Project STEMulate
Privacy

Your privacy

What this website and STEMulate Academy keep about you, who can see it, how long we keep it, and how to have it removed. Last updated 28 October 2026.

Project STEMulate is run by student volunteers in Singapore, so Singapore's Personal Data Protection Act (PDPA) applies. Questions, or a request to see, correct or delete your details: email proj.stemulate@gmail.com.

Sign-up forms on this website

The volunteer, partner, chapter and newsletter forms on Get involved send what you type (your name, email, and any school, organisation, phone number or message you add, and on the volunteer form what you'd like to help with) to our team. Each one is used only to reply about what you signed up for.

  • Only the Project STEMulate team can see sign-ups, on the STEMulate Academy admin page.
  • Volunteer, partner and chapter sign-ups are deleted once they're 12 months old (we clear them out every day). Newsletter emails stay until you ask us to take you off the list.
  • Under 18? Please check with a parent or guardian before you send a form.

The "Ask us" assistant

The "Ask us" chat is switched off for now, so nothing you type on this website goes to an AI service. Before we switch it on, we'll name here the AI service it uses and what that service keeps. When it's on, it answers questions about Project STEMulate from the facts on this website. We won't store your questions or the answers, and it is told never to ask for personal details, so please don't type any. AI answers can be wrong: email us if anything matters.

STEMulate Academy

STEMulate Academy is the online learning world for the children at our partner centres. When they sign up, children tick a box to say a parent or teacher said they can join.

What it keeps

  • The child's name, username, school level and centre, and a 4-digit PIN (stored scrambled, so nobody can read it).
  • A colour and a subject they pick, to reset a forgotten PIN.
  • Sign-in and Forgot-PIN tries (the username typed, whether it worked, and when) and when the PIN was changed, so nobody can keep guessing a PIN or the colour and subject.
  • Lesson progress, quiz and game scores, XP, Atoms, cards, friends and messages to friends, and exit-card reflections.

Who can see it

  • The child. On the Me page they can see their details and download all of them.
  • Other children see only a username, avatar and level, never a name or centre.
  • Staff and volunteers, with their own accounts, see the children at the centres they look after: name, username, school level, progress, scores and when they were last active. The staff page never shows messages or reflections.
  • Centre staff (not volunteers) can also set a new PIN for a child who forgot theirs. Whoever sets it could sign in as that child, so every PIN reset is recorded. The staff page also lets them save their list of children as a spreadsheet file, and reminds them not to keep it on a shared device.
  • Accounts that follow every centre. The admin team can let a centre-staff account (one of our own coordinators, for example) follow every centre. It then sees every child, including those whose centre isn't on our list, and can reset their PINs.
  • The Project STEMulate admin team can see and fix any account. Each time staff or the admin team open the list of children, look at a child's progress, or change or delete an account, we record which account did it (or that the shared admin passkey was used) and when. Looking again within the hour is recorded once. We keep that record for 12 months.

The "Ask STEMbots" lesson helper

The STEMbots lesson helper is switched off for now, so children's questions aren't sent anywhere. Before we switch it on, we'll name here the AI service it uses and what that service keeps. When it's on, only the question, the lesson's topic and the child's school level go to that service to write a reply, never their name or account.

How long, and deleting it

An account stays until it is deleted. A child can delete their own account from the Me page, and a parent, guardian or centre can ask us to delete it. Deleting an account removes everything tied to it.

Staff and volunteer accounts

For each staff or volunteer account we keep a name, email, role, the centres it follows, a scrambled password and when it last signed in. Sign-in tries (the email typed and whether it worked) are kept for 30 days. An admin can switch off or delete an account at any time.

Where it's kept

  • This website and STEMulate Academy are hosted by Render. Children's accounts, staff accounts and website sign-ups are kept in a Supabase database in Singapore that only our server can reach.
  • This website and STEMulate Academy load their fonts from Google Fonts, which sees your device's IP address. Neither uses advertising or tracking cookies.
  • Lesson videos in STEMulate Academy play from YouTube in its privacy-enhanced mode (youtube-nocookie.com). YouTube sees the device's IP address, and once a video plays it may store data on the device.