Privacy Policy

Last updated: 26 July 2026

This policy explains how doandplay ("we", "the Service", operating the website doandplay.com) collects, uses, stores, shares and protects personal information about you and your child. The Service is a routine and learning tracking tool for parents, in which parents create and manage records for their own children. By using the Service you confirm that you have read and understood this policy; if you do not agree, please do not use the Service.

Applicable law: the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs); the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs).
In addition, we design the Service to a high standard of children's privacy, and will comply with the Australian Children's Online Privacy Code once it formally takes effect.

1. What personal information we collect

We collect only what is necessary to provide the Service (data minimisation):

a) Parent account information

• Email address (for sign-in, account security and important notices).
• Password — handled by our authentication provider Supabase. We neither see nor store your password in plain text.
• A family display name you choose (a nickname is fine).

b) Information you create for your child (entered by you)

• Your child's name or nickname, and age.
• A profile photo of your child (optional).
• Routines, subjects, boards, goals, calendar check-ins, and learning / behaviour tracking records.
• Photos and other attachments you upload (optional).
• The login card the system generates for your child (username + 6-digit code, for read-only child sign-in; the code is stored only as a hash).

We encourage you to use a nickname or code name instead of your child's real name, and not to upload identifiable photos unless necessary.

c) Information related to AI features

• What you or your child type when talking to the "AI assistant (Ember)", together with the related records needed to generate a response.
• To support undo, Ember saves a snapshot of any record it is about to change. The snapshot is stored in Australia alongside that record, and is deleted together with the child or family it belongs to.
• We do not retain AI conversation history; we keep only usage metadata (time, model, action type, token count, for billing and capacity), with no message content. See section 4 for the important note on third-party AI processing.

d) Payment and billing information (once paid features are enabled)

• Billing uses a "subscription + energy points" model: recording and tracking features are free forever and require no subscription; only the AI assistant "Ember" requires a subscription, and it draws energy points from your balance based on actual usage.
• Payments are handled by a third-party payment provider (such as Stripe), which collects and processes your card details directly. We do not see your full card number. We keep only what is necessary, such as subscription status, energy-point balance and transaction records.

e) Technical and usage information

• A sign-in session token (stored locally in your browser to keep you signed in).
• The minimum technical data needed for security and abuse prevention (such as failed sign-in counts and rate-limit counters).

2. How we use this information

• To provide and maintain the Service (displaying and managing your child's goals, plans and tracking, and the AI assistant's scheduling and suggestions).
• To authenticate parents and children and keep accounts secure.
• To generate the AI assistant's responses and scheduling suggestions (see section 4).
• To process subscriptions and payments, meter usage, and prevent abuse.
• To contact you about service changes, security incidents and other important matters.
• To meet legal obligations and handle disputes.

We never use children's data for targeted advertising, we do not sell your data or your child's, and we do not use it for anything unrelated to the Service.

3. About children's data

Your child's information is the most sensitive part of the Service, and we design around that:

• We apply the best interests of the child as a design principle, with features collecting as little as possible by default.
• Parent-controlled: the account belongs to the parent and the child's view is read-only; entering, changing and deleting are all the parent's decision.
• Parental consent: at sign-up a parent must agree to this policy and confirm they are the parent or guardian before any child record can be created.
• No targeted advertising and no profile-based marketing built on children's data.
• Deletion in one step: a parent can export or permanently delete a single child, or the entire family, at any time (see sections 6 and 7).
• We treat anyone under 18 as a minor, with the care that implies.

4. AI features and third-party model processing (important)

The Service's "AI assistant (Ember)" relies on a third-party large language model provider (currently OpenAI; this may change or expand in future, and we will update this policy accordingly). To generate a response, what you or your child type, together with the related learning records needed for context, is transmitted to that provider's API for processing.

• That provider's servers are outside Australia and New Zealand (in the United States), so this processing constitutes a cross-border disclosure (see sections 5 and 6).
• We submit data through the provider's API with the no-retention setting enabled: conversations are not stored on the provider's side, and under its API terms content submitted via the API is not used to train its models. We likewise do not retain AI conversation history, keeping only usage metadata for billing.
• Please avoid entering unnecessary sensitive information in conversations with the AI (such as identity numbers, home addresses or detailed health diagnoses).

5. Who we share information with

We do not sell personal information. We share it only in the following cases, and only to the minimum extent necessary, with providers who help us operate (and who may process the data only on our instructions):

We may also disclose information where required by law, to protect significant safety or rights, or with your separate consent. In the event of a business transfer (merger or acquisition), your information may transfer under equivalent protection commitments, and we will notify you beforehand.

As the table shows, some processing takes place outside Australia and New Zealand. By using the Service you understand and agree to the cross-border processing necessary to provide those features.

6. Where data is stored, cross-border transfer, and retention

• Primary data (accounts, children's records, photos) is stored in Australia (Supabase Australian region) and encrypted at rest.
• AI processing may leave the country, as described in sections 4 and 5.
• We do not transfer data to China for processing.
• Retention: data is kept while you use the Service; once you delete a child or family, or close your account, it is handled as set out in the next section. Billing and transaction records may be retained for a period where the law requires it.

7. Your rights and how to exercise them

Under Australian and New Zealand privacy law, you have the right to:

• Access your and your child's personal information ("Export my data" is available in the Service).
• Correct inaccurate information (editable directly in the Service).
• Delete: "Delete account" in the Service permanently removes the entire family (including all children's records and uploaded photos, by cascade). Where you request deletion, we will destroy the data within 30 days of receiving the request (up to 60 days in complex cases).
• Withdraw consent: you may stop using the Service and delete your data at any time.
• Complain: see the next section to contact us. You may also complain to a regulator — in Australia the OAIC, and in New Zealand the Office of the Privacy Commissioner.

8. Security measures

• HTTPS in transit; encryption at rest in the database.
• Row-level security (RLS) plus application-layer isolation: every request made after a parent signs in is constrained at the database layer to that parent's own family, so a fault in the application layer still cannot read across families.
• Link-based features have a different boundary: the family display link, upload links and direct image links do not require sign-in, and their security boundary is the unguessable credential contained in the link itself. Please do not forward such links to anyone who should not see them; the display link can be regenerated in the app at any time, which invalidates the old one immediately.
• Children's photos and other files are kept in private storage, reachable only through short-lived links issued by our backend, with no publicly guessable URLs.
• Passwords and children's login codes are stored only as hashes, never in plain text.
• Server-side keys are used only in the trusted backend and are never sent to the frontend; sign-in is rate-limited and abuse-protected.

No system can guarantee absolute security. If a data breach occurs that may affect your rights, we will notify you and the relevant regulators as required by law.

9. Cookies and local storage

We use browser local storage to hold your sign-in session token so you stay signed in; this is necessary for the Service to work. We do not use third-party advertising or tracking cookies.

10. Changes to this policy

We may update this policy from time to time. We will notify you of material changes in the Service or by email. Continuing to use the Service after a change takes effect means you accept it.

11. Contact us

For privacy questions, to exercise your rights, or to complain, contact [email protected]. We aim to respond to your request within a reasonable time (generally within 30 days).