Privacy notice
This is a learning app used by children, so the short version matters more than the long one: we hold as little as the app can work with, we do not sell any of it, and there are no advertisers or trackers anywhere in it.
Last updated 6 September 2026
The short version
We know your email address, your children’s first names, the school year you told us each child is in, and how far they have got through the lessons. That is close to everything. There are no advertisements, no analytics services, and nothing about your family is sold or shared for marketing.
What we collect
About you, the parent or guardian:
- Your email address, which is how you sign in and the only way back into the account.
- Your password — stored only as a scrypt hash, never as the password itself. We cannot read it, and nobody here can tell you what it is.
- When you accepted these terms, and whether you have confirmed your email address.
About each child you add:
- The name you type for them. A first name or a nickname is enough, and we would rather you did not give us more.
- The school year you chose, which is what decides where their ladder starts.
- Their progress: which lessons and ranks they have worked through, and the score and date of each rank test they sit.
Technical, kept only so that signing in works:
- A session record — a random token stored as a hash, with the dates it was created, last used, and expires.
- When you ask for a password reset or an email confirmation, a hash of the six-digit code, its expiry, and how many times it has been tried.
What we do not collect
No date of birth, no home address, no phone number, no photographs, no school name, and no location. We do not ask a child for anything at all — everything above is typed by you.
There are no third-party analytics, no advertising networks, and no social media pixels in this app. There is nothing tracking anyone across other websites, because there is nothing here that could.
Cookies
Two, both strictly necessary, neither used for tracking. A session cookie keeps you signed in for up to 90 days; it cannot be read by JavaScript and contains no personal information, only a random token. A short-lived cookie holds the email address you typed while a password reset is in progress, and is deleted as soon as the reset finishes.
There is no cookie banner because there is nothing to consent to. Deleting these cookies signs you out and breaks nothing else.
Where it is kept, and who else touches it
The database is Postgres, hosted by Neon in Sydney, Australia. The app runs on Vercel. When email is switched on, password resets and confirmations are sent through Resend, which sees the recipient address and the message.
Those three are the only companies involved. None of them are given your data for their own purposes, and no one else has access.
How long we keep it
For as long as the account exists. Sessions expire after 90 days, and reset codes die within minutes and are cleared out afterwards. Ask us to delete the account and everything about you and your children goes with it — progress and test results included, since they belong to the child record and are removed with it.
Children’s information
Children do not have their own accounts and cannot sign up. A child’s record exists because you created it, and you can ask for it to be changed or removed at any time. We do not contact children, and we never send email to a child.
Keeping it safe
The site is served over HTTPS. Passwords are hashed with scrypt, a function designed to be slow and memory-hungry so that a stolen database is not a list of passwords. Session tokens and reset codes are stored as hashes for the same reason: a copy of those tables is a list of dates, not a set of keys.
No system is perfect. If something goes wrong in a way that affects you, we will tell you.
Your choices
Write to hello@skilltreeacademy.com.au to see what we hold, correct it, or have it deleted. We will not charge you and we will not make it difficult. There is not yet a button in the app for this, so email is the way.
If you are in Australia and you are unhappy with how we have handled your information, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
If this notice changes in a way that matters, the date at the top changes and we will tell you by email before it takes effect. SkillTree Academy is early software and things will change; what we hold about your family is not something we intend to change quietly.