Overview
ATARprepAI ("we", "us") is an AI-powered study tool for Australian high school students. This policy explains what personal information we collect, why we collect it, and how we handle it — in plain language.
By creating an account, you confirm you have read this policy and agree to our Terms of Service. If you are under 18, a parent or guardian should also review this document.
Information we collect
Account information: When you create an account, we collect your email address and a securely hashed version of your password (never stored in plain text). You may add a display name and choose an avatar; both are shown publicly (see "What other people can see"). If you sign up as a teacher, we record that role.
Study data: We store your quiz statistics, streak history, achievements, and the questions you answered incorrectly (your "mistake bank"), synced to your account so you can pick up across devices. We also record when you were last active, to understand engagement.
Things you create & share: If you publish a quiz or flashcard deck to the community library, vote or report content, or join or host a live class game, we store that content along with your votes and reports, any class enrolment, and the nickname you use in a live game.
Product analytics: We record limited first-party usage events (for example: account created and quiz generated) to understand and improve the app. Separately, we use PostHog Cloud for a single page-use event. This is on unless you turn it off — use the switch below, or Settings in the app. That event contains a fixed page category (not the page URL) and nothing else; it is anonymous by default, and an opaque analytics identifier is attached only if you explicitly switch analytics on while signed in. If your browser sends "Do Not Track" or Global Privacy Control, we do not load PostHog at all. We save your choice to your account when you are signed in, or in your browser when you are signed out. PostHog's browser-side identifier storage uses session storage and clears when that browser tab's session ends; a signed-in student's opaque account identifier remains on our account record until account deletion. We do not send your email, display name, notes, answers, quiz content, form entries, page queries, or referrers to PostHog. We do not use advertising trackers, and we never sell your activity.
We could not save that. Please try again.
Payment information (Pro): If you subscribe to a paid plan, payment is handled by Stripe. We never see or store your full card details, only a customer reference and your subscription status.
Referrals: If you invite a friend or arrive via an invite link, we record who referred whom so we can credit both accounts.
How we use your information
- To authenticate your account and keep your study data in sync across devices
- To personalise your experience (e.g. remembering your preferred timer settings)
- To send essential service emails — such as login codes and, if you opt in, streak reminders
- To understand and improve the service using first-party product analytics and limited PostHog Cloud analytics (which you can turn off)
- To run community and classroom features you choose to use (publishing, live games, classes)
We do not use your data for advertising and we never sell it. We share it only with the service providers we rely on to run the app (listed below), and, for content you choose to publish or the nickname you use in a live game, with other users as described in "What other people can see". You can turn off reminder and update emails any time via the unsubscribe link in any email or in Settings.
What other people can see
Most of your data is private to you. A few things are visible to others by design:
- Display name and avatar: shown on leaderboards, on any quiz or deck you publish, and to the teacher of a class you join.
- Published quizzes and decks: public in the community library with your display name as the author. You can unlist or remove them at any time.
- Live class games: the nickname and avatar you use are visible to the host and other players for that game.
- Class rosters: if you join a class with a code, the teacher who runs it can see your display name.
Community content is moderated. Items awaiting review stay hidden from the public until they are checked.
Third-party services
OpenAI: When you generate a quiz or have an answer graded, the notes or topic you enter are sent to OpenAI's API to generate questions. OpenAI processes this data under their own Privacy Policy (opens in new tab). Please don't paste content containing personal or sensitive details.
Vercel: The app is hosted on Vercel's infrastructure, which also provides privacy-friendly, cookieless web analytics. Vercel's Privacy Policy (opens in new tab) applies at the hosting level.
PostHog (product analytics): Unless you turn analytics off, PostHog Cloud processes the limited analytics described above on our behalf. We configure it with no session recordings, click capture, form capture, surveys, feature flags, error tracking, or performance tracking. PostHog necessarily receives technical browser and network information, including IP address, when your browser connects to it. Analytics are hosted in the PostHog Cloud region configured for our project (US or EU). Read PostHog's Privacy Policy (opens in new tab).
Amazon Web Services (AWS): Your account and study data are stored in a managed PostgreSQL database hosted on AWS in the Asia-Pacific (Tokyo) region.
Resend: We use Resend to send transactional emails (login codes and optional streak reminders).
Sentry: When enabled, we use Sentry for error monitoring to find and fix crashes. It records technical diagnostics, not your study content.
Stripe: If you subscribe to a paid plan, Stripe processes your payment under its own Privacy Policy (opens in new tab). We receive only a customer reference and your subscription status, never your full card number.
Google: If you choose "Sign in with Google", Google shares your email address with us to create or access your account, under Google's own Privacy Policy (opens in new tab).
Microsoft: If you choose "Sign in with Microsoft", Microsoft shares a stable Microsoft account identifier and may share an account email or username. We ask you to verify an email address you control before creating the account, rather than treating Microsoft's username as proof of email ownership. Microsoft's Privacy Statement (opens in new tab) applies.
Data retention
We keep your account and study data for as long as your account is active. Our first-party product analytics are kept for about 90 days. If you delete your account, we remove your account and study data from our systems within 30 days and queue erasure of any PostHog data linked to your account's opaque analytics identifier. PostHog analytics otherwise follow the retention period configured for our PostHog project.
Your rights (Australian Privacy Act 1988)
Under the Australian Privacy Act, you have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your account and data
To exercise any of these rights, including checking or expediting erasure of PostHog analytics linked to your account, email us at privacy@atarprepai.com and we'll respond within 30 days. You can turn analytics off at any time — in Settings in the app, or with the switch in "Information we collect" above.
Security
Passwords are hashed using industry-standard algorithms before storage, and all data in transit is protected with HTTPS. No system is perfectly secure, though — please use a unique password for this account.
Changes to this policy
If we make material changes to this policy, we'll notify you by email or by showing a notice the next time you log in. Continuing to use the service after changes are posted means you accept the updated policy.
Contact
Questions about this policy? Email us at privacy@atarprepai.com.