Privacy Policy

What we collect, why, who can see it and how long we keep it, in plain English.

Who we are

ONZU is operated by THREESIXNINEBIZ PTY LTD (ABN 69 667 951 224), referred to as "ONZU", "we", "us" and "our". This policy covers the ONZU app at onzu.app, the guide at onzu.app/how and the website at onzu.com.au. Our privacy contact is privacy@onzu.app, and our postal address is 5 Frederick Street, St Peters NSW 2044, Australia. We apply the Australian Privacy Principles to everything we hold, whether or not the Privacy Act requires it of a business our size.

Who this policy is about

ONZU is used by children in Years 3 to 6 under a Family Account held by an adult. We hold a small amount of information about the adult and a pseudonymous learning record for each child. We collect what we need to run the practice engine, keep the family's account safe, bill the account owner and understand how the app is used, plus the optional items you choose to add.

What we collect, and why

From the account owner and invited grown-ups

• Email address and a password (stored hashed). To sign you in, recover your account and send you the notices in the Terms.
• Your acceptance of the Terms and this policy, with version and time. To show what you agreed to.
• Which devices are trusted for your family, and a record of protected actions such as invites, transfers and deletions. To keep the account safe and to answer support questions.

For each child (a player)

• A nickname or first name, a school year and a chosen avatar. To run the app.
• Optionally, a sign-in name and password chosen by the grown-up, so the child can play on more than one device. The password is stored hashed.
• Optionally, a four-digit device PIN chosen by the player, which reopens their session on that one device. It is not a password and does not sign them in elsewhere.
• Optionally, a photo avatar. You choose whether to add one, and the app works without it. The photo is resized on the device and stored with the player's account data so it follows the player across the family's signed-in devices. It is not public and not visible to other families. It is processed by the providers listed below and can be seen by our support staff only when needed to help you.
• Learning state: which questions and words were practised, right or wrong, and when; rewards, pets and streaks. This is the product. It is how the app decides what to practise next.
• Private Word Packs the family creates. They are visible only to your family.

How the app is used

• We record how the app is used: which features are opened, how long sessions run, where children get stuck or stop, which devices and app versions are in use. Events use a player identifier rather than a name. They remain personal information because we can link that identifier to the player's account. We use this to fix what does not work, to decide what to build and to make practice more effective. We never use it to advertise to children, to rank children against each other or to sell to anyone. The app at onzu.app sends these events to our own server, which forwards them to PostHog, an analytics service hosted in the European Union, under the player identifier only. No PostHog script runs in the app, and PostHog never receives a name, an email address or a child's answers.

About payments

• Whether your family is on a trial, a monthly plan or an annual plan, and the dates.
• A Stripe customer reference. Stripe holds your card details and billing history. ONZU never sees the card number.

Technical and safety

• Counts of broad error types by app version, with no message text, profile, child, answer or learning data attached. To see and fix breakages.
• Sign-up protection from Cloudflare Turnstile, which checks that a sign-up comes from a person. Turnstile receives your IP address and browser signals for that check.
• Server logs with IP address and request details, kept for a short period for security.
• Safety records, such as a decision to block a profile from re-joining a feature. These are kept so that deleting and recreating a profile does not bypass them.

What we do not do

• We do not require a child's real name, email address, birthdate or location. A nickname is enough.
• We do not show ads in ONZU, and we use no advertising identifiers for children. The one advertising-related use is the grown-up ad measurement described below.
• We do not run third-party tracking scripts on onzu.app or onzu.com.au. The only third parties that receive anything from your browser are the providers named below, for the purposes stated; everything else goes through our own server.
• We do not let children message each other. There is no chat.
• We do not send push notifications and never ask for permission to. We do send account emails to the grown-up, described under "How we use it".
• We do not sell personal information or share it for anyone else's marketing. Meta receives a hashed email only to match the results of our own ads, described below.
• We do not use children's information to advertise to them, in ONZU or anywhere else.

How we use it

To run the practice engine and sync progress across your family's devices. To sign grown-ups and players in and recover accounts. To bill the account owner through Stripe. To understand how the app is used and improve it. To measure our own advertising. To keep the service and the children using it safe. To fix breakages.

To email the account owner. Some emails are about your account: verification, recovery, renewal reminders, receipts, and changes to price or policy. Some are about your subscription: during and after the trial we email the owner about upgrading, including, where a child has practised, a summary of that child's progress. When you create an account we tell you that we will email you about your trial and about subscribing. You can stop the subscription emails at any time with the link in each one; account emails continue while you hold an account.

Advertising measurement

We advertise ONZU to grown-ups, never to children. If you arrive at onzu.com.au from one of our ads, the page keeps the click identifier the ad added to the address; no advertising script loads on onzu.com.au or onzu.app. When you then create an account, start a trial or subscribe at onzu.app, our server tells Meta that the ad led to that step, using the click identifier and a hashed version of your email address. This lets us see which ads work and stop showing them to you once you have joined. It involves the grown-up only; no child information is ever part of it. To be left out, email privacy@onzu.app and we exclude your account.

Who we share it with

We use service providers to operate ONZU. They act on our instructions for the purposes below. Some, including Stripe, also handle information for their own legal, security, fraud-prevention and service-improvement purposes described in their own privacy policies.

