StudyHop is a learning app for school students from Kindergarten to Year 12, made by StudyHop (ABN 49 670 495 397), Sydney, Australia. This policy explains what we collect, why, and what we never do. It is written to comply with the Australian Privacy Act 1988 and the Australian Privacy Principles, and with the children's privacy rules of the Apple App Store and Google Play.
The short version
- A parent or school creates every child account. Children sign in with a nickname and a PIN, never an email address. Students aged 15 or older may make their own account with their own email.
- We collect only what the app needs to teach: the child's school year, the questions they answer, and what they type to ask for help. Photos of questions and notes are used once to help and are not kept.
- We never show advertising, never sell data, and never share a child's information with advertisers or data brokers.
- Parents can see, correct and delete their child's data at any time from the Parent page, or by emailing us.
What we collect
Parents and teachers
Your email address and a password (stored only as a one-way hash), or your Google or Microsoft account identifier if you sign in that way. Your email is used to sign you in, to send the weekly progress summary if you turn it on, and to answer your support questions.
Children
A nickname chosen by the parent (we ask for a nickname, not a full name), a PIN (stored as a hash), the school year, the buddy character they pick and the name they give it, and their learning activity: lessons started and finished, answers given, scores, stickers earned, saved work, the days they use the app, and the questions they type to the tutor. Photos of a question or of class notes are read once to answer or make a quiz and are not stored. We do not ask children for their real name, date of birth, email, phone number, address, school, or location, and the app has no open chat with other users.
Students who sign up themselves (15 and older)
Their email address and a password (stored only as a hash), their state and school year, and the same learning activity as above. They confirm they are 15 or older when they sign up, and manage and pay for their own Student plan. Under 15, a parent must make the account.
Website visitors
If you use the Contact page, or send a message from the website chat, we keep your name, email and message (and that chat) so we can reply.
Automatically
Standard server logs (IP address, browser type, time of request) kept by our hosting provider for security, for a short period. Sign-in uses a session cookie. Our public website pages (not the learning screens or the StudyHop app) use advertising cookies from Google (Google Ads) and Meta (the Meta Pixel, for Facebook and Instagram ads) so we can tell whether our ads lead to visits and family sign-ups. They tell Google and Meta that a visit or a family sign-up happened, along with the standard details any website sends (IP address and browser type). We never send names, email addresses or any child's information, and a student's own sign-up is never reported. You can block these with your browser's cookie settings, at adssettings.google.com, or in your Facebook or Instagram ad preferences. We use no other advertising cookies and no third-party analytics.
How we use it
To run the app: to show the right lessons for the child's year, mark answers, bring back questions they got wrong, keep their stickers and streaks, and show parents and teachers how they are going. We also use questions and lesson results in aggregate, with no names attached, to improve the lessons the app writes.
Who else sees it
We use a small number of service providers to run StudyHop. Each one receives only what it needs to do its job, under a contract and its own privacy terms, and none may use the data for advertising or for anything else:
- Lesson and answer service: receives the question, the photo, or the topic and year a lesson is for, so it can write the lesson, mark a written answer or explain something. It never receives a child's nickname, username or any account details, and it does not use what we send to train its systems.
- Voice service: receives only the sentence the buddy or narrator says out loud.
- Payments: parents pay through Apple (in the iPhone and iPad app), Google Play (in the Android app) or our card payment provider (on the website). They handle the payment and the card details; we never see or store card numbers, only the plan, payment dates and amounts.
- Email: sends the parent emails (weekly summary, reminders, account emails) and our replies to you. It receives the parent's email address and the message.
- Hosting and security: runs the website and app, stores the database, and runs the "are you human" check on sign-up and contact forms.
- Videos: video suggestions are looked up by topic only. No account details are sent.
Data sent outside Australia
Some of these providers process data overseas, mainly in the United States, and some in Europe and other countries where they run servers. What is sent overseas is limited to what is listed above: questions, photos and lesson requests (never with a child's nickname or username), sentences to be spoken, parent email addresses and messages, and payment details handled by the payment providers. We choose providers that protect data to a standard similar to the Australian Privacy Principles.
We do not sell personal information, and apart from the website advertising cookies described above, we do not share it with advertisers, data brokers or social networks. We would only disclose information if the law required it.
Google sign-in and Google Classroom
Students and teachers can sign in with their Google account. We receive only the account's identifier, email address and name, and use them only to sign that person in to their existing StudyHop account. Signing in with Google never creates a new account.
A teacher can choose to connect Google Classroom. StudyHop then asks Google for permission to: see the teacher's Classroom classes (so they can pick one), see the students in the class they pick and their school email addresses (so StudyHop can add those students to the teacher's StudyHop class and let them sign in with Google), and create assignments in that class (so the work the teacher sets in StudyHop also appears in Classroom, with a link). We read only the class the teacher picks, only when they ask, and we post only work the teacher sets. We don't read students' other Classroom work, grades or files.
The connection is stored securely (encrypted) and the teacher can disconnect at any time on the Google Classroom page in StudyHop, or at myaccount.google.com/permissions. StudyHop's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We never sell Google user data, use it for advertising, or use it to train AI models, and people at StudyHop only see it when it's needed for support, security or the law.
Microsoft sign-in and Microsoft Teams
Students and teachers can sign in with their school Microsoft 365 account. We receive the account's identifier, name and email address and use them only to sign that person in to their existing StudyHop account; signing in with Microsoft never creates a new account. A teacher can choose to connect Microsoft Teams: StudyHop then asks Microsoft for permission to read the teacher's Teams classes and the students in the class they pick (names and school email addresses), and to create assignments in that class for the work the teacher sets in StudyHop. We read only the class the teacher picks, only when they ask, and post only work the teacher sets. The connection is stored encrypted and can be removed at any time on the Microsoft Teams page in StudyHop or at myaccount.microsoft.com. We never sell this data, use it for advertising, or use it to train AI models.
Your rights and choices
- Parents can see each child's progress and saved work on the Parent page, change their year, reset their PIN, turn the weekly email on or off, and remove a child, which deletes all of that child's work.
- Anyone can ask us for a copy of their data, a correction, or deletion by emailing hello@studyhop.com.au. We answer within 30 days and delete within 30 days of a verified request.
- Schools that create accounts for students are responsible for having parental consent under their own policies.
How long we keep it
For as long as the account exists. When a parent removes a child, or anyone deletes their account (My account → Delete account), that account's work is deleted. Parents can also ask us to delete everything at any time. Payment records are kept for as long as tax law requires. Server logs are kept for up to 30 days.
One free week per person: when an account is deleted we keep a one-way fingerprint of its email address (a code that can't be turned back into the email), only so the same email can't start another free week. We keep nothing else from a deleted account for this.
Security
All traffic is encrypted (HTTPS). Passwords and PINs are stored as salted hashes. Accounts lock for 15 minutes after 5 wrong tries. Only the account owner and, for children, their linked parent can see their work; we test this regularly. If a data breach is likely to cause serious harm, we will tell affected families and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
Children under 13
Most StudyHop users are children. We never knowingly collect personal information from a child without a parent, guardian or school having created the account first. If you believe a child has an account without consent, email us and we will remove it.
Changes and complaints
If this policy changes in a way that matters, we tell parents by email and show a notice in the app. If you have a complaint, email us first; if you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.