Privacy
What is stored
Your email address, the subjects you are taking, the rating you give each skill, and the sessions the timer recorded. Alongside those, anything you add yourself: assessments, study plans, and photographs in the mistake bank.
Who can read it
You. Every table is scoped to the signed-in account in the database itself, so a request for another student's ratings comes back empty rather than depending on the app to ask politely.
Study groups
A group shares hours studied and how much of a course is covered. It never shares anybody's individual ratings, and you can sit in one anonymously, in which case the others see the figures without your name against them.
What Greenlight does not do
There is no advertising, nothing is sold or passed to anybody for marketing, and there are no third-party analytics or tracking scripts on this site.
Deleting it
You can delete your account from Settings whenever you like, and it takes everything with it: ratings, sessions, plans, group membership and the photographs in your mistake bank.
That is the whole of it in plain terms. The full policy is below and says the same things at length.
1. Who this policy is from, and what it covers
Greenlight is a study tracker for students sitting the NSW Higher School Certificate. It is operated by an individual based in New South Wales, Australia (referred to in this policy as we or us).
This policy explains what personal information we collect, why we collect it, who we disclose it to, where it is held, how long it is kept, and what you can do about it. It covers the Greenlight website and the application behind it. It is written to the Australian Privacy Principles in the Privacy Act 1988 (Cth), and we handle personal information in accordance with them.
Questions about this policy, or about the information held about you, can be sent to greenlighthsc@gmail.com.
2. Anonymity
An account needs an email address, because that is how you sign in and how a password reset reaches you, so the Service cannot be used entirely anonymously. Nothing else about your identity is required: there is no field for your real name, and a display name is optional. Inside a study group you may choose to appear anonymously, in which case other members see the group figures without your name against them.
3. What is collected
What you give us. Your email address and a password when you create an account, a display name if you set one, and the subjects you select. After that, everything you enter as you use the Service: the rating you give each skill, assessments and their due dates, study plans and the topics attached to them, notes and photographs you add to the mistake bank, the groups you join, and anything you write in the feedback form.
What using it creates. Study sessions recorded by the timer, including their length and the subject they were attributed to; a history of your rating changes, which is what the time-to-green projection is calculated from; and periodic snapshots of your overall coverage.
What is collected automatically. Ordinary server logs kept by the providers named in section 8, which include IP addresses, request times and browser user agent strings. There is no analytics service, no advertising network and no tracking code of any kind in Greenlight.
Greenlight does not ask for your address, your date of birth, your phone number or your marks, and there is nowhere to enter them. We do not collect sensitive information as that term is defined in the Privacy Act, and you should not enter any into the Service.
4. Why it is collected, and how it is used
We collect personal information only where it is reasonably necessary to provide the Service. Specifically, we use it to:
- create your account, sign you in, and verify who you are;
- store your ratings, sessions, plans and assessments and show them back to you;
- schedule your revision, build your study week and calculate the progress figures the app reports;
- show the aggregate figures described in section 8 to the members of a group you have chosen to join;
- send account emails such as address confirmation and password resets;
- keep the Service working, investigate faults and protect it against misuse; and
- comply with the law.
We do not use your information for any other purpose without your consent, unless we are required or authorised by law to do so.
5. Direct marketing
We do not use your information for direct marketing, we do not send promotional email, and we do not disclose your information to anyone else for marketing. The only email we send is about your account.
6. Payment information
No payment information is collected. If that changes, this policy will be updated to say what is collected and who processes it before any of it happens.
7. What is stored on your device
Signing in sets a session cookie, which is what keeps you signed in between visits. Your theme, typeface, timer and study preferences are kept in your browser's local storage so the app opens in the state you left it, and they stay on the device rather than being sent anywhere. A service worker caches the app so it will open without a connection.
None of this is used for advertising or to follow you between sites. Clearing your browser storage removes all of it, and you will be asked to sign in again.
8. Who your information is disclosed to
We do not sell personal information, we do not disclose it for advertising, and we do not pass it to schools, tutors or NESA. It is disclosed only to the service providers that run the Service, and only so that they can run it:
Supabase provides authentication, the database and file storage, and therefore holds everything described in section 3. Account emails, such as address confirmation and password resets, are sent through it.
Cloudflare hosts the site, serves every page and request, and keeps the server logs described in section 3.
Google Fonts serves the typefaces the app is set in. Your browser requests them directly from Google, which means Google receives the IP address the request came from. No account information is sent with it.
