What We Record About Your Child — All Of It

Most apps make you dig through a privacy policy to guess what they collect about your child. We'd rather just show you. This page is the complete list — if it's not here, we don't collect it.

Who your child is, to us

A first name or nickname for each player, chosen by you or your child, is saved on the device first. Family backup also saves it on our servers. If a learner joins a class, their teacher sees the display name held for that profile alongside their classroom rounds. The profile also has an age band or school year (with the country whose school years you picked, so years are labelled correctly), a cartoon avatar, the settings you choose for them (such as sound, timers and calm mode), and a play code (a random credential like a library card number). That's the whole identity. No surname, no birthday, no email, no photos, no location, no school name.

For Play Code sign-in security, our server also keeps hashes of codes, trusted-device tokens and browser information, sign-in times and revocation state. Anti-guessing records use hashes derived from the network address and browser information, failure counts and lock times. They do not store raw network addresses or browser information. Anti-guessing hashes are removed by a scheduled clean-up after 30 days without activity. These are sign-in records, separate from the anonymous counts below.

Practice stays on the device unless you turn on family backup. Classroom rounds are an exception: when your child joins a class with a teacher's code, that teacher sees those rounds even with family backup off.

What we record while they play

Practice data — the product doing its job:

• Which questions were asked and answered, right or wrong, and how quickly
• Rounds and sessions played, when, and in which mode
• Streaks, badges, and rewards earned
• Starting check, Day 7 and Day 21 check-in results
• How an answer was given, including the input mode, retries, choices or help, event and round references, and the learning-rule version
• For spoken answers, how sure the speech recogniser was (never the audio)
• A "start over" marker, if a grown-up starts them over
• Which facts our practice engine plans to serve next, and why

This is what powers progress reports, the 21-day Sprint check-ins, and the coaching for grown-ups. It's also how you can judge whether the Sprint is working: we show you the same numbers we see.

No tracking events. We don't record improvement signals, practice milestones or any other analytics events about your child's play, and nothing from a child's screen goes to an analytics company. Improvement signals and practice milestones recorded before 9 October 2026: collection has stopped. Earlier events were sent to PostHog; our database cleanup does not remove them. Changing Cookie settings does not delete events already sent. You can ask us to request deletion from PostHog through the Tell us form.

Anonymous daily starting-check counts

When a starting check begins after its warm-up, we add one to that day's started-check total. When it is finished, we add one to that day's finished-check total. These requests carry only the event type, a random key for that single delivery and its retries, and the New Zealand calendar day on which the event happened. They carry no cookies or referrer, no visitor or device ID, and no name, profile, answers or other information about your child. We count events, so a repeated check can add another count. Children's screens retry failed deliveries in memory only and do not save these counts to browser storage. A count can be lost if the page closes before delivery succeeds.

To avoid counting a retried delivery twice, we temporarily keep a hash of its random delivery key with the event type and an expiry time. The receipt expires after eight days and is removed by scheduled cleanup. It is not a visitor identifier and is not linked to an account, profile or practice record. The network address is used in memory for rate limiting only and is not stored with the count.

Only marketing and grown-up pages can save pending anonymous counts for later delivery, and only when you have allowed adult-page analytics. Children's pages retry in memory and never read, write or restore that saved queue.

The queue restriction applies to routine child counting. If a grown-up explicitly opens Cookie settings on a learner page, choosing Essential only can clear pending adult counts saved by an earlier grown-up visit.

Practice voice totals. We also count how often practice voice heard an answer or asked to say it again, as daily totals, with nothing that identifies anyone. These requests carry only the round's totals of answers heard, requests to say it again, and answers accepted using the expected-answer confidence check. They carry no cookies or referrer, identifiers, audio or answers. A failed delivery is dropped.

Crash reports:

• Crash reports contain only the type of error, where in our code it happened and which kind of page, never names, answers or anything you typed. An allowlisted technical error code if available, app version and time are also included. The report goes to our own database, never to an analytics company, and is removed by a scheduled clean-up after 90 days.

