Privacy Policy

Skillo App is an educational platform providing NAPLAN-style practice for students in Years 3, 5, 7 and 9. This policy explains how we collect, use and protect information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Skillo is designed so students are never identified by their real name or personal details. We store:

• A system-generated unique identifier (UUID)
• A display alias (colour + animal, e.g. “Gold Eagle”)
• A 4-digit postcode — used to increase the number of possible login combinations, making your account harder to guess. Combined with your colour, animal, and secret image, it creates a unique identifier that protects your account without collecting any personal information.
• Year level
• Practice question scores and answer history
• Feedback messages submitted via the feedback form (no name attached)

We do not collect names, email addresses, dates of birth, school names, or any directly identifying information.

Skillo uses essential cookies to maintain login state and improve your experience. We also use Cloudflare for security and performance, which processes request-level data including IP addresses as part of DDoS protection and bot filtering.

• Delivering NAPLAN-style practice content
• Maintaining your practice history and progress
• Improving the platform using anonymised aggregate data
• Generating anonymised regional statistics licensed to educational publishers (see Section 5 below)
• Responding to feedback submitted via the feedback form

We do not use your information for advertising, marketing profiling, or any purpose unrelated to educational services.

Skillo is free for students. Our revenue comes from licensing anonymised, aggregated regional data to educational publishers and curriculum researchers. Here is exactly how this works:

• What is shared: Regional participation and performance statistics aggregated to ABS Statistical Area level 3 (SA3) — roughly a suburb cluster. For example: “Year 7 students in the Inner East Melbourne SA3 averaged X% accuracy on Numeracy.”
• Minimum threshold: No region is ever reported unless it contains at least 100 students (k-anonymity). Regions with fewer than 100 students are reported as a broader area (e.g. “Regional Victoria”) or omitted entirely.
• What is NEVER shared externally: Individual student data, display aliases (e.g. “Gold Eagle”), postcodes, suburbs, or any identifier that could be used to single out a student.
• Who receives it: Educational publishers and curriculum researchers under data licensing agreements. Not advertisers. Not marketing firms.

Your postcode is used internally only — for school outreach and targeted ads run by Skillo directly. Your postcode is never included in external data products.

• Anthropic — used to generate practice questions. No student data is transmitted to Anthropic. Governed by Anthropic's Commercial Terms of Service including a Data Processing Addendum.
• Supabase — database storage, servers in Sydney, Australia. Data encrypted at rest and in transit.
• Vercel — web hosting. Processes limited request-level data as part of standard hosting operations.
• Cloudflare — security, DDoS protection, and bot filtering. Processes IP addresses and request metadata.

We do not sell your personal data or share it with third parties for advertising or marketing purposes. Anonymised aggregate regional data is licensed as described in Section 5.

Skillo is designed for children aged 8–15. Students are never asked for their real name, email, date of birth, or school name. All student accounts are fully pseudonymous. We collect the minimum information necessary to operate the service.

• Student account data: deleted 24 months after last activity
• Feedback messages: retained 12 months then deleted
• Inactive accounts: automatically deleted after 24 months

You can also request deletion at any time by emailing [email protected]. Because accounts are pseudonymous, please include your display alias and postcode so we can locate the record.

We use pseudonymous identifiers, encrypted database storage, Cloudflare DDoS protection, Turnstile bot verification, and rate limiting on all key actions.

You have the right to access, correct, or delete your data. Email [email protected]. We will respond within 30 days.

We comply with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). Given accounts are fully pseudonymous, the serious harm threshold is unlikely to be met in most breach scenarios. We will notify the OAIC and affected users where required.

Contact [email protected]. We will provide a substantive response within 30 days. If unsatisfied, contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

Material changes will be notified via in-app notice. The current version is always available at skillo.au/privacy.