How Ponder looks after your information.

1. Who we are and what this policy covers

Ponder is a guided-learning website and app for learners (children and adults), parents and carers, teachers, schools and other organisations. Ponder is operated by [Legal entity name] (ABN [ABN]) of [Registered address], Western Australia (“Ponder”, “we”, “us”).

This policy covers the Ponder website at www.ponderlearning.com [and any future custom domain], the web app at /app/, the Ask Ponder chat and voice features, and our dealings with you by email. It does not cover other websites we link to, or the social media platforms where Ponder has its own accounts (their own privacy policies apply). Ponder desktop and iPhone apps have not been released; this policy will be updated before they are.

The law we follow. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). [Confirm with legal adviser whether Ponder is covered by the Privacy Act or relies on the small business exemption.] Even where an exemption might apply, we have chosen to follow the APPs, including the Notifiable Data Breaches scheme, because Ponder handles information about children. We will also follow the Children’s Online Privacy Code once it is registered by the Office of the Australian Information Commissioner (OAIC).

2. What personal information we collect, and how

We only collect personal information that is reasonably necessary to provide Ponder. Most of it comes directly from you. Some comes from another person, for example when a parent adds their child or a school adds a student to a class roster. The table below lists everything the app stores today.

What we ask you not to share. Please don’t enter a child’s full name, home address, phone number, photo, or health details unless a feature clearly needs it. Ask Ponder turns away messages that mention passwords, card numbers, passports, Medicare or tax file numbers, or report cards, and it is told never to ask for or repeat a child’s personal details.

If you don’t give us information. You can explore the public guided spaces and use Ask Ponder without an account or giving your name. You need an account to save family or school records. You can use a nickname instead of a child’s real name (APP 2, anonymity and pseudonymity).

Unsolicited information. If we receive personal information we didn’t ask for and don’t need, we will delete or de-identify it where it is lawful and reasonable to do so (APP 4).

3. Sensitive information

Ponder does not ask for sensitive information such as health, disability, religion, racial or ethnic origin, or biometric information. However, free-text fields can contain it. In particular, teacher comments, notes on a subject, report cards and learning plans may mention health, disability, learning support or wellbeing. School results are not “sensitive information” under the Privacy Act, but we treat them with the same care because they are about children.

• We only collect sensitive information with consent, or where the law allows. By entering it, a parent, carer or school confirms they are allowed to share it with Ponder for the learner’s benefit.
• Only the people who manage that learner can see it (see Security).
• Our AI instructions forbid labelling a learner with any condition or diagnosis, and every AI output is a suggestion for a person to check.
• Voice questions are converted to text and the recording is not kept by Ponder. We do not use voice for identification, and we do not collect biometric templates.

4. Children’s privacy

Ponder is designed for learners of all ages, including children under 18. We take extra care with their information.

• Children don’t create accounts. Accounts are for adults: parents and carers, teachers and school staff, and adult learners. Our sign-up form only offers “Family” and “Organisation” accounts. A child uses Ponder through a profile that their parent, carer or school creates and manages.
• Consent comes from a responsible adult. For a family profile, the parent or carer who adds the child consents on the child’s behalf. For a school roster, the school is responsible for having the authority and any consent it needs under its own privacy obligations (see Schools and teachers). Where a child is old enough to understand, we encourage parents and schools to explain Ponder to them; our kids’ page can help.
• Linking a school and a family needs the parent’s agreement. A school’s roster record is connected to a family’s child profile only when the invited parent accepts the invitation, signed in with the exact email address the school invited. Either side can unlink later.
• We collect as little as we can. A first name or nickname, a year level, an optional birth year and a cartoon avatar. We never ask for a full date of birth, address or contact details for a child. A photo is only ever needed if a parent or carer chooses to make a photo avatar, and the photo is deleted as soon as the avatar is made.
• No advertising, no profiling for marketing. We don’t show ads, we don’t sell or rent children’s information, and we don’t use it to market to children.
• Ponder Quest stays on the device. Think Points, streaks, avatar pieces and game scores in Ponder Quest are saved only in the browser on that device (see Cookies and device storage).
• Top 10 charts are private to a family or class and use a nickname. A learner can hide themselves from the chart.
• Friends and chat (not available yet; off for every child until a parent or carer switches it on). Nobody can search for a child. A child can only be found by a private friend code they share in person, or, if their school turns it on for their class, by classmates whose families also linked them to the school. Other children see only the nickname or first name the child chose and their cartoon avatar, never a surname, school, age or photo. A parent or carer in both families must approve every new friend. Chat is between friends only, is quick friendly phrases unless both families allow typed messages for children aged 10 and over, and typed messages that share links, contact details, addresses or personal questions, or use unkind words, are stopped and the parents are told. No photos or files, no “read” receipts and no “online now”. Quiet hours (8 pm to 7 am by default) pause chat. Parents and carers of either child can read the whole conversation. Teachers and schools cannot see children’s friends or messages. Ponder’s team sees a message only if someone reports it. See how long we keep it.

