Shard Learning - Privacy Policy
Last updated: 29 September 2026
1. Purpose and audience
This is the privacy policy for Shard Learning: what we collect, why, who else sees it, and what you can ask us to do. It is written for schools, teachers, students, and their parents and guardians, and it is the binding version. Any plain-language rendering only explains it.
We handle personal information in our own right under the Privacy Act and the Australian Privacy Principles. A school decides that its students use Shard Learning and holds the relationship with families.
Shard Learning is used by teachers, by school students from Year 5 upward, and by adults doing professional learning.
2. Information we collect
We collect the following information on the platform.
| Whose information | What we hold | Why |
|---|---|---|
| Anyone with an account | Email address, display name, sign-in method, encrypted password if a password is used | To create the account and sign you in |
| Teachers | First and last name, school name | To check a teacher is a teacher and run their classes |
| Students | Email address, display name, teacher-provided name | To place a student in a class and show work to their teacher |
| Students | Expected graduation year | So we know when to delete their information |
| Anonymous classroom participants | A display name we generate | To join a live lesson with no name and no email address |
| Administrators | Email address and display name | To operate the platform |
| Class membership and invitations | The class an account belongs to, invitations sent and accepted | To run classes and enrolments |
| Learning records | Lessons completed, each answer as it is given, programming artefacts such as Python and Scratch code, and time spent on a lesson | To show progress to a student and their teacher |
| Sign-in and verification records | The connecting address, the browser's description of itself, the email address entered including where no account exists, and the Microsoft tenant identifier where a school uses Microsoft | To keep accounts secure and look into misuse |
We never collect a date of birth, an address, a phone number, payment or financial information, or location.
3. How we use information
We use personal information to run accounts and keep them secure, to deliver lessons, to show progress, to check that a teacher is a teacher, to send account mail such as class invitations and password resets, and to meet legal obligations.
We use it for nothing else. We do not advertise, market to students, build profiles, sell or rent information, or use anyone's work to train AI models. We run no analytics and no tracking. We give information to law enforcement only where the law requires.
4. How and where we store and share information
Personal information is held in Australia, in the Sydney region.
We give ninety days written notice before personal information, or access to it, moves outside Australia.
These services hold information for us, or receive it when your browser connects to them.
| Provider | What it does for us | What it receives | Where it is |
|---|---|---|---|
| Amazon Web Services | Hosts the platform | Everything the platform holds | Sydney, with certificates and edge delivery in the United States |
| Google sign-in | Signs you in with a Google account | Email address, name, account identifier | United States |
| Microsoft Entra | Signs you in with a school Microsoft account | Email address, name, account identifier | United States and worldwide |
| Google Workspace | Our own mail and documents | Mail we send, and enquiries you send us | United States and European Union |
| Growing Up Greatness | Copied on class invitations for its own classes | Learner email address, class name, join link | Mail hosted by Google |
5. Keeping information safe
Information is encrypted in transit and at rest. Passwords are stored one way and cannot be read back. Repeated failed sign-ins are slowed and then blocked. Accounts can only reach their own information, or in the case of a teacher, the information of their students.
We set these cookies, and none of them is used for analytics, advertising or tracking.
| Cookie | What it does | Lifetime | HttpOnly | Includes identifiable information |
|---|---|---|---|---|
| Refresh token | Gets your browser a fresh sign-in without your password | 30 days | Yes | No |
| Access token | Keeps you signed in | 8 hours | Yes | Yes (but not accessible) |
| Claim | Shows the page who is signed in | 8 hours | No | Display name only |
| Theme preference | Remembers the theme you chose | 1 year | No | No |
| Impersonation | Set only while an administrator is acting as an account | 8 hours | Yes | Yes (but not accessible) |
6. Children's privacy
The platform is used by children from Year 5 upward, and we take extra care with their information. We collect the least the product needs, use it only to run lessons and show progress, give it to no advertiser or data broker, run no analytics or tracking, and never use a student's work to train AI models.
Sections 2 to 5 set out each of those in full. How we keep children safe on the platform, and how to raise a concern about a child, are in our Child Safety and Online Safety Policy.
If you have a question about your child's information, ask your child's school, or write to us at the address in section 9.
7. If there is a data breach
If we discover a breach affecting a school's students or staff, we tell that school as soon as possible. We follow our incident response plan, which sets out how we contain the breach, assess who is affected and report it. Where a breach must be notified under the Privacy Act, we tell the Office of the Australian Information Commissioner.
8. How long we keep information, deletion and your rights
A student's account and the work in it are kept while they are at school, and deleted once they finish. Accounts nobody uses are reviewed every year. Sign-in details, including the connecting address and the browser description, are removed on a fixed schedule. The database is backed up to a point in time, so information can remain in a backup after it leaves the live system.
You can ask us for a copy of what we hold about you, or to correct or delete it. We answer within 30 days and confirm a deletion in writing. A parent or guardian can ask on behalf of their child, and a school or teacher on behalf of a student. Every request is handled by a person.
9. Changes, contact and complaints
We review this policy at least once a year. A significant change is one to what we collect, what we use it for, or who we share it with. We tell you when we make one and ask you to acknowledge it at your next sign-in.
Write to the Privacy Officer at official@shardlearning.com with any privacy question, request or complaint. If our answer does not satisfy you, you can take the matter to the Office of the Australian Information Commissioner.
A summary of our rules are here: Terms and Privacy