Privacy policy

Published 21 October 2026

This policy explains how NextGenAchievers looks after personal information in our app and on our website. Each section starts with a short summary in bold.

1. Our privacy promises

We collect as little as we can.
Kids use a username, not their real name.
Kids, parents and teachers can ask to see, fix or delete their information.
We'll tell you in plain words before we make a big change.

2. Are you a kid?

Read Privacy for kids. It's one short page that explains all this in kid-friendly words.

3. Who we are

In short: we're an Australian company, and we aim to follow the privacy laws that apply where our users live.

NextGenAchievers is run by Next Gen Achievers Pty Ltd, ABN 49 685 561 344, Queensland, Australia ("we", "us"). We aim to follow the privacy laws that apply where our users live, and to take extra care with children's information. We'll update this policy as privacy rules for children's apps change.

4. What we collect

In short: it depends on who you are. We only collect what we need to run the app.

What we collect
Who	What we collect	Needed or optional
Kids with a school seat	A username made by the teacher; a placeholder email (not a real address); the shared class password (stored encrypted, so the app can show it to the teacher); the seat's own sign-in password (stored hashed, one-way, by our sign-in provider); role, learning track and link to the teacher; progress (lessons completed, coins, XP, skills, medals, streak, Vault jars and goals with the names the child types, money in and out and cash-ins, and any coins cash rate a parent sets); activity in the app linked to the username, like lessons opened or completed.	Needed to run the app.
Kids with a parent account	A username; a placeholder email (not a real address); the link to the parent's account; role and learning track; progress and activity, as above.	Needed
Kids, teens and young adults who sign up themselves	A username; a password (stored hashed, one-way, by our sign-in provider); role and learning track; progress and activity, as above. Pathfinders and Mavericks give their own email address. Explorers don't give a real email. We ask for the year of birth once, to check the age group and whether a parent needs to approve. We don't store it. We keep only whether parent approval was needed and when the check happened.	Needed
Parents and guardians	Email address; the link between parent and child accounts; guardian email addresses on consent requests; the parent PIN (stored as a hash); consent history; parent profile details.	Needed
Teachers	Email address; password (stored hashed, one-way, by our sign-in provider); a generated username (not a name); seat limit, learning track and the shared class password; the classes and student seats created. We don't collect teachers' names or school names.	Needed
Website visitors who contact us	What you choose to send through our forms: name, email address, organisation (for enquiries) and your message.	Optional
Guests	A guest username and activity records saved on our servers: event type, lesson number, XP total, streak days and a small technical field. No real name, email or class. Lessons, coins, Lifetime XP, medals and Vault progress stay on the device. Guest activity records are deleted automatically after 30 days.	Needed to run guest play
Leaderboard settings	Whether the leaderboard is switched on for each child or class, and a short record of who changed it.	Optional. It's off until a parent or teacher switches it on.

We don't collect kids' real names, dates of birth or home addresses, and we don't store birth years. IP addresses are used briefly, in memory only, to stop misuse. Our own sign-in log also records the device or browser and the IP address of each sign-in, and it's deleted automatically after 30 days. Our sign-in provider keeps the IP address and device or browser details for each active sign-in, until you sign out or the account is deleted. Our hosting, database and email providers keep short-term technical logs, which may include IP addresses, for security and delivery, then delete them.

Like any website, our hosting provider briefly processes technical details, such as your IP address, browser type and region, to deliver pages. These logs are deleted automatically within about a day.

5. How we collect it

In short: from the people who set up accounts, and from the app as it's used.

From teachers, when they set up a class and create usernames.
From parents and guardians, when they create an account, link a child or answer a consent request.
From people who sign up themselves.
From the app, as kids complete lessons and activities.
From our website forms, when you contact us.

6. Why we use it

In short: only to run NextGenAchievers, and always with kids' best interests first.

To create and secure accounts. A username and password let you sign in. The learning track (Explorer, Pathfinder or Maverick) sets the right lessons.
To save learning. We store progress so kids can pick up where they left off.
To run school classes. Teachers see their own class only.
To link parents and children, so parents can give consent, change a child's learning track, recover usernames and delete accounts.
To send essential emails to adults: parents, guardians and teachers. These are approval and consent emails, welcome emails, class confirmations, password and username recovery, unused-account warnings, and account-deleted notices.
Optional emails. At sign-up, parents and learners aged 14 or older who sign up themselves can tick an optional box to get occasional emails from us. It's off unless ticked, isn't offered to Explorers, children a parent adds, teacher accounts or class seats, and you can unsubscribe any time.
To understand how the app is used in school trials. We record simple activity, like signing in, starting and finishing lessons, earning medals and opening Vault or Launchpad, with the username, class, XP and streak. It doesn't include email addresses, real names or device details, and it stays in our own database.
To reply to you when you contact us through the website.

