Privacy Policy

Summary

• Free practice needs no account. We don't ask for a name or an email address to use it. See section 1.
• Some pages show ads, such as choosing what to practise, results and worked solutions, and our guides. The page where your child answers questions has none, and subscribers' student and parent pages have none. See section 4.
• Google's advertising runs on some of our pages and sets cookies. Cookies are on unless you choose “Essential only”. See section 5.
• To stop free practice being misused, we keep internet addresses and device numbers for 30 days, apart from everything else. We also use them to understand how free practice is used overall. See sections 1 and 2.
• We keep anonymous statistics on how questions are answered, with an approximate location. We may use them commercially, only in a form that doesn't identify anyone. See section 2.
• Account and practice data is stored in Australia, in Sydney. See section 8.
• Parents create and control every student profile, and we never ask a child for an email address. See section 3.
• We don't sell personal information. See section 2.
• You can see, correct, export or delete your family's data by emailing us. See section 11.

1. Information we collect

• Parent account — your email address, your name, and a password (stored only as a cryptographic hash).
• Student profiles — a first name or username, year level, and for Years 11–12 a state and course selection. Student profiles are created by you, under your account. We do not collect a student's date of birth, school, photo, or email address.
• Practice in an account — the questions served and the answers given, with marks and time taken. We also keep the progress worked out from these, such as a working-level estimate.
• Free practice — we don't ask for an account, a name or an email address. While a free paper is open, we keep its questions, the answers given and the time spent, so we can mark it and show the results. We delete these 48 hours after the paper is submitted, or 24 hours after it was started if it never is.
• Free practice statistics — for each question answered, we record the question, whether it was correct and how long it took. We also record the date, the year level and the kind of practice. Each handed-in paper gets a new random number in these statistics, and that number is not kept anywhere else.
• Approximate location — with free practice statistics, we keep the country worked out from the internet address at the time. For visitors in Australia, we also keep the state, city and postcode. We don't keep the internet address with them.
• Records against misuse — the internet address (IP address) and a random device number that our site keeps in your browser. With them we keep a session number, the time and how many questions were served. These are kept apart from everything else and deleted after 30 days.
• Billing — card payments are processed by our payment provider (Stripe). We receive subscription status and receipts. We never see or store your full card number.
• Offer codes — if you use one of our offer codes, we keep it with your account and your subscription.
• Correspondence — the contents of emails you send us.
• Advertising — Google collects information through its advertising code and cookies on our pages. This includes your device and browser, the pages you visit, and your internet address. See sections 4 and 5.
• Technical records — standard security and access logs (such as IP address and timestamps) kept to protect accounts and diagnose faults.

2. How we use your information

• Running the service: assembling papers, marking, and showing progress to you and your child.
• Operating your account: sign-in, email confirmation and password resets, plus receipts and service notices.
• Support: answering the questions you send us.
• Preventing misuse: the records against misuse are used to apply the daily limit on free practice, and to detect and stop automated copying of our questions. When a device or a network goes well past a normal day's practice, we ask for a quick check that a person is there (see section 7).
• Improving the service: we also use the records against misuse to understand how free practice is used overall.
• Showing ads: see section 4.
• Measuring our advertising: when we run ads, the link you arrive on carries a click identifier from the platform that showed the ad. We keep it in a cookie of our own (section 5). If you then create an account, we keep it with your account so that we can report the sign-up to that platform. We send only the identifier, the name of the action and the time. We never send your name, your email address or your child's answers.
• Offers: applying an offer code you use, and counting how many families each code brings, so we can tell which of our posts and ads are working.
• Product news and offers: occasional emails to parents about new features and our offers. They're on by default, and you can turn them off at any time in your notification settings or with the unsubscribe link in each one.
• Statistics: we use practice statistics to improve the question bank. We may also use them commercially, for example in reports, and share them with others. We only do this in aggregate form that doesn't identify anyone, and we don't report areas with too few answers separately.

We do not sell or rent personal information, and we do not share it with other companies for their own marketing.

3. Children's and students' information

Meritly is used by children, so we hold ourselves to a narrower standard for student data.

• Student profiles are created and controlled by a parent or guardian. The information in them is provided by the parent, not collected from the child. Students sign in with a family code and username — never an email address.
• Free practice needs no account, and we never ask a child for a name or an email address.
• Free practice is designed to be set up by a parent. You choose what to practise and hand the device to your child. When they finish, a page asks them to hand it back to you before the results appear.
• The page where your child answers questions shows no ads. Subscribers' student pages show no ads either.
• We do not send marketing to students.

4. Advertising

We show ads from Google on some of our pages. These include choosing what to practise, the results and worked solutions from free practice, and our guides and exam pages. There are no ads on the page where your child answers questions, and none on subscribers' student and parent pages.

