🔒 Privacy Policy

Last updated: 13 April 2026

ATAR Ready ("we", "us", "our") provides interactive study tools for Australian senior secondary students preparing for WACE, QCE, VCE, HSC and SACE exams. This policy explains what personal information we collect, how we use it, who we share it with, and the choices and rights you have. We aim to comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

1. Who We Are

ATAR Ready operates the websites at atarready.com.au (study guides) and the "Bring Your Own PDF" tool. For privacy questions, data access requests, corrections or complaints, contact us at:

• Email: privacy@atar-ready.com.au
• Postal: [POSTAL ADDRESS]

2. Information We Collect

Information you give us

• Account details — your email address and password (or, if you sign in with Google, your Google account email, display name and profile photo).
• Profile selections — the state, school and subjects you choose so we can show you the right content.
• Promo codes — if you redeem a school promo code, we record the school name associated with that code.
• Uploaded exam PDFs — if you use the Bring Your Own PDF tool, we compute a SHA-256 hash of each file you upload, store the file in our Cloud Storage (deduplicated by hash), and record which files you uploaded against your account.
• AI explanation requests — when you press "Explain", we send the question text and image to a Google Gemini model and cache the response.

Information we generate as you use the service

• Study activity — bookmarks, personal notes, self-assessment scores, mock exam results, time spent.
• Drawings and annotations — pen/eraser strokes you make on questions, saved per-question.
• Sync data — a copy of your progress synced to Firestore so it follows you between devices.

Payment information

Payments are processed by Stripe. Stripe collects and stores your card details directly — we never see or store your card number. We retain only your Stripe customer identifier and subscription status (active, trialing, cancelled) so we can grant or revoke access.

Stored on your device

We use localStorage and IndexedDB (not third-party tracking cookies) to remember your dark-mode preference, cache your study progress for offline use, and (in the Bring Your Own PDF tool) store your uploaded PDF locally so it renders quickly. You can clear this at any time from your browser settings.

3. How We Use Your Information

• To create and operate your account and sync your study data across devices.
• To process payments, validate promo codes, and grant or revoke access.
• To generate AI explanations when you request them.
• To detect that uploaded PDFs match recognised official exams (via hash matching).
• To debug problems, improve the product, and communicate service updates.
• To comply with our legal obligations.

We do not use your information for third-party advertising, and we do not sell your personal information.

4. Who We Share It With

We share information with the service providers listed below, only as needed to deliver the service. Some of these providers store or process data outside Australia (primarily in the United States). Where we do this, we take reasonable steps to ensure they handle your information in a way consistent with the APPs.

Provider	What we share	Why	Location
Google Firebase (Authentication, Firestore, Cloud Storage, Cloud Functions)	Account credentials, profile, study data, drawings, uploaded PDFs	Sign-in, database, file storage, server-side logic	Primary region: australia-southeast1 (Sydney). Some Auth metadata may transit Google infrastructure in the United States.
Stripe	Email, name, payment card (collected directly by Stripe), subscription metadata	Process subscriptions and one-off payments	United States (PCI-DSS compliant)
Google Gemini API	Question images and text from exams you are studying (only when you request an AI explanation)	Generate written explanations of exam questions	Google data centres (region depends on Google's routing)
Google Fonts	Your IP address (as part of standard HTTP requests)	Serve web fonts	Google CDN (global)

We may also disclose information if required by Australian law (for example, in response to a valid court order), or to protect the rights, safety or property of users or the public.

5. Children and Young People

Our service is designed for senior secondary students, most of whom are aged 15 to 18. Following guidance from the Office of the Australian Information Commissioner (OAIC):

• We presume that users aged 15 or older have the capacity to consent to providing their personal information themselves.
• If you are under 15, please ask a parent or guardian to set up and manage your account, or to consent on your behalf.
• Where a school provides access through a bulk promo code, the school may be acting as the point of consent for its students. Schools should ensure they have appropriate parental consent in place before distributing access codes.

If you believe a child under 15 has registered without parental consent, contact us and we will promptly delete the account.

6. Security

We take reasonable steps to protect your information from misuse, loss, unauthorised access, modification and disclosure. These include:

• HTTPS everywhere (TLS encryption in transit).
• Firebase Authentication for password handling — we never see your raw password.
• Firestore security rules that restrict each user to their own /users/{uid}/** data.
• Stripe handling card data under PCI-DSS, so we do not store payment card numbers.
• Access controls on administrative tools and limited access to production data.

No service can guarantee perfect security. If we become aware of a data breach that is likely to cause serious harm, we will notify affected users and the OAIC in line with the Notifiable Data Breaches scheme.

7. How Long We Keep Your Information

• Account and study data — kept for as long as your account is active. You can request deletion at any time.
• Payment records — Stripe retains transaction records as required by Australian tax and consumer law (typically 7 years).
• Cached AI explanations — kept indefinitely in a shared cache so other users studying the same question don't need to re-query the AI. Cached explanations are not linked to your account.
• Backups — copies of data may persist in encrypted backups for up to 30 days after deletion.

8. Your Rights and Choices

You have the right to:

• Access the personal information we hold about you (APP 12).
• Correct information that is inaccurate, out of date or incomplete (APP 13).
• Delete your account and the associated personal data.
• Withdraw consent for optional processing (such as AI explanations) at any time.
• Complain to us, and — if unsatisfied with our response — to the OAIC at oaic.gov.au or 1300 363 992.

To exercise any of these rights, email us at privacy@atar-ready.com.au. We will respond within 30 days.

9. For Users in the EU and UK (GDPR)

If you access the service from the European Union or United Kingdom, you have additional rights under the GDPR / UK GDPR, including the rights of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection. The legal bases on which we rely are: contract (delivering the service you signed up for), consent (for AI explanations and marketing emails), and legitimate interests (security, debugging, product improvement). You may withdraw consent at any time without affecting the lawfulness of prior processing, and you can lodge a complaint with your local supervisory authority.

10. Cookies and Local Storage

We do not use third-party advertising or tracking cookies. We use:

• Firebase Authentication cookies — to keep you signed in.
• localStorage — for your dark-mode preference and a local copy of progress and bookmarks.
• IndexedDB — in the Bring Your Own PDF tool, to store your uploaded PDF in your browser for fast rendering.

11. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. If changes are material, we will notify you by email or via an in-app notice the next time you sign in.