-app activity.
We do not record sessions, capture screen recordings, capture heatmaps, or track rage-clicks. This website analytics is for understanding which marketing pages are helpful — it is separate from the in-app product analytics described above, and it does not see any child or parent account data.
How long we keep it
- Account and child profile data — kept until you delete your account or the profile. Account deletion has a 30-day grace period (see "Your rights and contact" below).
- Practice answers, scores and mastery signals — kept while the child's profile exists, so progress reporting keeps working; deleted with the profile or account.
- Writing submissions — by default we retain your child's written submissions until you delete their profile, so you can re-read them in the parent portal. You can change this in Parent settings → Privacy: purge after 30 days, 90 days, or 12 months, or immediately after we grade the writing (an automated nightly job applies your choice). The band estimate and per-criterion feedback are always kept (they're tiny and let you see your child's progress over time) — only the original text is affected by your choice.
- Product analytics events — kept while your account is active; you can request deletion at any time by emailing help@eucaly.au.
- Email delivery records — we keep a log of the transactional emails we send (email type, recipient and timestamp — never the full body) so we can answer delivery questions and avoid duplicate sends. These records are not currently deleted automatically.
- Dormant accounts — there is no automatic expiry. Your account and data stay until you delete them.
How we protect it
Every user-owned table in our database is protected by row-level security, so one account can never read another account's rows. Child profile PINs are stored as one-way hashes, never as plain text. Subscription entitlements are verified server-side with Apple and Google rather than trusted from the app. Card details never touch our systems — payment runs entirely through Apple and Google. API keys for our AI and email providers are held server-side behind authenticated functions and are never shipped inside the app. In-app analytics has autocapture, session recording and heatmaps switched off — only the specific events listed above are sent.
If something goes wrong
If we ever suffer a data breach, we will assess it promptly, notify affected parents where there is a risk of serious harm, and notify the Office of the Australian Information Commissioner where the Privacy Act requires it. We will be straight with you about what happened and what we are doing about it.
Your rights and contact
Parents can request access, correction or deletion of account information where applicable, ask questions about data handling or raise privacy concerns by contacting help@eucaly.au. Account deletion follows a 30-day grace period: your account is deactivated immediately on request and permanently deleted on day 30 (handled by an automated job). Within the grace window, you can email help@eucaly.au to cancel the deletion.
To make a privacy complaint, email help@eucaly.au with "Privacy complaint" in the subject line. We will acknowledge your complaint and respond within 30 days. If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner at oaic.gov.au.
Updates to this policy
We may update this policy as the product, legal requirements or service providers change, and when we do we will revise the date above and post the updated version on this page.