Google, and ad companies that work with Google, use cookies to show ads based on your earlier visits to this website and to other websites. You can turn off personalised ads from Google in its Ads Settings (google.com/settings/ads). You can turn them off for many other ad companies at aboutads.info. If you choose “Essential only” on our banner, we ask Google to show you ads that are not personalised (section 5).

5. Cookies and your choice

Cookies are on by default. Our banner has two buttons, “Accept all” and “Essential only”, and you can change your choice at any time on this page. On 28 September 2026, we reset every visitor's choice to “Accept all”. If you had chosen “Essential only” before, you can choose it again at any time.

• Essential cookies keep you signed in, remember your cookie choice, and hold the device number that goes into our records against misuse (sections 1 and 2). They are set whatever you choose. The device number cookie lasts up to 400 days, but our records of it are deleted after 30 days.
• With “Accept all”, if you came from one of our ads, we also set a cookie of our own that holds the click identifier from the link you arrived on. If you then create an account, we keep that identifier with your account until we have reported the sign-up. We delete it about three months after the click at the latest.
• With “Accept all”, Google's advertising code sets its own cookies as well.
• With “Essential only”, we don't set the click cookie. Google shows ads that are not personalised. It still uses cookies for those ads, but only to limit how often you see the same ad and to count ads in aggregate.
• Your browser also keeps the family code on a device where a student has signed in, so they don't have to type it again.
• For the length of a visit, your browser keeps two notes of ours, whatever you choose. They record whether a signed-in family has a subscription, and whether our ad check has run. We use them only to decide whether to show ad spaces. They are cleared when you close the tab.

6. Website statistics

We count visits to our pages so that we can see which pages people find useful. Some of that counting needs no cookies and happens whatever you choose. For our own visit counts, we keep only the visit itself: which page was viewed, the approximate location it came from, and the type of device. Our own counting doesn't follow you across other websites or build a profile of anyone. Google's advertising code (section 7) also records the pages you visit, under Google's own privacy policy.

7. How we share information

We do not sell or rent your information. Like almost every online service, we use a small number of specialist providers to run Meritly. We describe them by the kind of service they provide, and whether your information leaves Australia.

• Database, authentication and storage of account data, practice data, practice statistics and records against misuse — in Australia (Sydney).
• Website hosting and content delivery, including our own visit counts and the first line of protection against automated copying — outside Australia.
• Payments — handled by our payment provider (Stripe) on its own infrastructure, which operates globally. We name it because it takes your card details directly. We do not see or store them.
• Service email (confirmations, password resets, receipts) — routing may pass outside Australia.
• Our support mailbox, for emails you send us — outside Australia.
• Advertising — Google, outside Australia, mainly in the United States. We name it because its own code runs on our pages.
• Advertising measurement, when we run ads — the platform that showed the ad, outside Australia, mainly in the United States. All that leaves us is the click identifier, the name of the action and the time it happened.
• The quick check that a person is there (section 2) — Cloudflare, outside Australia. Its code loads only when that check is needed.

We may also disclose information where the law requires it, or to protect the safety of a person or the security of the service.

8. Overseas handling of information

Account and practice data, practice statistics and records against misuse are stored in Australia, in Sydney. The services listed in section 7 as operating outside Australia receive what their function needs. Google's advertising service and Cloudflare receive what their own code and cookies collect on our pages.

9. Data security

Data is encrypted in transit. Database access is controlled row by row, so an account can only ever read its own family's records. Answers to questions are never sent to a student's browser before they submit, and administrative access is limited and logged. No system is perfectly secure. If a data breach is likely to result in serious harm, we will notify affected families promptly and without undue delay. Where required, we will also notify the Office of the Australian Information Commissioner.

10. How long we keep it

Account information is kept for as long as your account is active. If you delete a student profile, their records and work are removed from the live service. If you close your account, we remove your family's personal information from the live service, and it ages out of our rolling backups within about 30 days. Records against misuse are deleted after 30 days. An open free paper is deleted 48 hours after it is submitted, or 24 hours after it was started if it never is. Practice statistics don't identify anyone, and we keep them for as long as they're useful. We may keep records we are legally required to keep (such as transaction records for tax law) for the required period.

11. Your rights and choices

Email hello@meritly.com.au from your account address to access, correct, export or delete your family's information. We respond within 30 days, usually much faster. You can change your cookie choice at any time in section 5. If you believe we have mishandled personal information, please tell us first so we can put it right. You can also complain to the Office of the Australian Information Commissioner (oaic.gov.au).

12. Changes to this policy

A change matters if it involves a new kind of information, use, recipient or country. When we make one, we post the updated policy on this page with the date it takes effect. We also show a notice on the parent sign-in page and in your account. A change can take effect on the day it is posted. The date at the top always tells you when it last changed.

13. Contact us

Privacy questions, requests and complaints: hello@meritly.com.au. Meritly is a product of SUPEREZ PTY LTD (ABN 17 663 697 318), Australia.