Privacy and security
Last updated: 10 October 2026
This page explains what Wattle Science collects, why, where it is kept, who can see it and when it is removed. It is written to help Australian schools check the app against the Australian Privacy Principles (APPs) and their own department's rules.
Be informed. Wattle Science is a small independent project. It has not been assessed by an education department or by Safer Technologies 4 Schools (ST4S). Check your school's requirements before entering real student information. Lessons, slides, Explore and practice mode need no sign-in and collect no personal information.
Short version for students
- You type your first name (and the first letter of your last name) and choose a 4-digit PIN. That's it: no email, birthday or photo.
- Only you and your teacher can see your work.
- Nothing you write is sent to AI or used for ads.
- Keep your PIN secret, like a locker combination.
What we collect
| Who | Information | Why |
|---|---|---|
| Teachers | Email, name (optional), password (stored only as a secure hash by Supabase Auth), sign-in times | To sign in and own classes |
| Teachers requesting access | Name, school email, school, optional message, network address | To approve teachers, and to stop spam |
| Students in a class | Display name (first name and last initial, or a nickname), PIN and printable secret code (both stored only as hashes), last sign-in time | To sign in on shared iPads |
| Students in a class | Answers, results tables and exit tasks they type; teacher feedback and judgements | Learning and assessment |
| Students in a class | Reading supports chosen by the teacher (bigger text, easy-read font, calmer colours) | Accessibility. This can hint at a learning need, so we treat it as sensitive: only that student's teacher sees it, and it is never exported or counted in statistics |
| Anyone signing in | Network address of failed sign-in attempts | To slow down guessing |
We do not collect student emails, dates of birth, photos, voice, location, contacts or device identifiers. There are no advertising or analytics trackers, and no student work is sent to AI services.
Where it is kept
- Database and sign-in: Supabase, in the AWS Sydney region (ap-southeast-2). Supabase Inc. is a US company; its staff may access systems from overseas for support and security.
- Website hosting: Vercel Inc. (US), which serves the app from a global network and keeps short-lived request logs. Student work is not sent to Vercel; the browser talks to the database directly.
- Email: sign-up and password emails are sent by Supabase's email service.
- On the iPad: a student's sign-in lasts only for that browser tab. Unsaved answers are kept on the device until they save, and are cleared after saving or after 7 days.
Who can see it
- Each student sees only their own work and feedback.
- A teacher sees only the classes they created.
- Wattle Science administrators approve teachers and see teacher emails and overall counts (numbers of classes, students and lessons), not student work.
- These rules are enforced inside the database (row-level security and checked functions), not just by the screens.
How it is protected
- All traffic uses HTTPS (TLS). The database is encrypted at rest by the hosting provider.
- Student PINs and secret codes are never stored in readable form. Five wrong PINs lock a student for 15 minutes; ten lock it until the teacher resets it. Easy PINs (years, patterns) are refused.
- Class sign-in pauses automatically after many wrong attempts, and guessing is limited per network.
- Students are signed out after 30 minutes without activity on the iPad (60 on the server), and after 10 hours at most.
- Teachers stay signed in only for the browser tab unless they choose "Keep me signed in on this device", and are signed out after an hour without activity.
- Teacher and admin rights need a confirmed email address that an administrator has approved. Teachers can turn on two-step sign-in with an authenticator app, and then it is required.
- Email sign-in links only work in the browser that asked for them.
- Student PINs and codes are stored as keyed hashes (HMAC with a secret key held separately in a vault).
- Downloads of student information, teacher approvals and new accounts are recorded in an audit log that only administrators can see.
- Strict browser security headers (Content Security Policy, HSTS, no framing).
- Spreadsheet exports are protected against formula injection.
Found a security problem? Please tell us through the contact form (choose "Anything else" and write "Security"). See also security.txt.
How long we keep it
| Information | Kept |
|---|---|
| Student work, feedback and names | Until the teacher deletes the student or class. Deleting removes it from the live database straight away; the hosting provider's backups roll over within days. |
| Failed sign-in records (network addresses) | 2 days |
| Student sign-in sessions | Removed a day after they end |
| Access requests | Network address and message cleared after 30 days; name and school cleared 12 months after the request is handled |
| Teacher accounts | Until the teacher or school asks us to remove them |
We recommend teachers export and then delete each class at the end of the school year.
Your choices and rights
- Teachers can export a class (spreadsheet) and delete students or classes at any time.
- Parents and students can ask the school or teacher to see, correct or delete a student's information. Teachers can do this directly in the app.
- Teachers can ask us to see, correct or delete their own account through the contact form.
- If you are unhappy with how we handled a privacy question, tell us first; you can also contact the Office of the Australian Information Commissioner (oaic.gov.au).
If something goes wrong
If we suspect a data breach, we will contain it, assess it quickly (within 30 days at most, as the Notifiable Data Breaches scheme requires), tell affected schools as soon as we can, and notify the OAIC and affected people where the breach is likely to cause serious harm.
Schools: the school is in charge
Schools decide whether to use Wattle Science with real students and what to enter. Teachers act for their school; the school remains responsible for its students' information. We use it only to run the service for that school.