We may also disclose personal information where we are required or authorised by law to do so, where it is necessary to lessen or prevent a serious threat to a person's life, health or safety, or where it is reasonably necessary to investigate or report unlawful activity.
Inside a study group, other members can see your display name, the hours you have logged that week, and the proportion of your courses you have rated green. They cannot see individual ratings, assessments, or anything in your mistake bank. Choosing to be anonymous replaces your name with "Anonymous" for the other members.
Live study activity. While your timer is running, the members of your groups can see that it is running, which subject it is against, and how long it has been going. When you stop, that session stays visible to them for two hours and then disappears. This is the only part of Greenlight that shows other people what you are doing while you are doing it, it is limited to people you have chosen to share a group with, and it shows nothing at all when your timer is off. Anonymity applies to it exactly as it does to the rest of the group: an anonymous member appears on the board without a name.
9. Where it is held, and disclosure overseas
The database and the uploaded files are held on servers in Sydney, Australia. Your account, your ratings, your study history and anything you upload therefore stay in the country.
Two things still leave it. Hosting is provided by Cloudflare, whose network serves requests from locations around the world, so the page requests you make and the logs they generate may be handled in another country before reaching us. And, as section 8 explains, your browser fetches typefaces directly from Google, which receives the IP address the request came from.
Neither of those carries your account information, but both are disclosures to overseas recipients, and by using Greenlight you consent to them. You should understand that Australian Privacy Principle 8.1 will not apply to those two disclosures, meaning we will not be accountable under the Privacy Act for an act or practice of either recipient that would breach the Australian Privacy Principles. We choose providers that publish their own security and privacy commitments, and we disclose to them only what the Service needs to run.
10. How it is protected
Every table carries row-level security, which is enforced by the database rather than by the app: a request for another account's rows returns nothing even if the application asks for them. Passwords are hashed by the authentication provider and are never visible to us. Traffic is encrypted in transit. Uploaded photographs are held in a private bucket and are reachable only through a signed link issued to the account that uploaded them. Access to production systems is limited to the operator.
No system is perfectly secure, and nobody can honestly promise otherwise. If a data breach occurs that is likely to result in serious harm, we will notify affected accounts and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme.
11. How long it is kept, and deletion
Your information is kept for as long as your account exists. Nothing expires and nothing is deleted for inactivity, because a syllabus rated in Year 11 is meant to still be there in Year 12.
When you delete your account, the rows belonging to it and the photographs you uploaded are deleted immediately. Deletion is permanent: deleted information is not retained in a form from which it can be restored, and we cannot bring it back for you. Server logs held by the providers in section 8 are kept for their own limited retention periods and then discarded.
Where we no longer need personal information for any purpose set out in section 4, and are not required by law to keep it, we destroy it or de-identify it.
12. Accuracy
Most of what we hold is entered by you, and you can correct it in the app at any time. If something is wrong that the app will not let you change, write to greenlighthsc@gmail.com and we will correct it.
13. Access, correction and your choices
Everything held about you is visible in the app, and almost all of it is editable there: ratings, plans, assessments, mistakes, your display name and your group memberships. You can leave a group at any time, and you can be anonymous inside one.
You can delete your account, and everything belonging to it, from Settings. You may also ask us for a copy of the personal information we hold about you, or ask us to correct it, by writing to greenlighthsc@gmail.com. We will respond within a reasonable period, and we do not charge for making a request. If we refuse access or correction, we will tell you why in writing and how to complain about it.
14. Students under 18
Greenlight is built for HSC students, so most of the people using it are aged 16 to 18. It is not directed at children under 13, and accounts are not knowingly created for them. If we become aware that an account belongs to a child under 13, we will close it and delete what is held.
Nothing in Greenlight is advertised to, sold to, or profiled for marketing. If you are a parent or guardian and would like to see what is held about your child, or want the account deleted, write to greenlighthsc@gmail.com and it will be dealt with.
15. Changes to this policy
If this policy changes, the date at the top of it changes with it. Account holders will be told before a change that materially affects how their information is handled takes effect, rather than after.
16. Complaints
If you think your privacy has been mishandled, write to greenlighthsc@gmail.com, setting out what happened. We will acknowledge the complaint and respond to it within a reasonable period. If you are not satisfied with the response, you can take the complaint to the Office of the Australian Information Commissioner at oaic.gov.au, on 1300 363 992, or at GPO Box 5218, Sydney NSW 2001.