Privacy notice

This notice covers the optional Catalyst account. The app shows a short version before you make one. It is also Catalyst's privacy policy.

Catalyst is a phone app for learning VCE organic chemistry, made in Australia. You can reach Catalyst at [email protected]. [Decide: the business name or ABN that runs Catalyst; the Privacy Act expects this notice to name it]

Accounts are optional

You don't need an account to use Catalyst. Accounts are for people 16 and over.

The app asks for your date of birth and keeps it on your phone. If you're under 16, you keep the whole app but can't make an account. If you're 16 or over and want an account, you confirm your age and accept the terms first. [Decide: publish the terms on this site and link them here]

[Decide: whether to say that a wrong date of birth is fixed only by emailing Catalyst, and that a parent or teacher can ask for an account held by someone under 16 to be closed (docs/research/minimum-age.md, recommendation 3)]

What stays on your phone

These never go to the server, with or without an account:

• your date of birth (the server stores only that you confirmed you are 16 or over, and when);
• your lessons and learning progress;
• your drawings.

[Decide: add Catalyst Plus purchases and any ads here once they are live]

What the server stores

Catalyst's server is Supabase, a hosted database, in its Sydney region (ap-southeast-2). If you make an account, it stores:

• your email address, and the link to Google, Facebook or Apple if you sign in with one of them;
• your display name;
• Kat's outfit, pose and title (Kat is the cat in the app);
• a backup of your wardrobe records: the items you bought with atoms (the points you earn in the app), the mystery samples you opened, the milestones you reached, and your Molecule of the day rounds with their times;
• the time you confirmed you are 16 or over, and the version of the terms you accepted;
• when your account and profile were created and last updated.

[Decide: Supabase Auth may also keep the name and picture link that Google, Facebook or Apple sends. Check and list them here if so.]

Supabase also keeps sign-in records for security. These can include your IP address. [Decide: how long Supabase keeps sign-in records]

The database lets each account read and change only its own records. Catalyst keeps your records until you delete your account.

When you delete your account

Deleting your account removes it, and everything saved to it, straight away. Catalyst then keeps a short record of the deleted account for 30 days and deletes it automatically after that. The record holds:

• the account's ID and email address;
• when the account was made and when it was deleted;
• the version of the terms you accepted.

[Decide: why the record is kept, for example to answer questions or reports about an account after it's gone]

How it's collected

To sign in with email, you type your email address and Catalyst emails you a six-digit code. If you sign in with Google, Facebook or Apple instead, that company shares your name and email address with Catalyst's sign-in service. Its own privacy policy covers what it does with them.

After you sign in, the app sends your profile and wardrobe records to the server, and sends them again when they change.

No law requires you to give this information. If you don't, you can't make an account, and the app keeps working without one.

Why

Catalyst uses your information to sign you in, and to keep your profile and wardrobe when you change or reset your phone.

Other learners can't see your profile. Catalyst has no friends, leaderboards or public profiles yet. Catalyst doesn't use your information for advertising and doesn't sell it.

Who receives it

• Supabase hosts the database and the sign-in service in Sydney, so your account and profile are stored in Australia.
• Resend, a company based in the United States, sends the email with your sign-in code from its servers in Tokyo, Japan. Your email address and the code email go to Resend, so they leave Australia.
• Google, Meta (which runs Facebook) or Apple handles your sign-in if you choose one of them. Their systems may be outside Australia. [Decide: name the countries for Google, Meta and Apple]
• The people who run Catalyst can see the data in the Supabase dashboard.

So your information can go to Japan and the United States (Resend), and to wherever Google, Meta or Apple handle sign-in if you use them.

Seeing and correcting your information

You can change your display name in the app, on Profile. To see or correct anything else the server holds, email [email protected].

Deleting your account

You can delete your account in the app at any time. Delete your account explains how, and how to do it without the app.

Complaints

If you think Catalyst has mishandled your information, email [email protected] first. If the reply doesn't settle it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.