• Supabase: database and sign-in, Australia
• Vercel: hosting, United States
• Stripe: payments, worldwide
• PostHog: product analytics, European Union, via our server, no script in the app
• Cloudflare: sign-up protection, worldwide
• Resend: account emails, United States
• Meta: advertising measurement, United States, grown-ups who came from an ad only
• Google Cloud Vision: handwriting recognition, United States, only when that feature is on

Ask privacy@onzu.app for more detail on any provider, including what it processes and where.

We also disclose information where the law requires it, where it is needed to protect a child or respond to a safety report, or to a successor if the business is sold, under this policy.

Overseas disclosure

Your family's account and learning data is stored in Australia. Some providers handle information outside Australia: Vercel serves the app and runs our API from the United States, Resend sends our emails from the United States, PostHog holds usage events in the European Union, Meta receives grown-up ad-measurement events in the United States, Stripe and Cloudflare operate worldwide, and Google Cloud Vision reads a black and white image of your child's writing in the United States when handwriting recognition is turned on. We send the image through our server without your child's name or account identifier. Google processes these synchronous requests in memory and does not persist the image to disk. Google temporarily logs some request metadata, such as the time and size of the request, to improve its service and combat abuse. Google does not specify a fixed retention period for this metadata in its Vision data-usage FAQ. The United States endpoint applies to recognition processing, not a guarantee that all support, account or metadata processing stays there. Where a provider handles information outside Australia we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

What lives on your device

The app stores device preferences in your browser. While signed in as a player, it also keeps a temporary copy of unsaved progress so it can retry after a connection problem or reload. This recovery copy excludes photo avatars and is removed once saving succeeds. If you sign out with unsaved play, the app asks before discarding it. Recovery copies expire after 30 days and are removed when the app next opens; a closed app cannot erase browser storage. Other device preferences and copies left by older app versions remain until you clear the browser's site data for onzu.app. Removing a home-screen shortcut does not by itself clear that data. Clearing device data does not delete progress already saved to your account. We do not use cookies for tracking.

How long we keep it

• Usage events at PostHog: 12 months, then deleted.
• Learning data, pets, rewards and usage events in our own database: while the account is active. When you delete a player or a family, the data can be restored for 30 days. After that it is deleted from live systems and any remaining copy is de-identified, so it is no longer linked to your family.
• Backups: after data leaves our live systems it can persist in encrypted backups for up to 30 days, so up to 60 days after you asked for deletion, then expires. If we ever restore from a backup, deletions are replayed so deleted data does not come back.
• Account records: while the account is active, then the 30-day restore window, then deleted or de-identified.
• Acceptance records: 7 years after the account closes, because they evidence the contract.
• Billing records: 7 years, as Australian company and tax law requires.
• Safety records: kept for 2 years after the last related event to stop a blocked profile returning by being recreated, then deleted. Reviewed every year.
• Server and security logs: 30 days.
• Provider copies: each provider keeps information for the period in its own policy; we ask for deletion when we delete.

Cancelling a subscription does not itself delete anything. Deleting a player or a family does.

Your choices and rights

• See it: the account owner can download the family's player state, Word Packs and consent history as a JSON file from the Family Account. Anyone whose information we hold, including an invited grown-up or a parent who is not the account owner, can ask for access by emailing privacy@onzu.app. We check identity and authority in proportion to what is asked for, and reply within 30 days. If we refuse any part of a request we say why and how to complain.
• Correct it: nicknames, school years, avatars and Word Packs are edited in the app. Email us for anything else.
• Delete it: delete a single player without touching siblings, or delete the whole family, from the Family Account. Deleting the family requires a decision for every player first.
• Disputed authority: if two adults each claim authority over a child's profile, we freeze transfers and deletion of that profile, ask both for evidence of authority and act on a court order or written agreement. We do not decide custody questions.
• Complain: email privacy@onzu.app. We acknowledge within 7 days and aim to resolve within 30. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Consent and notices

Accepting the Terms records your agreement to the contract. Acknowledging this policy records that you have been told how we handle information; it is not consent to everything in it. Where we need your consent, we ask at the moment it matters: when you add a photo avatar, invite a grown-up, move a player to another family or turn on an optional feature, the app tells you what is collected, who receives it and what happens if you decline.

Children

Children use ONZU under a Family Account created by an adult. The adult chooses the child's nickname and avatar, decides whether the child has their own sign-in and controls year levels and Word Packs. A child cannot change the family's contact details, billing or privacy choices. Where we introduce any feature that lets children interact across families, we update this policy and ask the account owner to enable it first. Today there is no such feature.

Security

Passwords are hashed. Protected actions in the Family Account ask for the grown-up's password again. Player sessions on other devices use short-lived credentials the owner can revoke. Data is encrypted in transit and at rest with our providers. If we discover a breach that is likely to cause serious harm, we notify affected account owners and the OAIC as the Notifiable Data Breaches scheme requires.

Changes to this policy

When we change this policy we publish the new version with its date. If a change means we would use your family's information for a new purpose, we ask the account owner before it applies, and we ask separately for consent where the law requires it.

Contact

How the service itself is offered, including plans, refunds and cancelling, is set out in the Terms of Use.

privacy@onzu.app · 5 Frederick Street, St Peters NSW 2044, Australia · THREESIXNINEBIZ PTY LTD, ABN 69 667 951 224