Dashy Helper:

• If your child is struggling in a practice round, Dashy may show a tip from our own reviewed list. The app works this out on the device from the round's answers. Nothing about it leaves the device, no AI is involved, and you can turn it off for each child in Grown-ups.

A finished guest starting check is kept on the device that took it for use in Sprint set-up for 14 days. It includes the questions, answers, timings and chosen school year. It expires after 14 days and is removed when the app next checks for kept starting checks. A grown-up can attach it to a learner; only then does it enter that learner's practice record and, with family backup consent, get uploaded.

What we never do on children's screens

• No advertising. Ever. No ads, no ad trackers, no retargeting.
• For analytics, nothing is sent from children's screens except the anonymous counts described above. Children's screens never talk to analytics companies.
• No session recording or screen capture. Nobody watches recordings of your child playing.
• No audio recording. If your child answers out loud, their speech is recognised on the device itself. Audio is never recorded, stored or sent to us or anyone else. Only their answer is kept, along with the fact that it was spoken, just as a typed answer is kept.
• No selling data or sharing it for advertising. The service providers and optional classroom and Coach uses are described here and in the Privacy Policy.
• Practice has no chat or free-text answers. A player can choose a first name or nickname for their profile.
• No behavioural profiling beyond learning progress — we model times tables, not children.

The AI Coach — only if you turn it on

AI Coach is its own choice, separate from family backup, and it needs family backup on because it reads the backed-up practice. If you enable the AI Coach, your child's practice summary is sent from our servers to our configured AI provider to write reports for you. Their name, school year and country are not sent. It happens only after your explicit consent, and the outputs are checked against child-safety rules before anyone sees them. We have turned off sharing of API data with OpenAI for training. OpenAI is our default provider. Its Standard retention keeps API data for up to 30 days for abuse monitoring, with legal exceptions. The retention limits and configured alternatives are described in sections 4 and 6 of the Privacy Policy. If you ask the grown-ups' help chat about your child's maths, it uses the same kind of practice summary, also without their name.

Private confidence ratings and sharing a result

If a grown-up submits the Day 7 or Day 21 reflection, we keep their before-and-now confidence ratings with the learner's result, even if they choose not to share a card. These ratings are private and are not published.

After the Day 21 check-in you can choose to share one anonymous card: how much your child's accuracy went up, their year level. No town, name, photo or quote. You can stop sharing at any time in Grown-ups → Shared results, and we take the card down.

Your controls

Delete a child (Grown-ups → Manage profiles) or your whole account (Grown-ups → Settings), export this device's data, or ask us anything through the Tell us form. Removal starts from this device and our active database. We aim to finish associated personal-data deletion within 30 days; unfinished database work is retried by scheduled cleanup and a failed sign-in deletion may need operator action. Purchase, payment, refund and Coach credit records are kept for tax and refunds. Whole-account deletion also removes linked non-financial customer information, outreach, household notes and contacts. Financial records keep only amounts, currency, dates, status and transaction/account references, including Stripe IDs, needed for tax, refunds and credit reconciliation. Names, emails, typed messages and non-financial notes are removed. Unlinked support messages and help-chat feedback are removed by a scheduled clean-up after 24 months. A copy on another device stays there until you delete it on that device too; its Play Code can no longer sign in. An account that runs classes is deleted by hand on request through the Tell us form. Turning family backup or AI Coach off stops new uploads or new reports, but doesn't delete what's already saved. Deletion has the limits described in section 8 of the Privacy Policy, including provider logs, backups and inbox copies. Scheduled cleanup works in batches, so a backlog can take later runs to finish. Enforcement starts with the next daily run after the owner dashboard check on 14 October 2026; the latest run before release 25 was a dry run, not evidence of completed deletions.

This page is kept in sync with our code. When we add or change anything we record about children, this page changes in the same release.