If you believe a child has given us personal information without a parent’s or school’s involvement, please contact us and we will delete it.

5. Schools, teachers and organisations

When a school uses Ponder, the school decides which students and staff to add and what records to keep about them. Ponder handles that information on the school’s behalf to provide the service. Schools must make sure they:

• have the authority, and any consent they need, to enter student information into Ponder, including under their own privacy laws and education department policies (for example, the WA Privacy and Responsible Information Sharing Act 2024 for WA public sector schools);
• tell students and families that the school uses Ponder, and point them to this policy;
• only upload a report card when they hold consent from the student’s family (the upload form asks the school to confirm this each time);
• give staff access only to the classes they teach, and remove staff who leave.

Who sees what in a school. School owners and admins see their whole school. A teacher sees only the classes they teach and the students in them. A linked parent sees their own child’s school, class, teachers’ names, homework, results and any learning plan the school chooses to share. Staff email addresses are not shown to parents. A new school stays “pending” until Ponder checks it, and parents can only be invited by a checked school.

[A separate school data processing agreement is planned. Until it exists, the terms of use and this policy apply.]

6. How we use personal information

We use personal information for the main purpose it was collected, and for related purposes you would reasonably expect (APP 6):

• to create and run accounts, and to sign you in securely;
• to provide family and school spaces, class rosters, homework, results, challenge tests and learning plans;
• to connect a school record with a family record, when the parent agrees;
• to answer questions in Ask Ponder and give hints in the Learn space;
• to write suggested learning plans, and (when switched on) to read report cards so a person can check the results;
• to keep Ponder safe: preventing misuse, limiting request rates, investigating problems and keeping audit records;
• to process subscriptions and payments, when payments are switched on;
• to respond to you, and to send service messages such as email confirmation links;
• to meet our legal obligations.

We do not use personal information to train AI models, we do not sell it, and we do not use it for advertising. We will ask for your consent before using it for a new, unrelated purpose, unless the law allows otherwise.

7. AI and automated processing

Ponder uses Claude, an AI model made by Anthropic, through Anthropic’s commercial API. Our server sends the request; your browser never talks to Anthropic directly, and our AI key stays on our server. Under Anthropic’s commercial terms, content sent through the API is not used to train Anthropic’s models by default. Anthropic keeps API inputs and outputs for a limited period for safety and abuse monitoring under its data retention policy [confirm current retention period and whether a zero-data-retention arrangement applies].

