Privacy Policy
Last updated: 1 August 2026
NAPLANPractice provides practice tests for school students. Because most of the people practising here are children, this policy explains in plain language what we collect about a child, who controls it, how long we keep it, and how a parent gets it deleted.
Short version. An adult creates the account. We store an email address, a first name, and the answers and scores from practice tests. We do not sell data, we do not run advertising, and we do not use third-party analytics or tracking. A parent can ask us to delete everything at any time by emailing privacy@naplanpractice.com.au, and we will do it within 30 days.
1. Who we are
NAPLANPractice operates the website at naplanpractice.com.au. We are an independent provider of practice material. We are not affiliated with ACARA, with NAPLAN, or with any government body or school authority. NAPLAN is a registered trademark of ACARA, used here only to describe what our practice material is for.
For any privacy question, contact privacy@naplanpractice.com.au.
2. Accounts are held by adults
An account must be created and held by a person aged 18 or over. If the person practising is a child, the parent or guardian creates the account, holds the login, and is responsible for it. By creating an account you confirm you are an adult and that you consent to us handling your child's information as described in this policy.
We do not ask a child to create their own account, and we do not knowingly collect information directly from a child without a parent or guardian having set up the account first. If you believe a child has created an account without a parent's involvement, email us and we will delete it.
3. What we collect
Information you give us
- Email address — used to sign in, to confirm the account, and to contact the account holder about the account.
- First name — used to personalise the interface. A nickname is fine; we do not need a child's full or legal name, and we ask that you do not provide one.
- Password — stored only as a cryptographic hash by our authentication provider. We never see or store the password itself.
Information created by using the service
- Practice test activity — which test was attempted, when it started and finished, the answers given, and the resulting score.
- Account role — whether the account is marked as a student, parent or teacher account.
What we deliberately do not collect
- No date of birth, home address, phone number, school name or student identifier.
- No advertising or marketing profiles, and no data sold or shared with data brokers.
- No third-party analytics, no tracking pixels, and no social media trackers. The site loads no third-party scripts at all.
- No cookies for tracking. Your sign-in session is kept in your browser's local storage on your own device and is cleared when you sign out.
4. Third parties who process data for us
We keep this list as short as we can. It is currently two entries.
| Who | What they handle |
|---|---|
| Supabase | Our database and sign-in system. They store the account details and practice results described above on our behalf. Data may be stored on servers outside Australia. |
| Vercel | Hosts the website itself. Like any web host, their servers process the IP address of visitors in order to deliver pages, and keep short-lived technical logs. |
One further disclosure for completeness: our pages load a web font from Google Fonts. That request tells Google the IP address of the device loading the page. No account information is sent, but we mention it because it is technically a request to a third party.
5. How long we keep it
- While the account is open — we keep the account details and practice history so progress can be tracked over time.
- After a deletion request — removed from our live systems within 30 days.
- Inactive accounts — if an account is not signed in to for 24 months, we delete it and its practice history.
- Backups — deleted data may persist in encrypted backups for up to a further 30 days before those backups expire.
6. How a parent gets information deleted
Email privacy@naplanpractice.com.au from the address the account was registered with, and say what you want: a copy of the information we hold, a correction, or deletion.
We will confirm within 7 days and complete the request within 30 days. We do not charge for this. If we cannot verify that you hold the account, we may ask one confirming question before acting — this is to stop someone else deleting or downloading your child's information.
You can also ask us to stop processing the information, or withdraw consent, at any time. Withdrawing consent means the account is closed, because the service cannot run without storing the account and its results.
7. Security
Access to practice data is restricted at the database level so that an account can only ever read its own records — this is enforced by the database itself, not just by the website. Passwords are hashed by our authentication provider and are never visible to us. Traffic to and from the site is encrypted with HTTPS.
No system is perfectly secure. If a breach occurs that is likely to cause serious harm, we will notify affected account holders and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.
8. Complaints
If you are unhappy with how we have handled your information, email us first and we will try to resolve it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
9. Changes to this policy
If we change this policy in a way that materially affects how we handle a child's information, we will email account holders before the change takes effect. The date at the top of this page always reflects the current version.