Privacy policy

Applies to scribebot.ai and app.scribebot.ai. Last updated 3 September 2026.

This is an interim notice, not yet a lawyer-reviewed policy.

Everything below is an accurate description of what the software actually does today — it was written from the code, not from a template, and it is published now so that teachers and school IT teams can see how their information is handled. A solicitor-reviewed privacy policy will replace this page, and the outstanding items are named plainly in What is not settled yet rather than papered over.

If anything here matters to a decision your school is making, please write to [email protected] and ask.

Who we are

Scribebot is Australian assessment and exam authoring software for NSW secondary school teachers, operated from Sydney, New South Wales. We are bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth) and handle personal information accordingly.

Contact for any privacy question, request or complaint: [email protected].

What we collect

Scribebot has teacher accounts only. There are no student accounts.

Account information

Your name.
Your email address.
Your school's name, and its NSW school code where you pick it from the list.
The subjects you teach, so drafts default sensibly.
A cryptographic hash of your password (scrypt). Your password itself is never stored and cannot be recovered from the hash.
The date your email address was verified.

A signup that is started but never confirmed is held separately and briefly, with the password already hashed, so an abandoned signup leaves nothing in plain text.

Content you create or upload

Your conversations with Scribebot, in full.
The assessment tasks and exam papers it drafts for you.
Documents you upload — past papers, faculty assessment policies, and a school template, which may carry your school's name and crest.

Please do not upload student work, student names or other student personal information. Scribebot does not need it and is not built to hold it.

What we do not collect

No analytics and no tracking. There are no analytics scripts, no advertising, no tracking pixels and no third-party JavaScript anywhere on this site or in the application.
No tracking cookies. The only cookie set is the one that keeps you signed in. It is set by us, marked HttpOnly and Secure, scoped to the application host alone, and it is not readable by this public site.
No payment details. Scribebot does not take payment yet.
No personal information in our access logs beyond the ordinary web-server record of a request.

How we use it

To give you an account and keep you signed in.
To draft the documents you ask for, and to store them so you can come back to them.
To email you a one-time code at signup, and to let you reset your password.
To keep the service running, diagnose faults and prevent abuse.

Your content is not used to train models. We do not use teacher conversations, drafts or uploads to train or fine-tune any model, ours or anyone else's, and we do not sell or rent personal information to anybody.

Who we disclose it to

Two service providers, and nobody else. We do not disclose personal information to advertisers, data brokers or any other third party.

Google: Drafting is performed with Google's Gemini models. The text of your prompt, the conversation it belongs to, and the text and images extracted from any document you upload are sent to Google for processing. This is a disclosure of personal information outside Australia, and it is the only one.
Resend: Your email address is disclosed to our email provider in order to deliver your signup code and password-reset messages.
Our host: The application, the database and your documents run on infrastructure hosted in Australia.

Cross-border disclosure (APP 8). By using Scribebot you acknowledge that material you submit for drafting is disclosed to Google for processing, and may be processed outside Australia. If that is not acceptable for particular material, do not put that material into Scribebot.

How we protect it

All traffic is encrypted in transit with HTTPS, and HTTPS is enforced.
Passwords are stored only as scrypt hashes.
Your documents are stored per account and are only ever served to a signed-in session belonging to that account.
The application is marked so that search engines do not index it, and no teacher document is ever publicly reachable.
Only the people who operate Scribebot can reach the systems that hold your information, and they do so only to run and repair the service.

How long we keep it

We hold teacher documents while they are being used, and not indefinitely.

While you are using Scribebot, we keep your work. We do not expire individual papers or conversations. Teachers reuse an assessment the following year, and deleting your work on a timer would defeat the purpose of the product.
An account nobody signs in to for two years is deleted, along with its papers, conversations and uploads.
We email you 30 days before that happens, and signing in at any point cancels it and resets the clock. We will not delete your documents without telling you first: if we cannot deliver that email, we do not delete the account.
Expired sign-in sessions, unconfirmed signups and unused password-reset codes are cleared automatically within hours.

Accessing, correcting and deleting your information

You can see and change your name, school and subjects in the application's settings.

You can delete your account yourself, at any time. It is in Settings, under "Delete my account". It removes your papers, conversations and uploads, and your name, email address, school and password, immediately and permanently. Nothing is archived and nothing is recoverable — so download anything you want to keep first.

For a copy of everything we hold about you, or a correction, write to [email protected]. We will respond within 30 days.

What is not settled yet

Stating these plainly is more useful to a school than leaving them implied:

Data breach response. We are covered by the Notifiable Data Breaches scheme and would notify affected users and the OAIC as it requires. We do not yet have a written response plan.
This page has not been reviewed by a solicitor. It is accurate, and it is not yet the finished document — see the notice at the top.

Complaints

Write to [email protected] and we will respond within 30 days. If you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

When this interim notice is replaced by the reviewed policy, and for any later material change, we will update the date at the top of this page and email account holders.