Privacy Policy

Gridpanions respects the privacy of teachers, students, parents and other people who use our website and services.

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and the choices available to you.

Gridpanions is an Australian educational service operated under the business name Gridpanions, ABN 66 552 476 125.

For privacy enquiries, contact us at [email protected].

1. Information we collect

The information we collect depends on how you use Gridpanions.

Teacher accounts

When a teacher creates an account, we may collect information such as:

• display name
• email address
• account login and authentication information
• device login history (a per-browser identifier and login times), used only to enforce the account's device limit
• subscription status
• game and account activity
• settings and preferences
• communications sent to us.

Student accounts

Students do not need an account to join and play a Gridpanions game.

If a student chooses to create an account to save their progress and Gridpanion collection, we may collect:

• display name or username
• email address, where required for the account
• account login and authentication information
• game progress
• coins, experience, achievements and Gridpanion collection information
• year level, if the student chooses to provide it (optional)
• other information necessary to provide account features.

We encourage students to use a display name that does not unnecessarily reveal personal information.

Students playing without an account

Students may participate in a game without creating a Gridpanions account.

When joining a game, a student may provide a player or display name and game code so that they can participate in that game.

Some games (such as Grid Sprint and Grid Strike) also offer a solo practice mode that can be played without an account. To run a solo session, we may store the player name entered and the session's gameplay results (such as answers, time and score).

Guest game and solo-session information is kept only as long as needed to run the game and is removed by routine clean-up of old games.

We aim to collect only the information reasonably necessary to operate the game.

Feedback form

Anyone can send us feedback or report a problem through the feedback form. It collects the name entered, whether the sender is a teacher or student, the type of issue, the game it relates to (if any) and the message (up to 500 characters). If the sender is signed in, we also record which account sent it, so we can follow up. Feedback can only be read by Gridpanions, not by other users. Please do not include personal details that aren't needed to describe the issue.

Technical information

When you use Gridpanions, some technical information may be collected automatically, including:

• IP address
• browser and device information
• pages or features accessed
• dates and times of access
• security and authentication information
• error and diagnostic information.

This information may be used to operate, secure, troubleshoot and improve Gridpanions.

2. How we use information

We may use personal information to:

• create and manage accounts
• authenticate users
• allow teachers to create and host games
• allow students to participate in games
• save student progress and Gridpanion collections
• provide paid Gridpanions features
• process and manage subscriptions
• send account-related emails such as email verification and password resets
• provide customer support
• maintain the security and integrity of Gridpanions
• detect or prevent misuse, fraud or automated activity
• troubleshoot technical problems
• improve the service
• understand which year groups use Gridpanions and help us improve games, educational content and curriculum-related features
• comply with applicable legal obligations.

We do not sell students' or teachers' personal information.

We do not use student personal information for targeted advertising.

3. Children and student privacy

Gridpanions is designed for use in educational settings and may be used by children and young people.

We recognise that children's personal information deserves particular care.

Students can participate in Gridpanions games without creating an account. Creating an account is only necessary where a student wishes to use account-based features such as saving progress or growing and collecting Gridpanions.

We seek to minimise the personal information collected from students and do not require information such as a student's home address, phone number or date of birth simply to play a game.

A student account may optionally record a year level (e.g. "Year 4"), chosen from a fixed list. Providing a year level is entirely optional, and Gridpanions does not require a student's date of birth simply to work out their year level. Year-level information is currently used mainly to understand overall usage patterns across year groups and to help guide improvements to Gridpanions — it is not currently used to restrict games, automatically assign curriculum content, build individual learning profiles, or make assumptions about an individual student's ability.

Where consent is required for the collection or use of a child's personal information, the appropriate consent may depend on the child's age, maturity and capacity to understand the relevant privacy information. A parent, guardian or school may need to assist where appropriate.

Parents, guardians and schools may contact us if they have concerns about information associated with a child.

4. Schools and teachers

Teachers may use Gridpanions as part of classroom activities.

Teachers and schools are responsible for deciding whether Gridpanions is appropriate for their students and for complying with any privacy, technology-use, consent or other requirements that apply within their school, education authority or jurisdiction.

We encourage teachers not to enter unnecessary personal information about students into Gridpanions.

5. Payments

Payments and subscriptions may be processed by third-party payment providers such as Stripe.

Gridpanions does not need to store complete payment-card details when payment information is handled directly by the payment provider.

The payment provider may collect and process information in accordance with its own privacy policy and legal obligations.

We may receive information relating to a transaction, such as subscription status, payment status, product or plan purchased and transaction identifiers.

6. Service providers

We use third-party service providers to help operate Gridpanions. These providers may process information on our behalf where necessary to provide their services. We take reasonable steps to use reputable providers and limit the information shared to what is reasonably necessary for the relevant service.

