Your info, and what we do with it

yipiQ is built and run by Stephanie Coaching (stephaniecoaching.com), a tutoring practice in Australia. yipiQ runs on our own server in Australia — it is not hosted on a cloud platform overseas, and your child's data stays on hardware we control. We follow the Australian Privacy Principles, and because yipiQ is made for children aged roughly 8–14, we hold ourselves to the stricter children's-privacy standards (COPPA in the US, GDPR-K in Europe) even where they don't strictly apply to us.

We collect only what the product needs to work. In full:

• Account basics — a username, a display name, and a password stored only as a cryptographic hash (we cannot read it back). Staff accounts may add an email address for sign-in. Children's accounts have no email address; a guardian's email address is stored only when it is used to authorise the child's account (see Consent, below).
• Study activity — answers given, the memory model that schedules reviews (how well each card is known and when it's next due), streaks, and in-app coins and XP. This is the product: it is how yipiQ knows what to show next.
• Things your child writes — flashcards, stories, debate and discovery posts, and other study work they choose to create in yipiQ.
• Voice recordings (optional) — some activities let a child record a short clip of themselves speaking. The audio is automatically deleted within 30 days (sooner if the take was abandoned); a text transcript of what was said is kept so their scorecard still makes sense.

We never collect data for advertising, we never build advertising or behavioural profiles, and we never sell or rent data to anyone.

yipiQ sets one cookie: ember_sess. It is the sign-in session — it is how the server knows which account is asking — and it lasts up to 30 days. It is httpOnly (scripts in the page cannot read it) and it is scoped to yipiQ alone. There are no analytics cookies, no advertising cookies, no third-party cookies, and no tracking pixels. The fonts are bundled with the app, so the browser never contacts a font service. Because the one cookie is strictly necessary for sign-in, there is no cookie banner to click through.

One outside technology provider is involved:

• OpenAI — powers the AI tutor and the marking of debate and discovery work, and transcribes voice recordings. When a child asks the tutor a question or submits work for marking, we send OpenAI the question and the child's work (for voice features, the recording itself, so it can be turned into text) — never their name, username, or any account details. Usage is capped per child per day. OpenAI states that data sent through its API is not used to train its models.

That is the whole list. There are no analytics services, ad networks, or data brokers.

Video lessons are not part of yipiQ. Stephanie Coaching provides them separately through Radiance, outside this app. This policy describes the information handled by yipiQ only; ask Stephanie Coaching if you need the privacy information that applies to a video lesson.

There are no parent accounts. Instead, each child has a private, unguessable snapshot link they can share with their parents, showing effort and momentum — streaks, minutes, daily goals — never other children and never a class ranking. Anyone who has the link can view that one child's snapshot, so it should be shared the way you'd share a password: with your own family, and no one else.

Signup asks the learner to choose one of two routes. A class code from a teacher or tutor provides school-authorised consent and opens the full account. A learner joining on their own must provide a parent or guardian's email address; the adult reviews a private page and explicitly chooses whether to allow the account. Simply opening that email link does not approve anything. We keep a record of the route and decision that applies to each account.

Until one of those routes is approved, the signed-in learner cannot use the full product. They can only try a three-card demonstration whose answers and score stay temporarily in that browser page: it does not write study history, create or publish content, use AI or voice, join classes, upload files, share work, or earn rewards. A guardian can withdraw consent at any time by emailing [email protected], and we'll close the account.

• Voice recordings — audio deleted within 30 days (within 24 hours if the take was abandoned or replaced); the text transcript is kept.
• Guest "try it" accounts — closed automatically after 30 days of inactivity.
• Sign-in sessions — expire after 30 days.
• Study work and progress — kept while the account is active, so a child's learning history keeps working for them.
• Advertising profiles — never built, so there is nothing to retain.

• See and take your data — Settings → "Export my data" downloads everything in the account as a file you can keep.
• Delete the account — on request, we permanently remove the personal details (name, username, any emails, written content and recordings tied to identity). De-identified learning statistics may be kept — numbers with no name attached.
• Withdraw consent — at any time, as above.

For any of these, or any question about this policy, email [email protected]. We keep an internal audit log of access to children's data — exports, snapshot views, moderation decisions — so "who saw what" always has an answer.

yipiQ is designed for children, so the protections above are the product, not an afterthought: no ads, no trackers, no behavioural advertising profiles, no selling of data, an adult-authorisation gate before the full product, the minimum data we can get away with, and a human (not an algorithm) reviewing anything flagged in child-written content. Children are also reminded in-app not to put personal details — addresses, phone numbers, emails — into their work; if something like that is spotted, it is flagged for a person to check rather than published onward.

If we change this policy, we'll update this page and the "last updated" date at the top. If a change matters — new data collected, a new company involved — we'll tell account holders directly rather than hoping they re-read this page. Last updated 20 July 2026.