Kids' best interests come first. Before we collect or use a kid's information, we ask whether it's good for the kid. We don't use third-party analytics or tracking tools in the app.

No profiling or automated decisions. We don't build profiles of kids, and we don't make automated decisions that significantly affect anyone. There are only two automatic steps. The age-group check at sign-up decides whether a parent needs to approve the account. And accounts that stay unused for 12 months are deleted automatically (section 13).

7. Usernames

In short: a username keeps a kid's real name private.

Kids use a username instead of a real name. At school, the teacher makes the username, and the school keeps any list that matches usernames to students. At home, please choose a username that doesn't include a real name, a school or anything else that could identify a kid.

8. Parents and guardians: consent

In short: younger kids need a parent or guardian to say yes.

Kids aged 13 and under need a parent or guardian to say yes before using an account, or a school to set up their class.
Guest play. Kids can try lessons as a guest, without signing up. Progress, including lessons, coins, Lifetime XP, medals and the Vault, is saved on the device. On our servers, we save simple activity records under a guest username: the type of activity, the lesson number, the XP total, streak days and a small technical field. They don't include a real name, email or class. The "Clear this device's progress" button clears the device only. It doesn't remove the records on our servers. Guest activity records are deleted automatically after 30 days.
People aged 14 and over can agree for themselves. We encourage teens to talk with a parent first. Young adults on the Maverick track (17+) sign up themselves.
Launchpad. Launchpad helps kids start a real small business outside the app, so it needs a parent's approval.

Parents can change a child's learning track and recover usernames in the app. Behind the parent PIN, "My child's data" lets parents see, download and delete a child's data, and "My account" lets parents download or delete their own account and see their consent history. Kids are told about these controls in Privacy for kids.

9. Schools

In short: teachers set up classes, and schools tell parents.

Teachers set up classes and create usernames that shouldn't include a student's real name. The school keeps any list that matches usernames to students. We ask schools to tell parents about NextGenAchievers, and to get any consent needed, before students start. Students in a class share one class password, stored encrypted so the app can show it to the teacher. Teachers see their own class only. The class list shows usernames, each student's lifetime XP and the class total. Each student's page shows progress, coins, medals, Vault and recent activity, with a "Download data" button for that student's full data file. "Export whole class" downloads one spreadsheet with a row per student: username, track, lessons done, coins, lifetime XP, medal counts, day streak and Save, Spend, Give and Emergency jar balances. It doesn't include emails, goals or dates. Teachers can delete a student or a whole class. We'll tell schools before a big change that affects their students.

10. Leaderboard, coins and XP

In short: coins and XP are virtual, and no other user can see a kid on the leaderboard.

Coins are collected as kids learn, and coin balances are stored. Coins are virtual, and the app never moves any money. Parents can choose to set a coins cash rate and pay an agreed reward outside the app.
XP is a virtual score that shows learning progress. It isn't linked to money in any way. Teachers can see XP for their own class.
Leaderboard. The community leaderboard is off until a parent or teacher switches it on, and parents and teachers can switch it off again. When it's on, it shows the kid's own username and some sample players, each with a rank, a day streak and Lifetime XP. No other user can see the kid's username or XP, and nothing on it links to a profile.

11. Who can see it, and where it's stored

In short: only the people who need it, and our service providers in Japan and the United States.

Teachers see their own class only.
Parents see their linked child's username, account status and learning track. Behind the parent PIN, they can also see and download the child's data.
Authorised NextGenAchievers staff can access stored data only to give support and keep the service running, for example to reset a password.
Other users can't see a kid's username or XP. The leaderboard shows sample players and the kid's own row only (section 10).

We don't share personal information with anyone else unless the law requires it.

We use these service providers. Some store or process data outside Australia:

Supabase (database and sign-in): data is stored in Japan (Tokyo).
Vercel (app hosting): app functions run in the United States (Washington DC).
Resend (email): emails are processed in Japan (Tokyo), and Resend keeps its email delivery records (logs) in the United States.

We stay responsible for how your information is handled.

12. Cookies and device storage

In short: we only use what's needed to sign in and save progress.