The providers we currently use include:

• Supabase (supabase.com) — database, authentication, and backend infrastructure. Processes account, game and student-progress data necessary to run Gridpanions, and sends account-related emails (verification, password resets) via its built-in email delivery service. Processed under our contract with Supabase (necessary to provide the service). Hosted in Australia (Sydney) — see section 7.
• Vercel (vercel.com) — website hosting. Serves the Gridpanions website and games; processes technical/access information necessary to do so. Processed under our contract with Vercel (necessary to provide the service). Data may be processed in the United States — see section 7.
• Stripe (stripe.com) — payment processing. Processes teacher subscription payment details; see section 5. Processed under our contract with Stripe (necessary to provide the service). Data may be processed in the United States — see section 7.
• Cloudflare (cloudflare.com) — Turnstile CAPTCHA. Processes technical information necessary to help protect account sign-up and sign-in from automated abuse. Processed under our contract with Cloudflare (necessary to provide the service).
• Google (google.com/adsense) — advertising (AdSense), planned for the guest-only solo results screen (used only by unlogged-in student guests) — see section 8. Not yet active as of 26 September 2026: Google's advertising code is not loaded on any Gridpanions page until then (site ownership is verified with a page tag that sends no visitor information). Once live, it will process technical/advertising information about guest visitors to that screen only. Processed under our contract with Google (necessary to display advertising on that free, guest-only surface). Data may be processed in the United States or elsewhere — see section 7.
• Google Fonts (fonts.google.com) — delivers a web font used on one page. Loading any font from Google's servers sends the visitor's device/browser information, same as loading an image from any other website. Processed under Google's standard terms. Data may be processed in the United States or elsewhere — see section 7.
• Have I Been Pwned (haveibeenpwned.com) — checks whether a password has appeared in a known data breach, at signup and password reset. Uses a privacy-preserving technique (k-anonymity) that only ever sends a short partial fragment of the password's cryptographic hash — never the password itself, and never enough to reconstruct it. No account information is sent or received.

We may add, remove or change service providers as Gridpanions develops. This Privacy Policy will be updated to reflect significant changes.

7. Overseas processing and storage

Our database and backend infrastructure (Supabase) is hosted in Australia (Sydney region). Some of the other third-party technology providers used by Gridpanions store or process information outside Australia.

Specifically:

• Our website hosting (Vercel), payment processing (Stripe), advertising provider (Google, see section 8), and web font delivery (Google Fonts) are operated by providers headquartered in, and which commonly process data in, the United States, and may process data in other countries as part of their own global infrastructure.

Where applicable, we take reasonable steps to consider the privacy and security practices of service providers that handle personal information. If our infrastructure or service providers change, the countries involved may change too, and we will take reasonable steps to keep this section up to date.

Where we decide to relocate or expand where personal information is stored or processed to a new country (for example, moving our primary database to a new hosting country), or to give a new person or contractor access to unencrypted personal information, we will take reasonable steps to notify schools and teachers before that change takes effect. This does not apply to changes made within an existing provider's own global infrastructure that are already described in this section.

8. Cookies, similar technologies and advertising

Gridpanions may use cookies, local storage and similar technologies (stored in your own browser) where necessary to:

• keep users signed in
• maintain sessions
• remember settings and choices, such as your preferred view or personal best times in solo practice
• operate games
• provide security features
• maintain website functionality
• understand and troubleshoot technical performance.

We do not use these technologies to sell student information.

Advertising: the Grid Sprint "Solo Practice" results screen, when played by a guest who is not signed in, is planned to display advertisements served by Google AdSense (not yet active as of 26 September 2026). Advertising is never shown to signed-in students or teachers, and Google's advertising code is not loaded on any other page. Once live, this will involve sharing technical and browsing information (such as IP address, device and browser information, and ad interaction) with Google for ad-serving purposes on that screen, governed by Google's own privacy and advertising policies. We do not use student personal information tied to a signed-in Gridpanions account for targeted advertising.

9. Security

We take reasonable technical and organisational measures to protect information from loss, misuse, interference, unauthorised access, modification and disclosure.

These measures may include authentication controls, encrypted connections, access restrictions, security monitoring and reputable third-party infrastructure.

However, no internet service or electronic storage system can be guaranteed to be completely secure.

10. Data breach notification

We maintain an incident response process for handling suspected security, privacy and online safety incidents, including data breaches.

If we become aware of a data breach involving personal information that is likely to result in serious harm, we will investigate and, where required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth) or otherwise reasonably appropriate, notify affected individuals and/or the Office of the Australian Information Commissioner as soon as practicable. Notifications will include, to the extent known, a description of the breach, the personal information involved, and the steps we recommend affected individuals take.

Schools and teachers will also be notified as soon as practicable of any breach affecting their students' information, so they can support their own students, parents and reporting obligations.

11. How long we keep information

We aim to retain personal information only for as long as reasonably necessary to provide Gridpanions, maintain legitimate business and security records, and meet applicable legal obligations.

Information may be deleted or de-identified when it is no longer reasonably required.

12. Accessing, correcting or deleting information

You may contact us to request access to, correction of, or deletion of personal information we hold about you, subject to applicable law and any information we are reasonably required to retain.

Parents or guardians may contact us regarding information associated with their child. We may need to take reasonable steps to verify identity or authority before providing, changing or deleting information.

These requests are free of charge. We aim to respond within 30 days, and in any event within 3 months.

Contact [email protected].

13. Privacy concerns and complaints

If you believe Gridpanions has mishandled personal information, please contact us at [email protected].

Please provide enough information for us to understand and investigate your concern.

We will review privacy complaints and aim to respond within a reasonable period.

Where the Privacy Act 1988 (Cth) applies, you may also have the right to make a complaint to the Office of the Australian Information Commissioner.

14. Changes to this Privacy Policy

We may update this Privacy Policy as Gridpanions develops, our practices change or legal requirements change.

The latest version will be published on the Gridpanions website and will show the date it was last updated.

If we make a significant change to how personal information is handled, we will post a notice via the announcement banner on the Gridpanions teacher home screen at the time of the change, in addition to updating this page.

15. Contact us

For questions, requests or concerns about privacy:

Gridpanions
ABN: 66 552 476 125
Email: [email protected]
Australia