Privacy Policy

Last updated: 8 October 2026

Balasiguga is provided by an individual developer (a sole trader) based in Australia, ABN 70 202 810 083 ("we", "us"). This policy explains what we collect, how and why, where it's kept and what you can do about it. We follow the Australian Privacy Principles, and we give everyone, wherever they live, the same rights described below.

For children: the short version

• Your parent set up Balasiguga for you. You don't need your own account.
• We only know you by a nickname your parent chose. We don't ask for your real name, school or birthday.
• We keep the questions you practise, your answers and the notes you write, so the app knows which questions to bring back. Your parent can see them too.
• When your parent adds a question, an AI helper in another country may read it. It only sees the part of the page your parent picks, and we never tell it your name.
• To keep the app safe, a check from Google makes sure a real person is using it, not a robot.
• We never show you ads, and we never sell anything about you.
• If you want something deleted, ask your parent, or email us at support@balasiguga.com.

1. What we collect

About you (the parent or guardian)

• Your email address, name and profile picture from the sign-in you use (Google, Apple or an email link), and your sign-in account ID.
• Your plan and billing status. If you buy Pro, we give Stripe your email address, and Stripe gives us a customer ID and subscription status. We never see or store your card number.
• Your messages to us when you contact support.

About your children

• A nickname, a time zone (used to work out which day's reviews are due) and, optionally, a school year.
• The questions you add, including photos and screenshots, which may show your child's handwriting; and your child's answers, results, practice times and notes.
• For each child device you connect: a device record, when it joined, and the device's own sign-in ID. Children don't have emails or passwords.

Technical information

• Your device's network (IP) address, which our servers see with every request. If a wrong family code is entered, we keep a scrambled (hashed) form of that address, so repeated wrong codes from one place can be blocked.
• What our security check, Google reCAPTCHA, collects about the device and browser to tell real use from automated abuse. It sets one cookie that it needs to work.
• Basic server logs and error reports.
• We don't use advertising or analytics trackers. The app keeps your sign-in, your settings, and screenshots or recordings that haven't been uploaded yet, in your browser's storage on your device.

How we collect it

From you when you use Balasiguga, from your child's use on devices you connect, from the sign-in provider you choose, and from Stripe if you buy Pro. You need an email address to have an account; the school year and notes are optional.

2. Why we use it

• To run Balasiguga for your family: store questions, schedule reviews, show progress, and let child devices take part.
• To read questions from photos, screenshots and papers with AI when you ask it to.
• To take payment for Pro and apply your plan.
• To keep the service secure, prevent abuse, fix problems, and contact you about your account or important changes.

We don't sell personal information, don't use it for advertising, and don't use your family's data to train AI models. If you're in the European Union or the United Kingdom, our legal bases are: providing the service you signed up for (contract), keeping it secure and working (legitimate interests), and meeting legal obligations such as tax records.

3. AI processing

When you use an AI feature, we send only the area you framed on a photo or screenshot, plus the text needed for the task (such as the school year and your list of topics), to OpenAI in the United States. The framed area can include your child's handwritten answers. We never send the full original photo, and we never add names or account details to these requests; the app reminds you to leave names and page headers out of the frame. The one exception is blank test papers you upload as PDF files: their pages are sent whole, because they don't contain your child's work.

We ask OpenAI not to keep these requests. OpenAI may keep them for up to 30 days to check for abuse, and doesn't use them to train its models. AI results are saved only as suggestions until you review them.

4. Where it's kept and who helps us

• Google Firebase and Google Cloud host our database, file storage, sign-in, server functions and security check. Your family's data is stored in Sydney, Australia. Sign-in, security and logging services may process data in other countries, mainly the United States.
• OpenAI (United States) processes the framed areas, as described above.
• Cloudflare runs our domain and forwards support email.

These providers handle data only on our behalf, under contracts that protect it. These ones act under their own privacy policies:

• Stripe, which processes payments. For customers in the European Union and the United Kingdom, Link (a Stripe service) is the seller of record.
• Google and Apple, if you use them to sign in.
• Gmail (Google), where we read and answer support email.

Because most of these providers are overseas, your information may be handled outside Australia, mainly in the United States. We may also disclose information if the law requires it.

5. How long we keep it

• Original photos are deleted automatically about 30 days after the question is organised, unless the photo is the question's only picture. (Automatic deletion is being switched on in late October 2026; until then, original photos are kept.)
• Framed question images, screenshots and blank papers are part of your questions and are kept with them.
• Everything else is kept while your account is open, because the learning history is what makes reviews work. Questions you delete in the app are hidden everywhere but stay in your family's data until your family is deleted.
• Server logs are deleted after about 30 days.
• When you ask us to delete your family, we delete its data within 30 days, except billing records we must keep for tax law (in Australia, usually 5 years). Copies in our backups expire on their own within about 100 days.

6. Your rights

You can ask us to access, correct, export or delete your family's information, or to stop processing it. Most information can be viewed and corrected directly in the app. To delete your family and all its data, email us from the address you sign in with and we'll confirm before deleting; a self-service option in the app is coming. We'll reply within 30 days.

If you have a complaint about how we've handled your information, email us with the details. We'll look into it and reply within 30 days with what we found and what we'll do. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), or, in the European Union or the United Kingdom, to your local data protection authority.

7. Security

Data is encrypted in transit and at rest. Access rules keep each family's data separate, so one family can't read another's, and child devices can only see their own family's data. A parent can remove a device at any time. If a data breach is likely to cause you serious harm, we'll tell you promptly and report it to the Office of the Australian Information Commissioner.

8. Children

Balasiguga is designed to be used by children with a parent in charge. Accounts are only for adults, and a parent or guardian agrees to this policy for their family. We collect as little about children as we can: we ask only for a nickname, not a real name, school, birthday or contact details.

9. Changes

If we make an important change, we'll tell you in the app or by email before it applies, and ask you to agree again where needed.

10. Contact

Privacy questions and requests: support@balasiguga.com.