Privacy policy

Ebiblo is operated by Ebiblo Pty Ltd (ABN 60 155 467 833), Sydney, New South Wales. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we apply them whether or not the Act requires it of us. Because many of the people who use Ebiblo are children, we take particular care with learners' information; see section 4.

1. What we collect

• Account details — your name, email address, username, sign-in method (email, Apple or Google), your birth month and year, and whether you told us you came to create or to learn. If you sign in with Apple or Google we receive only the details you allow them to share.
• Admin material — the files and prompts, typed or spoken, an Admin gives a page's agents, the page's brief, and the posts, sections and question sets their pages hold.
• Learner details — the name, and email or username, an Admin uses to add a learner to a page; for a learner without an email, the name and the login code the Admin makes for them; and the name of a reader who asks to join a group page.
• Answers and results — every attempt a learner makes, the answers given, the marks and the reasons, and progress over time. A knowledge check tried by a reader who is not signed in stays in their browser until they sign in and keep it.
• Public activity — the blogs you follow and the posts you like, which are counted for the blog's owner, and the comments you write, which anyone reading the post can see with your name.
• Notification subscriptions — a push subscription for each browser or device on which you turn notifications on.
• Usage and technical information — pages visited, device and browser type, IP address and approximate location, so the Service works and we can see what is used.
• Correspondence — messages you send through the contact page.

We do not ask for sensitive information as the Act defines it. Admins should not include health, racial, religious or similar information in material or questions.

2. How we collect it

Directly from you when you create an account, set up a page, follow, like or comment, or contact us; from an Admin when they add a learner; from learners and readers when they answer; from your device when you turn on notifications; and automatically through cookies, browser storage and logs. You can read public blogs and the public parts of the website without identifying yourself.

3. Why we use it

To run the Service: drafting posts, sections and question sets from an Admin's brief and material, marking answers, publishing what an Admin publishes, showing results and progress to the learner and to the Admin who owns the page, and sending the notifications you have turned on. To bill you for a paid plan and for credits you buy. To support you. To keep the Service secure and detect misuse. To understand how the Service is used and improve it. To meet our legal obligations. We do not use material or answers to train AI models, we do not sell personal information, and we show no advertising.

4. Learners and children

A learner under 18 can only join Ebiblo through an invitation from an Admin who has confirmed they are the child's parent or guardian, or a school or tutoring centre acting with parental consent. We collect the minimum a learner needs to answer and see their own results. A learner's answers and results are visible only to that learner and to the Admin of the page they answered on. Parents and guardians can ask to see or delete a child's information through the contact page; where the Admin is a school or centre we may also refer the request to them.

5. AI processing

Admin material and learners' answers are processed by AI models — to draft posts, sections and question sets, and to mark written and spoken answers against an approved answer or the exam's scale. This is done through Emidox, also operated by Ebiblo Pty Ltd, on our own accounts with third-party AI providers: Amazon Web Services (through Amazon Bedrock), OpenAI, Anthropic, Google, DeepSeek, xAI and Moonshot AI. Amazon Bedrock also draws the pictures Quilt adds to posts and sections, and reads the figures on the pages of a PDF an Admin gives Quest. The content of a draft or a marking run goes to the provider of the model that runs it, which processes it for us under its agreement with us. Learners' names are not sent to the model; answers are.

Spoken answers. When a learner records a spoken answer, the recording is sent through Emidox to OpenAI, which writes down what was said and marks it. That runs on our own OpenAI account. The recording itself is not kept. What was heard, and its mark, are kept for seven days so the attempt can be handed in, and then with the attempt, like a written answer.

Speak. Speak, in the boxes where an Admin writes to a page's agents, uses the speech recognition built into your browser, not ours: your browser turns what you say into text in the box, and we receive only the text you send. To do that, your browser usually sends your voice to its own speech service, under that company's privacy terms — Chrome sends it to Google, Edge to Microsoft and Safari to Apple — unless it can recognise your language on your device, as Chrome can for some languages, in which case your voice stays on your device. Firefox has no speech recognition, so it offers no Speak.

6. Who we share it with

• AI providers — as described in section 5.
• Service providers — hosting, storage, payment processing (Stripe), push-notification delivery (the push services of the browsers you use, such as Google, Apple and Mozilla) and analytics providers who work for us under contract and may only use the information to provide their service.
• Your browser's speech service — if you use Speak, your browser sends your voice to the company that provides its speech recognition (Google for Chrome, Microsoft for Edge, Apple for Safari), which handles it under its own privacy terms. We do not receive the audio.
• Emidox — the two products share your account details so you sign in once, and Emidox holds the agents and input pages behind your pages.
• The Admin of a page — sees the learners on that page, their attempts, and requests to join it. A plan's owner sees every page on the plan.
• Everyone — what an Admin publishes on a public blog, the owner's name shown with it, and the comments readers write there are public: anyone can read them, and search engines and AI assistants can index them.
• Where the law requires — to a court, regulator or law-enforcement body under a lawful request, or to protect our rights or someone's safety.

7. Overseas disclosure

Some of the providers above — AI model providers, hosting, payment and push-notification services — are located or store data outside Australia, including in the United States, the United Kingdom, the European Union and China. We send information to them only to run the Service, and we take reasonable steps to choose providers that handle it consistently with the APPs, but they are bound by their own laws and terms. By turning on notifications you consent to the relevant information being sent to your browser's push service in the country where it operates. By using Speak you consent to your voice being sent to your browser's speech service, which may be outside Australia.

8. How we protect it

Data is encrypted in transit and at rest. Access to production data is limited to people who need it to run the Service. We use reputable hosting with access controls, logging and regular backups. No system is perfectly secure; if a data breach is likely to result in serious harm we will notify affected people and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

9. How long we keep it

Account details are kept while your account is open. Attempts and results are kept while the page they belong to exists, so that progress can be seen over time; an Admin can delete a page, which deletes its sets and attempts. Closing your account deletes your material, answers and results, apart from records we must keep by law (for example billing records, kept for seven years) or need to resolve a dispute. Backups roll off within a short period after deletion.

10. Cookies and analytics

We use a sign-in cookie, a preference cookie for light or dark appearance, and a cookie that remembers your analytics choice. If you try a knowledge check without signing in, your answers are kept in your browser's storage under a random number for that device, so you can come back to them; signing in files them with your account. On the public website, the sign-in page and public blogs we use Google Analytics, provided by Google, to count page views, sign-ups and which pages help people. It sets its own cookies and receives your IP address and browser details; we turn off Google's advertising features and do not send it your name, email or anything you type, and a public blog is reported by its number, never its name. Quiz, document, input, library, account and dashboard pages are never measured, so a learner answering a quiz never meets it. Where the law requires your agreement first, Google Analytics does not load until you accept. You can change your answer at any time with the Cookie settings link at the foot of each page, or block cookies in your browser; the website will still work, but you will need to sign in each visit. We do not use advertising cookies.

11. Access, correction and deletion

You can see and change your account details on your Account page, and delete your account from its Security tab. For anything else — a copy of the personal information we hold about you or your child, a correction, or deletion — ask through the contact page. We will respond within 30 days, and will not charge for a reasonable request. If we refuse a request we will tell you why and how to complain.

12. Complaints

If you believe we have handled personal information in breach of the APPs, contact us through the contact page and we will investigate and respond within 30 days. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13. Changes to this policy

We will post changes here and update the date above. Where a change materially affects how we handle your information we will tell you in the app before it takes effect.

14. Contact

Ebiblo Pty Ltd, Sydney, New South Wales, Australia — through the contact page.