ethicsplaygroundEthics Olympiad Pty Ltd · ABN 52 606 554 367

Ethics Playground — Privacy Policy

Version 1.0 — 27 October 2026. Reviewed annually; next review by 27 October 2027.

Who we are. Ethics Playground is run by Ethics Olympiad Pty Ltd (ABN 52 606 554 367), PO Box 116, Dernancourt SA 5075, Australia. We also run the Ethics Olympiad competitions. This policy covers Ethics Playground (ethicsplayground.com.au and ethicsplayground.com) and the information we hold about the teachers, schools and students who use it. Our privacy officer is Lachlan Wills, privacy@ethicsplayground.com.au.

This policy explains what Ethics Playground collects, why, who can see it, where it is stored, how long it is kept, and how to ask us about it. It is written for teachers and school leaders. A short version for students is in the Acceptable Use Policy, and a note you can send to parents and carers is at the end.

1. Who Ethics Playground is for

Ethics Playground is used by schools. A teacher creates a class, adds students by first name, and students sign in with a class code and a four-digit PIN to play short ethics games with multiple-choice answers. Students do not create accounts, do not enter any information about themselves, and cannot message anyone. Schools are responsible for telling parents and carers that the class uses Ethics Playground; the parent note at the end of this policy is written for that.

2. What we collect

About students (the only personal information we hold about a child):

About teachers: email address, display name, the school they belong to, a password stored by our sign-in provider as a one-way hash (we cannot read it), whether two-step sign-in is turned on, the date of last sign-in, and which version of this policy they accepted and when.

Technical information: when a student or teacher signs in, we record the date, the outcome, and the first part of the network address (enough to spot a pattern of guessing, not enough to identify a device). We do not use cookies for tracking or advertising; the only cookies are the ones that keep a student or teacher signed in, and one that remembers whether sound is on.

What we do not collect: surnames, dates of birth, photos, email addresses or phone numbers of students, free-text writing by students, location, device identifiers, or anything about a student's beliefs. See section 4.

3. Why we collect it

We collect this information to run the games, keep each class's results separate, show leaderboards within a class and (where the school allows) between schools, let teachers see how their class is going, and keep the service secure. For schools covered by state privacy law, the school is the organisation collecting the information for its educational purposes and we hold it on the school's behalf under our Terms of Service. We do not use personal information for advertising or marketing, do not sell it, do not use it to train artificial-intelligence models, and do not share it with anyone except the service providers in section 7.

Ethics Olympiad Pty Ltd is a small business. We have chosen to handle the information covered by this policy as if the Australian Privacy Principles applied to us in full, and to be bound by the Notifiable Data Breaches scheme as described in section 11.

4. Thought experiments: a deliberate exception

Some activities ask students what they think about an ethical dilemma. How a child answers those questions is sensitive, so answers to thought experiments are stored with no link to the student at all: not their name, not their class, not their school. Nobody, including teachers and us, can see how an individual student answered; the only thing recorded against a student is that they finished. The anonymous answers are used in aggregate ("64% chose this") to show the class the spread of views.

5. Leaderboards and who can see a student's name

6. Where information is stored

All data is stored in Sydney, Australia (Supabase, hosted on Amazon Web Services, region ap-southeast-2) and processed by our application servers in Sydney (Vercel, region syd1). Backups are encrypted and kept in Australia. We will give schools at least 30 days' written notice before moving data, or granting access to it, to or from another country.

7. Who else handles the information

Our Sub-processor List names every outside service, what it receives and where it is. In summary: Supabase and Amazon Web Services (database and sign-in, Sydney), Vercel (hosting, Sydney, with global delivery of static files that contain no personal information), Resend (sends password emails to teachers, so receives teacher email addresses and names), GitHub (source code only, no personal information). No analytics, advertising, tracking or artificial-intelligence services are used. No personal information about students leaves Australia. The only personal information sent outside Australia is a teacher's email address and name, for password emails.

8. How long we keep information

Our Data Retention and Deletion Schedule has the detail. In summary:

9. Access, correction and deletion

A teacher can see, correct, deactivate and permanently delete any student in their class at any time from the dashboard, and can export everything we hold about a class as a spreadsheet. A school can ask us to delete all its data; we do so within 10 business days and confirm in writing. Parents and carers should contact the school, which can act on their behalf; or contact us at privacy@ethicsplayground.com.au and we will respond within 30 days, free of charge. What survives deletion is explained in the Data Retention and Deletion Schedule (a security log entry with an internal ID and no name; anonymous aggregates; backups until they roll off).

10. How we protect it

Encryption in transit and at rest; access to the database only through our application servers, never directly from a browser; PINs and passwords hashed; throttling and lock-outs against guessing; two-step sign-in required for our administrators and available to teachers; a record of every administrative action; automated dependency checks; an independent security test. Our Security Hardening Standard has the detail.

11. If something goes wrong

If we become aware of a data breach affecting a school's data, we will tell the school as soon as practicable and no later than 72 hours after we confirm it, with what happened, what information was involved, what we have done and what the school should do. Our Data Breach Response Plan sets out the process, including notification to the Office of the Australian Information Commissioner where the breach is likely to result in serious harm.

12. Complaints

Contact our privacy officer at privacy@ethicsplayground.com.au. We acknowledge complaints within 5 business days and aim to resolve them within 30 days. If you are not satisfied you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, for government schools, to your state's privacy regulator.

13. Changes to this policy

We will publish changes here with a new version number and date. Teachers will be asked to accept the new version at their next sign-in before continuing, and schools will be emailed when a change affects what we collect or who handles it.

Note for parents and carers (for teachers to send)

Our class is using Ethics Playground, an Australian website of short ethics games run by Ethics Olympiad Pty Ltd. Your child signs in with a class code and a PIN; the site holds only their first name, an emoji they choose, and their game scores. It holds no surname, date of birth, photo, email or free writing, and when the games ask what your child thinks about a dilemma, that answer is stored without any link to them. All data is kept in Sydney and is never used for advertising. Classmates can see each other's first names and points on a class leaderboard. [If opted in: Our class has also joined the national leaderboard, on which students at other schools can see your child's first name, emoji and state.] The privacy policy is at ethicsplayground.com.au/privacy. Questions: ask me, or email privacy@ethicsplayground.com.au.