In the app: a sign-in session cookie, plus a short-lived cookie during password recovery. The app also keeps a list of accounts used on the device, a progress cache and the session in your browser's local storage. It uses no analytics, advertising or tracking tools. On a shared computer, please sign out when you're finished.

13. How long we keep it, and deleting it

In short: we keep information while it's used. Parents and teachers can see, download and delete it in the app, and anyone can ask us by email.

App: we keep information while the account or class is active. If an account isn't used for about 11 months, we send one warning email. A child's warning goes to the linked parent, or to the teacher for a class seat. Parents and teachers get one for their own accounts too. A parent account counts as active while any linked child is active, and a teacher account while any class seat is active. We never email a class student or a child on a parent account. If we have no parent or teacher email to reach, there's no warning. An account still unused at 12 months is deleted, and never sooner than 30 days after a warning.
Activity records are deleted along with the account they belong to.
Our sign-in log: it includes the device or browser and IP addresses, and it's deleted automatically after 30 days.
Active sign-ins: our sign-in provider keeps the IP address and device or browser details for each active sign-in, until you sign out or the account is deleted.
Our providers: our hosting, database and email providers keep short-term technical logs, which may include IP addresses, for security and delivery, then delete them.
Backups: we don't currently keep restorable backups. So once information is deleted, we can't get it back.
Website enquiries: if you email us or use the Register your interest form, we keep the details you send, such as your name, work email, organisation, organisation type, roughly how many people would use it, and anything you'd like us to know, so we can reply to you and follow up your enquiry. We keep enquiries for up to 12 months after we last hear from you, then delete them, unless you become a customer. You can ask us to delete yours sooner.

How to see, download and delete:

Parents: behind the parent PIN, "My child's data" lets you see, download and delete your child's data. "My account" lets you download or delete your own account and see your consent history. Deleting your own account also deletes all linked child accounts.
Teachers: each student's page has a "Download data" button for that student's full data file. "Export whole class" downloads one spreadsheet with a row per student (no emails, goals or dates; see section 9). You can delete a student or a whole class. You can also delete your teacher account, which removes your classes and all student logins. You type DELETE to confirm.
Kids: the "My info" page shows the username, the learning track and who manages the account. Kids can't download or delete in the app, so they can ask their parent or teacher, or email us. The "Ask my account manager" button on the leaderboard doesn't send a message or email, so it's best to talk to the parent or teacher directly.
Guests: progress, including lessons, coins, Lifetime XP, medals and the Vault, is saved on the device. Simple activity records (no real name, email or class) are saved on our servers under a guest username. "Clear this device's progress" clears the device only. Guest activity records are deleted automatically after 30 days. To ask us to delete guest activity sooner, email info@nextgenachievers.com with the guest username.
Downloads are a plain data file. They leave out password and PIN hashes, class passwords and security tokens.
By email: anyone can email us to ask for a deletion. A kid can ask too, or the parent of a kid under 16. We'll delete the kid's information and confirm in writing within 30 days.

14. Your rights

In short: you can see, fix or delete your information.

You can ask us:

to see the personal information we hold about you or your child, explained in a way that's easy to understand
to fix anything that's wrong
to delete it (section 13)
to stop an optional feature, or withdraw consent
how we use your information.

Parents and teachers can see, download and delete information in the app (section 13). For anything else, or if you'd rather not use the app, email us, and we'll respond within 30 days.

15. Questions and complaints

In short: ask us anything. If you're not happy, you can also contact the privacy authority where you live.

Email info@nextgenachievers.com. Kids are welcome to ask too. You don't have to give your name for a general question. If you have a complaint, email us first and we'll reply within 30 days. If you're not satisfied, you can also contact the privacy or data protection authority where you live.

16. Security

In short: we protect information, and we'll tell you if something serious goes wrong.

Data is sent over encrypted connections (HTTPS). Each class's shared class password is stored encrypted, so the app can show it to the teacher. Every account's own sign-in password, class seats included, is stored hashed (one-way) by our sign-in provider, and the parent PIN is stored as a hash. Access is limited by account role, and only authorised staff can reach stored data. Password reset events record the user ID and role, never the password. If a data breach is likely to cause serious harm, we'll tell the people affected, and any authority we're required to tell.

17. Changes to this policy

In short: we'll tell you before big changes.

We'll post updates here and change the date above. If we make a big change, such as a new kind of information or a new use of children's information, we'll email parents and teachers at the address on their account before it takes effect, and we'll tell schools. Please keep your email address up to date.

18. Contact us

Privacy questions, requests and complaints: info@nextgenachievers.com