Privacy

For children: when you practise here, nobody is watching you but your own grown-up. We never ask for your real name, your birthday, your school or a photo. If you use the BrightWren Maths app, we save your answers so it knows which questions to give you next, and so the grown-up who set it up can see how you are getting on. There is a whole page about this written for you, without the grown-up words.

For grown-ups: there are two things here, and they hold different amounts of data. The free practice on this website needs no account and runs in your browser. The only things it sends without being asked are a count of each page visit, made for us by Vercel, which you can switch off, and a note when a page breaks, and neither says who you are. The BrightWren Maths app does need an account, so it holds your email address, a nickname and school year for each child you add, and every answer they give. We set no advertising cookies, use no third-party trackers, show no ads, and never sell or share any of it. If someone misuses sign-in, we switch on a check by Cloudflare for a while. While it is on, Cloudflare sees your internet address and details of your browser when you ask for a sign-in code, and nothing about your children.

Who we are

BrightWren is made by Not Another Studio Ltd, a small studio in the United Kingdom. We are responsible for the personal data described on this page (the data controller). If you have a question about your data, or want it removed, email privacy@brightwren.co.uk.

What we collect, and why

Practising on this website

The questions are made in your browser. Your device remembers your practice level for each topic, and any mistake reports you have started, so the site works smoothly next time. That information stays in your browser and is never sent to us. There is no sign-up and no account. If a page here breaks, it sends us a note of what broke so we can fix it, as described further down this page. Each page you open is also counted, as described under Visitor numbers.

The BrightWren Maths app

The app at app.brightwren.co.uk is the part that saves progress, so it is the part that holds data. It is meant to be set up by a grown-up, who stays the account holder. Here is everything it keeps.

• Your email address. That is the whole account. There is no password: we email you a code to sign in. We use the address to sign you in and, if something goes wrong, to reach you.
• When you agreed to the terms. The date you created the account, and which version of the terms you agreed to, so there is a record if they ever change.
• A profile for each child. A nickname you choose, a picture they pick from a set, and their school year. We deliberately do not ask for a child's real name, birthday, school, address, photo or email, and there is nowhere to enter them. A child has no account and no login of their own; they practise inside yours.
• The maths they do. Each answer, whether it was right, which kind of question it was, how hard it was, and when. This is what makes the app work: it decides which question comes next, which times-tables facts to practise, and what you see on the progress page. It is genuinely the point of the product rather than something collected on the side. For a SATs mock test, we also keep whether the 30 minutes ran out, and how long the test was off their screen while its clock ran, so a low score comes with its reason.
• Trophies and progress markers. Which badges a child has earned, which parts of the adventure they have finished, and which school years you have opened on the account.
• Which emails you have asked for. Two boxes in Settings, both off unless you tick them: news when we build something new, and a note before each school year. We keep whether each is ticked and the day you ticked it, so there is a record of what you agreed to. Untick either at any time, in the same place.

There is no chat, no messaging, no way for children to see or contact each other, no public profiles, and no advertising anywhere in the app.

Checking that a person is signing in

Anyone can ask the app to email a sign-in code, so a program could ask thousands of times and use up the emails families need to get in. We have a check against that, but it is normally switched off, because it can get in the way on older devices. We switch it on only if someone misuses sign-in, or for a few minutes to test it, and off again afterwards.

While it is on, pressing "Email me a code" or "send a new code" on the app's sign-in page, on a device that is not signed in, brings in Cloudflare to check that a person is asking, not a program. Usually this happens by itself. Now and then it asks you to tick a box. A device that is already signed in is never checked, so the check never runs where children practise.

For the check, Cloudflare sees the address of your internet connection (your IP address), details of your browser and how it connects, and which website is asking, and it runs small tests in your browser to tell a person from a program. We never send Cloudflare your email address, and Cloudflare says the check does not read what you type into the page. Nothing about your children is on the sign-in page.

We keep nothing Cloudflare sends back. If the check fails, the page notes what failed, like any other error described further down this page. That note never holds your name or email address, and it is deleted after 90 days.

If you join an email list

On the Apps and Classroom pages, a grown-up can leave an email address to be told when something launches. If you do, we store that email address, along with which list you joined and basic technical information such as your browser type. We use it only to send you that one update, and nothing else. It is meant for adults, not children, and you can ask us to remove it at any time.

If you report a mistake

The "spot a mistake?" button lets you flag a question or a piece of writing so we can fix it. We store the details of the report: which question or page it was, the answer given and whether it was marked right (if it had been answered), any note you add, and basic technical information such as your browser type. It does not ask for, and we do not want, your name or email here.

Visitor numbers

We count visits to this website so we can see which parts get used, and we use the counts for nothing else. Vercel, a company in the United States that also hosts this website, does the counting for us. It uses no cookies. Each time a page opens, it records when, which page, the page you came from, your country, region and city, whether you are on a phone, tablet or computer, and which operating system and browser you use.

To tell one visitor from another, Vercel makes a code from the request your browser sends as the page opens. Vercel says it does not keep a visitor's session for good but throws it away after 24 hours, and that the counts are not tied to you or to your internet address. We only ever see totals, such as how many visits a page had this week. The basis for counting is our legitimate interest in knowing which parts of the website are useful.

