---

1. Who We Are

Think Square is an educational platform providing mathematical games and resources. Think Square is operated by Andrew Lorimer-Derham trading as Think Square, ABN 19 747 680 525 ("Think Square", "we", "us").

For any privacy question or request, contact our Privacy Officer at michael@thinksquare.com.au (see Section 12).

2. Data We Collect

We minimise data collection to what is strictly necessary for gameplay and account management.

• Account Administrators (Teachers, Tutors, Parents, and individuals managing their own account): Name, Email Address, Organisation Name (if applicable).
• Participants (anyone who plays the games - mostly students, but also adults playing for themselves):

3. How We Use Your Data

• Core Functionality: To deliver the games, save user progress, and maintain the integrity of the platform.
• Event Reporting: For Organisations participating in specific external challenges (e.g., Victorian Maths Games Challenge), we report aggregated, de-identified participation results to the organizing body. We do not share individual participant data for general subscribers.
• Notifications & Announcements: To tell users about activity in their games (for example, a new challenge or that it is their turn) if they have turned notifications on, and to show in-app notices about the Platform itself, such as a new game becoming available (see Section 8).
• Child Safety: Concern reports are sent only to Think Square's child-safety contacts and handled under our Child Safety and Wellbeing Policy. A report about one contact goes only to the other. We never send the reporter an automatic reply.
• Service Emails: To send emails needed to run your account, such as password resets, invoices, subscription and seat reminders, and reports you request. News or announcement emails (for example, about new games) are only sent to Administrators who choose to receive them, and every one includes a link to stop receiving them.

4. Data Storage & Sovereignty

Our primary servers are hosted in the United States (AWS Region: US-East-2, Ohio).

By using this platform, you acknowledge and consent to your data being stored outside of Australia. We ensure our hosting providers adhere to security standards equivalent to the Australian Privacy Principles (APPs).

If you turn on notifications, each notification is delivered through the push service run by your browser's maker (Google, Apple, Mozilla or Microsoft), which may process it outside Australia. Notification content is encrypted so that only your device can read it (see Section 8).

5. Data Retention

• Active Subscribers: We retain participant data for as long as the Organisation holds an active subscription.
• Deletion Policy: An account and all personal data associated with it are permanently deleted from our systems once it no longer has any active access (no current subscription, event access or free seat) and nobody has signed in to it or played a game on it for 12 months. Accounts that are still used are kept, even without a subscription. We check for these accounts every day.
• Child-Safety Records: Concern reports, and records needed to respond to them, are kept for the periods set out in our Child Safety and Wellbeing Policy, separately from the rule above.

6. Children’s Privacy & Parental Rights

For users under the age of 13 (or the legal age in your jurisdiction):

• Institutional Consent: Where Think Square is used in a school or an organised educational setting, the Organisation/Manager provides consent for data collection on behalf of the parents.
• Parental Rights: Parents have the right to review, delete, or refuse further collection of their child's data. Since we do not have a direct relationship with students, parents should first contact their Organisation Manager to exercise these rights.
• No Marketing to Children: We never use children’s data for marketing or behavioral advertising, and we do not show third-party advertising on the Platform.
• Subscriptions & Payments: Subscriptions are purchased by Administrators. Renewal reminders, invoices and offers are sent to the Administrator who manages the account (for example, the school, or a parent managing a family account). Participants who don't manage their Organisation's account are never shown payment options; if their access ends, they are asked to contact their Organisation Manager instead.
• What Children May See: While logged in, children may see in-app notices about games and features included in their access (for example, that a new game has been added). If they choose to, they can also receive notifications about their own games (for example, that it is their turn in a challenge). Notifications or emails about new games or other Platform news are only sent to Administrators who choose to receive them.

