Last updated 25 October 2026.
Pebble Island is run by Katie Larissa Martin (ABN 60 695 024 558) ("we", "us"). This policy explains what personal information we collect, why, where it is kept and what you can do about it. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth), and we design for children's privacy as the Children's Online Privacy Code requires.
Pebble Island is for learning and playing.
A grown-up set it up for you. They typed your first name and your age.
We keep what you learn, so the games know what to show you next.
We do not show you ads. We do not sell anything about you.
Your grown-up can see your progress. They can ask us to delete it any time.
If something feels wrong, tell your grown-up.
Parents and guardians create the account, add their children, choose a plan and manage settings. By adding a child, you confirm you are that child's parent or legal guardian, or have their permission, and you consent on the child's behalf to us handling the child's information as this policy describes.
Children use Pebble Island under their parent's account. They cannot create accounts, buy anything, message other people or share anything publicly. Settings and the Parent Hub are locked behind a parent PIN.
| Information | From | Why |
|---|---|---|
| Your email address and password (stored only as a secure hash) | You, at sign-up | To create and secure your account |
| Name and email from Google or Apple, if you sign in with them | Google or Apple, with your permission | To sign you in |
| Your choice about marketing emails, with the time and wording you agreed to | You | To keep a record of consent, as the Spam Act 2003 requires |
| Your plan, its status and renewal date | Stripe | To give you access to what you paid for |
| Each child's first name or nickname, age, year level, state, interests (for example "magic" or "dinosaurs") and the name of their helper character | You | To show the right lessons, pictures and reports |
| Learning activity: lessons and games played, answers, scores, levels, time spent, rewards, and how confident your child said they felt about a lesson | The app, as your child uses it | To adapt the difficulty, plan what comes next and show you progress |
| Anything you type in the Parent Hub report builder, such as your child's legal name, registration date and notes | You | To draft your home education report |
| Work-sample photos you add to a report | You | To include in your report. These stay on your device and are not uploaded to us. |
| Your parent PIN (stored only as a secure hash) | You | To lock grown-up areas |
| Basic technical information (IP address, browser type, time of request) | Your browser, automatically | To deliver the website and keep it secure |
We do not collect your child's photo, voice, location, school, contacts or any government identifier, and we do not ask for health information. Please don't enter health or other sensitive information about your child in free-text fields.
We collect only what is needed to provide Pebble Island. If you don't give us your email, you can't create an account. Everything else about your child is up to you; the app works with just a first name and age.
We use personal information to:
We don't use children's information for advertising, profiling for marketing, or training artificial intelligence models, and we don't sell or rent anyone's information.
Pebble Island saves your family's data in your browser on your device, and a copy in your account so you can use more than one device.
| Provider | What they do | Location |
|---|---|---|
| Supabase | Stores accounts and your family's saved data | Sydney, Australia |
| Stripe | Sells and processes subscriptions as merchant of record. Stripe receives your email and payment details under its own privacy policy. We never see your card number. | Australia and overseas, including the United States and Ireland |
| Vercel | Hosts the website | Global network, including the United States |
| Google Fonts | Supplies the text fonts. Your browser requests them from Google. | United States |
| Google or Apple | Only if you choose to sign in with them | United States |
| Your device's speech voice | Reads text aloud. Some browsers send the text to their own speech service. | Depends on your browser |
Children's learning data is stored in Australia. Providers outside Australia receive only what they need for their task, and we choose providers who protect information to a standard similar to the Australian Privacy Principles. We may also disclose information if the law requires it.
We send marketing emails only to parents who tick the box to agree. The box is never ticked for you. Every email says who it's from and has an unsubscribe link, and we act on unsubscribes within five business days. You can also switch this off in Grown-ups. We never send marketing to children.
Data is encrypted in transit and at rest. Each account can read only its own data. Passwords and PINs are stored only as one-way hashes. Grown-up areas need your PIN. If a data breach is likely to cause serious harm, we will tell you and the Office of the Australian Information Commissioner as the law requires.
We keep your information while your account is open. If you use Delete my account data, your family's saved data is removed from our database straight away and marketing emails stop. To close your login as well, email us and we'll do it within 30 days. Backups clear within 30 days. Stripe keeps billing records for as long as the law requires. Data saved in your browser stays until you delete it, clear your browser data or reset the app.
We'll respond within 30 days. We may need to confirm you're the account holder first.
Email hello@pebbleisland.app. We'll reply within 30 days. If you're not happy with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.
If we make a significant change to this policy, we'll email account holders and show a notice in the app before it takes effect.