Last updated 6 November 2026 (adult logins and cheers added). Golden Boot is a private family app, not a public service.
What we collect
We keep only what the app needs: each adult's email address and password (stored by our sign-in provider and hashed, never in plain text), each child's first name, school year, challenge setting, kit colour, optional PIN (hashed), chosen favourite players, activity scores (words per minute, MAZE, sentence and maths results), the daily reading passage, and rewards the parent sets up and approves, and cheers sent by parents or the teacher. A parent may add a child's date of birth: it is optional and used only to show the child's age next to their school year. We do not collect school names, photos, locations or contact details for children.
Who can see a child's progress
Each adult has their own login. Children can have their own login too: a username and secret word that a parent sets up, with no email address. A child can only see his own progress, cheers and rewards, plus his brother's points for the family league. Parents in the family can see and manage everything. A parent can invite a teacher, who can only see the children that parent chooses: their progress and cheers. A teacher can't change settings, rewards or scores. Parents can remove any adult's access at any time in the parent area. Cheers (short encouraging messages from parents or the teacher) are stored with the child's profile and are visible to the parents. Invite codes work once and expire after 7 days.
Voice
The read-aloud uses the iPad's built-in speech recognition to count words. We never record or store audio. Only the final word count is saved. On Apple devices, speech recognition may be processed by Apple under Apple's own privacy policy. Microphone access can be turned off in iPad Settings, and the app still works by tapping the last word read.
How it's used and shared
Data is used only to run the app and show progress to the parent. It is not sold, used for advertising or shared for marketing. The app has no ads and no third-party tracking. To write the daily news passage, the favourite player names (never a child's name or scores) are sent to Anthropic's Claude API, which searches public sports news. Data is stored with Supabase in Sydney, Australia, and the app is hosted on Vercel.
Security
Every database row is tied to the parent's account and protected by row-level security, so one family can never see another's data. Connections are encrypted (HTTPS). PINs and passwords are hashed. Secrets are kept on the server only.
Your choices
A parent can view, correct or delete any child's data, or close the account, by contacting the account owner. Deleting the account removes all linked children, scores and passages. Questions or complaints can be sent to the family account owner; if not resolved, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
This policy follows the Australian Privacy Principles, including collecting the minimum data needed (APP 3) and taking reasonable steps to keep it secure (APP 11).