What Other Players Can See

• Leaderboards and Ranked Matches: Players in your own Organisation see your first name and the first letter of your last name (for example, "Sam T."). Players from other Organisations see only your Organisation's name, with a number on leaderboards (for example, "Hillside Primary P3"), never your name.
• Challenges: In a challenge, which two players choose to start with each other, each player sees the other's first name only.
• Shared Games: If a player shares a finished game, anyone with the link can see the game and the player's first name.
• Staff and Event Organisers: Think Square staff and authorised event organisers can see full names when they need them, for example to run an event.

7. Social Authentication

Think Square offers sign-in through Google and Microsoft (Single Sign-On, or SSO) to simplify login.

• We request basic profile information from your login provider solely to retrieve your avatar/profile picture and to obtain your email address for secure account matching. We actively discard and do not store your real first or last name, ensuring your account can be used pseudonymously. We do not access your private files, contacts, or any other data from your Google or Microsoft account.
• We store the unique Social ID provided by Google or Microsoft to link your Think Square account to your social login. This allows you to sign in securely without a separate password.

8. Notifications

Think Square can send browser and app notifications (for example, "Sam challenged you" or "It's your turn"). They are off by default.

• Opt-in Only: Notifications are only sent after a user turns them on and their browser asks for, and is given, permission. Users choose which games and which kinds of notification they receive in their account settings.
• What We Store: When notifications are turned on, the browser gives us a device identifier (a "push subscription") so we can address notifications to that device. We store it with the browser type and the user's notification choices. We keep a short log of notifications sent, which is deleted after 7 days.
• How They Are Delivered: Notifications pass through the push service of the browser's maker (Google, Apple, Mozilla or Microsoft). The notification content is encrypted so that only the user's device can read it.
• Turning Them Off: Users can turn notifications off at any time in their account settings or in their browser or device settings. Logging out removes that device's subscription, so notifications do not continue on a shared computer.
• Organisations: An Organisation Manager can switch notifications off for everyone in their Organisation at any time, under Manage → Change Organisation Details → Notifications.
• News About the Platform: Notifications about Think Square itself, such as a new game being added, are a separate choice and are only sent to Administrators who turn them on.

9. Security

• Encryption in Transit: All data sent between your browser and Think Square is encrypted using HTTPS (TLS).
• Restricted Access: Administrative access to our production systems and data is restricted to a small number of authorised people who need it to run the Platform. Think Square staff accounts can only sign in through Google or Microsoft, not with a password.
• Viewing as a User: To fix problems, a small number of Think Square administrators can view the Platform as a particular user sees it. Every time this happens, we record who did it, which account, and when.
• Passwords & Payments: Passwords are stored only in hashed form, never in plain text. Card payments are handled by Stripe; we do not see or store your full card details.

10. Cookies & Analytics

• Essential Cookies Only: We use a session cookie to keep you logged in and a security cookie to protect forms against misuse. The Platform cannot work without them. We also store a few settings in your browser, such as whether game sound is muted.
• No Tracking or Advertising: We do not use advertising or tracking cookies, and we do not use third-party analytics services such as Google Analytics.
• Usage Statistics: Our own servers record overall usage figures (for example, how many games are played each day) to keep the Platform running well and improve it. These are not used to build profiles of individuals or for marketing.
• Third-Party Services: Some "Learn" pages include embedded YouTube videos, and YouTube may set its own cookies when you play one. Signing in with Google or Microsoft, or paying through Stripe, takes you to their sites, which use their own cookies under their own privacy policies.

11. Data Breaches

If we become aware of a data breach, we will act quickly to contain it and assess the risk of harm. Where required, including under the Notifiable Data Breaches scheme, we will notify affected Organisations and individuals and the Office of the Australian Information Commissioner (OAIC).

12. Contact & Complaints

To ask a question about your privacy, request access to or correction of your personal information, or make a complaint, email our Privacy Officer at michael@thinksquare.com.au. Participants in a school or other Organisation may wish to contact their Organisation Manager first.

• What Happens Next: We will acknowledge your complaint, look into it, and give you a written response within 30 days.
• If You Are Not Satisfied: You can take your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.