You can stop your visits being counted with the switch below. It is on unless you turn it off. Turning it off works in this browser on this device only, so do it on each one you use. Your choice is saved in this browser, so it is lost, and counting starts again, if this website's data is cleared from your browser. Safari also clears it by itself if you go about a week without using this website.

Why we are allowed to hold it

The law asks us to say on what basis we hold what we hold. For everything the app needs in order to work at all (your account, each child’s profile, and the maths they do), the basis is that you asked us to provide it and it cannot work without them.

The sign-in check, while it is switched on, rests on a different basis: our legitimate interest in keeping sign-in working for every family.

We also count how families get on: how many people who sign up go on to add a child, how many children finish a first go, how many come back, and which school years get practised. The basis for that is our own legitimate interest in seeing which parts of getting started are confusing, so we can fix them. That counting is done by adding up what is already here, and the answers are totals. We do not build a picture of any individual child, we do not score or predict anyone, and nothing about a child is sent to an outside company for it.

Cookies

We use no cookies for advertising or tracking, on the website or in the app. The website uses your browser's local storage to remember your practice level, and whether you have switched off visitor counting; neither ever leaves your device. The app stores a sign-in token in your browser so you stay signed in between visits. That is a necessary part of signing in, not tracking.

When the sign-in check runs, Cloudflare may keep a small note for it in its own part of your browser. Cloudflare says it collects the check's details to spot and block programs, not to identify, profile or target anyone.

Children's privacy

Both the website and the app are built with children's privacy in mind, and the design choices are the protection: the free practice needs no account at all, and in the app a child is a nickname, a picture and a school year. We hold nothing that identifies a child to anyone outside the family, and a child cannot be contacted through anything we make.

The account, and the decision to use the app, belong to the grown-up. If you are a parent or carer and you would rather we held none of it, see below.

Who can see the data, and where it is kept

We do not sell your data, and we do not share it for advertising. Only you, signed in to your own account, can see your family's data in the app: it is locked to your account in the database itself, so one family can never read another's. We can see it too, because we run the service and have to be able to fix it.

It is stored for us by Supabase on servers in the European Union, and the website and app are hosted by Vercel. Sign-in emails are delivered by Resend, an email service in the United States: to send an email they process the address it goes to, and they keep a delivery record for up to 30 days, then delete it. All of these only process the data on our behalf, under contract, and do nothing else with it.

The sign-in check is run by Cloudflare, a company in the United States. While it checks a sign-in, it works on our behalf. Cloudflare also uses what it sees to get better at spotting programs, and for that part Cloudflare is responsible itself (it is the data controller), not us. It explains this in its privacy notice for the check. Questions about the check on our sign-in page come to us. Questions about Cloudflare's own use can go to Cloudflare at dpo@cloudflare.com. Emails you send to hello@brightwren.co.uk or privacy@brightwren.co.uk also pass through Cloudflare on their way to our inbox. Cloudflare's own pages say it keeps a note of who sent each one, its subject and when, for 31 days, and does not store what the email says.

We back up the app's data every day to an encrypted studio computer, so we can restore it if something goes wrong. The backups are stored nowhere else, and each one is deleted after 14 days.

If you tell us something is wrong using the report button in the app, we keep what you wrote along with a reference to your account, so we can come back to you about it. That reference is not your name or your email: it is an internal id, and once your account is deleted it points at nobody. A child reporting a problem with a question sends no reference at all.

When something goes wrong in the app or on this website, the page writes down what broke so we can fix it: the error itself, which page it happened on, basic technical information such as your device and browser type, and when. It never records a name, an answer or anything typed. If it happens on a page for grown-ups in the app, such as Settings or Progress, the record carries the same internal reference to your account that a report does. On a child's page, and anywhere on this website, it carries none.

How long we keep it

We keep your account and your family's progress for as long as you have an account, because progress that vanishes is not progress. We keep an email-list address until you ask us to remove it, or until the launch you signed up for has happened. We keep mistake reports for as long as they are useful for fixing problems. Records of what went wrong, from the app and from this website, are deleted 90 days after they happen. The backups of the app's data are deleted after 14 days. Vercel keeps visitor counts for at least a year, and says it may keep them longer.

Cloudflare's notice for the sign-in check, linked above, does not say how long Cloudflare keeps what it sees.

Deleting a child, or the whole account

You can remove a child from your account at any time in the app, and everything of theirs goes with them: their profile, their answers, their trophies. Our backups still hold it for up to 14 days, and then those are deleted too. If you want the whole account gone, email privacy@brightwren.co.uk from the address you signed up with and we will delete it and everything under it. We will confirm when it is done.

Your rights

You can ask us to show you the personal data we hold about you and your children, correct it, or delete it. You can also ask us to stop using it. Just email privacy@brightwren.co.uk and we will sort it out. If you think we have got it wrong, you can complain to the UK's Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can fix it.

Anything else

If you want to talk to a person about any of this, email hello@brightwren.co.uk.

Changes to this notice

If we change how we handle data, we will update this page. Last updated: 18 September 2026.