Privacy Policy
Last updated: November 2026
1. Overview
K.S. Innovations (ABN 69 890 596 069) (“we”, “us”, “our”) operates PosiTrack, a behaviour tracking application for educational environments. This Privacy Policy explains how we collect, use, store, and protect personal information in connection with the App and our website.
We are committed to complying with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in that Act. We handle all personal information with care and in a manner consistent with the APPs, and we expect all schools and users of PosiTrack to do the same.
2. Information We Collect
We collect the following types of information:
- Account information: Name, email address and school name, provided when creating an account using a school-issued access code.
- Behaviour records: Positive behaviour points and related records entered by teachers and administrators within the App. These records are associated with student names or identifiers as entered by school staff.
- Device information: Device type, operating system, and App version, collected for support and performance purposes only.
- App usage information: Analytics about how the App is used, such as which screens are viewed and which features are used (for example, awarding points or running a prize draw). This information is associated with your account so we can improve the App and assist with support requests. It never includes student behaviour records.
- Crash reports: If the App crashes or encounters an error, a diagnostic report (including device model and operating system version) is collected so we can find and fix the problem.
- Notification tokens: If you enable point notifications, a device token is stored so we can deliver push notifications to your device. You can turn notifications off at any time.
We do not collect sensitive information (as defined under the Privacy Act) and we do not knowingly collect personal information directly from students.
3. Student Data
PosiTrack is designed to minimise the collection of student personal information. Student names or identifiers are entered into the App solely by authorised school staff. We do not collect, access, or use this information for any purpose other than providing the service to the school.
Schools and teachers bear responsibility for ensuring that their use of the App — including the information they choose to enter — complies with their institution's privacy policies, any applicable state education department guidelines, and the Privacy Act 1988 (Cth). We recommend that schools obtain appropriate authorisation before entering student information into the App.
4. Analytics and Diagnostics
The App uses Google Analytics for Firebase and Firebase Crashlytics to understand how the App is used and to identify crashes and errors. This data covers App usage only — screens viewed, features used, and technical diagnostics. Student behaviour records are never included in analytics or crash data, analytics data is not used for advertising, and it is not shared with third parties for their own purposes.
Our website (positrack.app) does not use analytics or tracking cookies.
5. How We Use Information
We use the information collected to:
- Provide, maintain, and improve the App and its features
- Manage school accounts and access
- Respond to support requests
- Ensure the security and integrity of the platform
- Meet our legal obligations
We will not use personal information for direct marketing without your consent, and we will not use it for any purpose that is inconsistent with the reason it was collected.
6. Data Storage and Security
Student information, behaviour records and account profile information are stored in Google Cloud Firestore in Sydney, Australia. CSV exports and score-reset archives are stored in Google Cloud Storage in Sydney, and backups stay in Sydney.
Some Google and Apple services that PosiTrack relies on are global and may process data outside Australia, including in the United States:
- Sign-in: staff email addresses and password hashes are held by Firebase Authentication.
- Push notifications: when a staff member chooses to follow a student, PosiTrack sends them notifications such as “Sam Smith earned 3 points”. The notification text, including the student's name and points earned, passes through Firebase Cloud Messaging and, on iPhone and iPad, Apple Push Notification service.
- Analytics and crash reports: Google Analytics for Firebase and Firebase Crashlytics receive app usage events, a pseudonymous user ID, the school ID and staff role, and crash reports. They do not receive student information or behaviour records.
Section 7A lists every service provider, what it receives and where.
We implement appropriate technical and organisational security measures to protect personal information against unauthorised access, loss, misuse, or disclosure. However, no system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet.
7. Data Sharing
We do not sell, rent, or share personal information with third parties for marketing purposes. We share personal information only with the service providers listed in section 7A, and only so they can provide their service to us.
We may disclose personal information if required to do so by law, or to protect the rights, property, or safety of our users or the public.
7A. Our Sub-processors
We use the service providers below to run PosiTrack. Each one processes data only to provide its service to us, under its data processing terms, and none may use PosiTrack data for its own purposes such as advertising.
Lawful basis: under the Privacy Act 1988 (Cth), we disclose personal information to these providers only for the primary purpose it was collected for, running PosiTrack for your school (APP 6.1). Where data may leave Australia, we take reasonable steps under APP 8.1 by using providers bound by data processing terms with security and confidentiality commitments (for Google, the Google Cloud Data Processing Addendum). For schools and users outside Australia, the same disclosures are made to perform our contract with the school.