• Suggestions, not decisions. Learning plans and report-card readings are suggestions. A parent, teacher or adult learner reviews every plan before it is saved or shared, and checks every report-card value before it becomes a result. The AI is instructed never to diagnose, label ability or compare a learner with others.
• No decisions with legal or similarly significant effects are made by AI alone. The one automated decision Ponder makes is scoring a gifted pathway challenge test: the database marks the answers, and a score of 85% or more unlocks next-year learning inside Ponder. It never changes a learner’s official school year or enrolment. A parent or teacher can ask us to review a result.
• Voice. When you ask Ponder a question by voice, the recording (up to 30 seconds) is sent from our server to NVIDIA’s hosted speech recognition service to turn it into text. The text is then handled like a typed question. Ponder does not keep the recording.
• Ponder’s spoken voice. Ponder reads her answers, hints and feedback aloud. To do this, our server sends the text of Ponder’s own words (not your recording) to HeyGen’s text-to-speech service and plays the audio back to you. You can turn Ponder’s voice off in Ask Ponder or Learn, and that choice is remembered on your device.
• Live avatar voice (when switched on; currently Off): Ponder’s talking avatar is provided by HeyGen’s LiveAvatar service. Only the text of Ponder’s own answer is sent to it to be spoken; your microphone is never connected to it. It uses a short-lived session.

8. Who we share personal information with

We share personal information only as needed to run Ponder, with your agreement, or where the law requires it:

• People you share it with in Ponder, under the access rules in Security: for example, a linked parent and a child’s teachers can see each other’s entries about that child. When friends and chat are switched on, a child’s friends see their chosen name and cartoon avatar, the other child’s parents and carers see the messages and challenges the two children share, and a parent approving a friend sees the first name of the other family’s approving parent or carer.
• Service providers who host or process information for us under contract (listed below).
• Authorities where required or authorised by law, for example a court order, or to lessen a serious threat to someone’s life, health or safety.
• A buyer of our business, if Ponder is sold or restructured, on the condition that they protect it as this policy describes. We would tell you first.

We do not sell, rent or trade personal information.

9. Service providers and overseas disclosure

Our main database, file storage and sign-in service is hosted by Supabase in Sydney, Australia. Some providers process information outside Australia. Before disclosing information overseas we take reasonable steps to make sure the provider protects it consistently with the APPs (APP 8), mainly through their contractual data protection terms. [Confirm each provider’s data processing agreement is accepted.]

Ponder’s own social media publishing uses Blotato and HeyGen to prepare and post Ponder’s marketing videos. No learner, family or school information is sent to them.

10. How we protect personal information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure (APP 11). Today these include:

• Access rules in the database. Every table that holds personal information uses row-level security, so the database itself (not just the app screen) decides who can see or change each record: a family’s guardians, a school’s owners and admins, the teachers of that class, or a linked parent. These rules are checked with a multi-user test script that signs in as each kind of user.
• Private report-card storage. Report cards go into a private storage area with the same access rules; files are never public, and the server reads them with short-lived links.
• Our staff don’t browse your records. Being a Ponder admin in the app gives access to test tools and school verification, not to families’ or schools’ learning records. Access to the underlying systems is limited to the people who operate Ponder [confirm named staff and multi-factor authentication].
• Encryption. All traffic uses HTTPS (TLS), with HTTP Strict Transport Security. Our providers encrypt stored data at rest [confirm against provider documentation]. Email sign-in passwords are stored only as secure hashes by Supabase.
• Keys stay on the server. Keys for the AI, voice and payment services are kept in server settings and never sent to browsers. The browser only has a public key that works together with the database access rules.
• Audit log. Adding, changing or deleting results, learning plans and report cards is recorded in an audit log (who, what and when, without copying grades or comments). School owners and admins can see their school’s log.
• Abuse protection. Rate limits, same-site request checks, a strict content security policy and other security headers on every page.

No online service can be perfectly secure. If you think your account has been compromised, change your password and contact us straight away.

11. How long we keep information, and deleting it

We keep personal information only for as long as we need it for the purposes in this policy or as the law requires, then delete or de-identify it. Our planned retention periods are below. Where we note that deletion is not yet automatic, we carry it out manually on request and are building automatic deletion.

Deleting your account. You can delete your account yourself in My account → Your data and privacy → Delete my account. It happens straight away: your family, the children only you look after and their records are deleted with it; a family you share with another parent or carer stays with them; schools keep their own records; any paid plan is cancelled. You can also email us from the address on the account and we will delete it within [30 days]. If you are the only owner or admin of a school that still has staff or students, make someone else an admin first, or talk with us about what happens to the school’s records.

