1. Why this notice exists

This is the detailed companion to the short notice you tick during signup. It is written for parents and guardians, and for students old enough to hold their own account, so you can see the full list of what is stored rather than a summary of it. The broader privacy policy covers your rights, security and contact details.

2. Who holds the account

A parent or guardian is the account owner for the family. They create their own account first, give consent, and then add each child. Children under 16 do not sign themselves up. A student who is 16 or over may hold their own account instead.

About the parent or guardian we store a first name, an email address and a password. The password is held in encrypted form by our authentication provider, Supabase, and cannot be read by anyone at Sorsa.

3. About a child under 16, exactly

This is the whole record. There is no other field.

The login is a username we generate from the child's first name plus a few digits, and an eight digit PIN. The PIN is shown to the parent once at setup, held in encrypted form by Supabase, and never kept by us in a readable form. Behind the scenes each child login carries a synthetic address on our own domain. It is an internal identifier only: it is not a mailbox, it belongs to nobody, and it cannot send or receive email.

4. About a student 16 or over

A student aged 16 or over can consent for themselves. On that pathway we store their first name, year level, email address, a password held in encrypted form by Supabase, and their date of birth. The date of birth is kept for one reason: it is the record that they were old enough to give that consent. It is never collected for a child set up by a parent.

5. Learning data

As a student works we record which lessons they complete, the answers they submit and their progress. That is what makes it possible to resume a lesson, revisit an answer and see improvement over time. A parent can see this for the children on their account.

6. Consent data

Each time consent is given we record who gave it, what it covered, the notice version they were shown and the date and time. This notice is version 2026-07-v1. If we later change what we collect, the version changes with it, so it is always clear which set of promises you agreed to.

7. Where the data lives

In Supabase, on servers in Sydney, Australia. The site itself is hosted by Vercel. Analytics is Vercel Analytics, which is privacy-friendly: no cookies, no personal data, no following anyone around the web.

8. What we do not do

• we do not sell student data, ever
• we do not use it for advertising
• we do not build advertising profiles of students
• we run no third-party advertising trackers
• we do not collect sensitive information such as health, behaviour or government identifiers

9. Who can see it

A student sees their own work. A parent or guardian sees their own account and the children they added. A small number of Sorsa administrators can reach data where it is genuinely needed to run and support the platform. The database enforces this with row level security, so one family cannot reach another family's records.

Please keep passwords and PINs private, and avoid sharing logins between students.

10. Sorsa has not launched yet

Sorsa is pre-launch. Any account created now is a trial or test account, made so we can check the experience end to end before real families arrive. Everything described here still applies to it.

11. Access, correction and deletion

You can ask us to show you what we hold about your family, correct anything wrong, or delete it, at any time. Contact Sorsa through this website and include enough detail for us to recognise the account. Full detail is in the privacy policy.