| Sub-processor | Organisation and contact | Service and purpose | Data disclosed | Where processed or stored |
|---|---|---|---|---|
| Cloud Firestore | Google LLC and Google Australia Pty Ltd. cloud.google.com/privacy | Main database for the app | Student first and last names, class, house and points; behaviour records (points awarded, by whom, when); staff names, email addresses, roles and settings; school details | Sydney, Australia (australia-southeast1), including backups |
| Cloud Functions | Google, as above | Server-side processing (awarding points, imports, exports, account and role changes, notifications) | The same data as Firestore, while it is processed | Sydney, Australia |
| Cloud Storage | Google, as above | CSV exports and score-reset archives created by school administrators | Student names, classes, houses and points | Sydney, Australia |
| Firebase Authentication | Google, as above | Staff sign-in, email verification and password reset emails | Staff email addresses, names, password hashes, sign-in records | Global, including the United States |
| Firebase Cloud Messaging | Google, as above | Delivering push notifications | Notification text (a student's name and points earned), device tokens and Firebase Installation IDs | Global, including the United States |
| Apple Push Notification service | Apple Inc. apple.com/legal/privacy, apple.com/privacy/contact | Delivering push notifications to iPhone and iPad | Notification text (a student's name and points earned), device tokens | Global, including the United States |
| Google Analytics for Firebase | Google, as above | Understanding how the app is used so we can improve it | Pseudonymous user ID, school ID, staff role, app usage events, device and app version. No student information | Global, including the United States |
| Firebase Crashlytics | Google, as above | Finding and fixing crashes and errors | Crash reports, device and app version, pseudonymous identifiers. No student information | Global, including the United States |
| Firebase App Check, reCAPTCHA Enterprise and Google Play Integrity | Google, as above | Confirming requests come from the genuine PosiTrack app, to block abuse | Device and browser signals, IP address | Global, including the United States |
| Apple App Attest | Apple, as above | Confirming requests come from the genuine PosiTrack iOS app | Device attestation data | Global, including the United States |
| Firebase Remote Config and Firebase Hosting | Google, as above | App settings, and serving the PosiTrack web app | IP address and device information. No student information | Global content delivery network |
| Have I Been Pwned (Pwned Passwords) | Troy Hunt, haveibeenpwned.com | Checking that a new password has not appeared in a known data breach | The first 5 characters of a one-way hash of the password only. Your password and email are never sent | Global (served through Cloudflare) |
| Namecheap email forwarding | Namecheap, Inc. namecheap.com/legal/general/privacy-policy | Forwarding email sent to hello@positrack.app | Whatever you include in your email, usually your name, email address and school | United States |
| Gmail | Google, as above | Receiving and answering support, privacy and access requests | Whatever you include in your email, usually your name, email address and school | Global, including the United States |
| Formspree | Formspree, Inc. formspree.io/legal/privacy-policy | The contact form on positrack.app | What you enter in the form, usually your name, email address, school and message | United States |
Before we add or replace a sub-processor that receives student information, we update this table and treat it as a material change under section 12.
8. Data Retention
We retain account information and behaviour records for as long as your school's subscription is active. Upon cancellation or expiry of a subscription, data will be retained for up to 90 days to allow for account reactivation, after which it will be securely deleted. You may request deletion of your school's data at any time before that period by contacting us.
9. Notifiable Data Breaches
We comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth). In the event of a data breach that is likely to result in serious harm to any individual whose information is involved, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable and within the timeframes required by law.
10. Your Rights: Access, Correction and Deletion
You can ask us to give you access to, correct, or delete the personal information PosiTrack holds about you. There is no charge.
How to ask. Email hello@positrack.app with your name, your school and what you are asking for. To protect your information, we will confirm your identity first, usually by replying to the email address on your PosiTrack account, or for a student, through the school.
Staff. You can correct your own name in the app at any time (Settings), and delete your account yourself in Settings. When we receive a request, we will:
- Access: send you a copy of your account details and the records linked to you, in a common electronic format
- Correction: correct inaccurate, out-of-date or incomplete information
- Deletion: delete your sign-in account and remove your name and email address from PosiTrack, including replacing your name on historical point records with “Former staff member”
Students and families. Your school controls student information in PosiTrack, and school administrators can view, correct and export it, and remove a student, at any time. Please contact your school first. If you contact us directly, we will pass your request to the school and help the school respond.
Timeframe. We acknowledge requests within 5 business days and complete them within 30 days. If we can't, we will tell you why and when we expect to finish, and we will always finish within 3 months.
If we refuse. If the law allows us to refuse part of a request, we will tell you why in writing and how to complain (section 11).
Deleted information may remain in encrypted backups for up to 14 weeks until those backups expire. It is not restored except to recover from a disaster, and if that happens we delete it again.
11. Complaints
If you believe we have breached the Australian Privacy Principles or mishandled your personal information, you may lodge a complaint with us at hello@positrack.app. We will investigate and respond within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
12. Changes to This Policy and Our Terms
We may update this Privacy Policy and our Terms of Service. When we make a material change, such as collecting new information, using it in a new way, or adding a sub-processor that receives student information:
- Every user is asked to review the updated Privacy Policy and Terms of Service, and must accept them before they can continue using PosiTrack.
- The date at the top of this page shows when it was last updated, and we keep previous versions available on request.
For minor changes that don't affect your rights, such as fixing typos or updating contact details, we update the date at the top of this page.
13. Contact
For any privacy-related questions or concerns, please contact us at hello@positrack.app.