12. Accessing and correcting your information

You can ask for a copy of the personal information we hold about you or your child, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading (APPs 12 and 13). Much of it you can already see and edit yourself in the app, and you can download a copy of your information, and of each child you look after, in My account → Your data and privacy. For anything else, contact us. We will:

• confirm your identity (and, for a child’s information, that you are their parent, carer or school) before releasing anything;
• respond within 30 days;
• not charge you for making a request, or for correcting information;
• explain in writing if we refuse, why, and how to complain.

For records a school entered, we may refer your request to the school, because the school manages those records. If we can’t correct something, you can ask us to attach a statement that you believe it is wrong.

13. Cookies and device storage

Ponder does not set advertising or tracking cookies, and we do not use analytics tools today. The app stores a few items in your browser’s local storage and session storage so it can work. These are necessary for the features you use, so we don’t ask for consent separately; you can clear them in your browser settings at any time (you will be signed out).

Our pages load fonts from Google Fonts, which receives your IP address and browser details. Stripe sets its own cookies on its checkout pages when payments are switched on. If we add privacy-friendly analytics in future (for example Vercel Web Analytics, which does not use cookies), we will update this policy first.

14. Marketing and social media

• We never direct marketing at children, and we never use a child’s information for marketing.
• We may send adult account holders occasional news about Ponder only if you opt in, and every message will have an unsubscribe link (APP 7 and the Spam Act 2003). [Ponder does not send marketing emails today.]
• Ponder’s Facebook, Instagram, LinkedIn and YouTube accounts are Ponder’s own. Our posts never include information about learners or families. Videos made for children are marked as made for kids and carry no links. If you interact with those accounts, the platform’s own privacy policy applies to what you share there.

15. Payments

Paid plans are not switched on yet, and nothing is charged today. When they are, payments are handled by Stripe on Stripe’s own secure checkout and billing pages. Your card details go straight to Stripe and never touch Ponder’s servers. We keep only the Stripe IDs, your plan, seat count, subscription status and dates, and the billing email, so we can give you access to the features you pay for. Stripe’s privacy policy explains how Stripe handles your information.

16. If there is a data breach

If we suspect a data breach, we act immediately to contain it, then assess it within 30 days. If it is likely to result in serious harm to anyone, we will notify the people affected (or, for children, their parents, carers or school) and the Office of the Australian Information Commissioner as soon as practicable, under the Notifiable Data Breaches scheme. Our notice will say what happened, what information was involved and what you should do. Where a school’s records are involved, we will also tell the school promptly so it can meet its own obligations.

17. Questions and complaints

If you have a concern about how we handle personal information, please contact our privacy contact first (details below). We will acknowledge your complaint within [5 business days] and aim to resolve it within 30 days, and we will tell you the outcome in writing.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au/privacy/privacy-complaints, phone 1300 363 992. If your concern is about a school’s records, you can also raise it with the school or its education authority.

18. People outside Australia

Ponder is made for learners, families and schools in Australia, and we don’t market it elsewhere. If you use Ponder from the European Union or the United Kingdom, the GDPR or UK GDPR may give you extra rights, such as data portability, restricting processing and objecting to processing. We rely on performing our contract with you, our legitimate interest in running a safe service, and, for children’s information and report cards, consent from a parent, carer or school. Transfers to the USA rely on our providers’ standard contractual clauses or equivalent safeguards. Contact us to use these rights. You can also complain to your local data protection authority.

19. Changes to this policy

We will update this policy when Ponder changes, for example before switching on report-card reading, payments or the live avatar. The version number and date at the top will change. If a change materially affects how we handle your information, we will tell account holders by email or in the app before it takes effect. Earlier versions are available on request.

20. Contact us

Privacy contact: [Privacy officer name or role]
Email: [Privacy contact email] (until it is published, contact us through Help)
Post: [Legal entity name], [Registered address], Western Australia
ABN: [ABN]

You can ask for this policy in another format, free of charge. Related pages: Privacy for kids and parents · Terms of use (draft) · Trust and compliance · Australian Privacy Principles ↗