Privacy Policy

Last updated:

Who controls your data

The short version

Using SharpY Mind without an account (default)

When you use the Settings screen without signing in, SharpY Mind saves the following to your browser's localStorage only:

• A name or nickname you choose for your child
• Year group and target school (used only to adjust question difficulty and topics)
• Scores, streaks, badges, gems and topic-by-topic practice history

This data never leaves your device automatically, and is not transmitted to us or to any third party. Clearing your browser's site data, using a different browser or device, or using private/incognito mode will not carry this data across — use the in-app Backup progress button to export a JSON file you control, and Restore backup to bring it back.

Using SharpY Mind with a Family Account (optional)

Our lawful basis for processing: we rely on consent (UK GDPR Article 6(1)(a)) for all data collected through a Family Account. Because this includes children's personal data, that consent is given by the parent or guardian who creates the account, in line with Article 8 (conditions for a child's consent). Only an adult can create a Family Account — child profiles exist solely inside it — and at signup we require an explicit, affirmative confirmation ("I confirm I am this child's parent or legal guardian…") that must be actively checked before the account can be created; the time this is given is recorded against the account. You can withdraw this consent at any time by deleting the account (see "Your control over the data" below) — this stops all further processing and does not affect anything already done under prior consent.

Age assurance: SharpY Mind never asks a child for their date of birth or age. Instead, the whole product — question difficulty, content, design, gamification — is built uniformly for the 8–10 age bracket (school Years 3–5) and applies the same protections to every user rather than trying to estimate an individual child's age. This is a deliberate design choice under the ICO's Children's Code Standard 3: rather than collect more personal data to verify age, we avoid the extra collection and apply child-appropriate protections to everyone by default.

If you create a Family Account, the following is collected and stored by our database provider, Supabase, acting as our data processor:

• Parent: your email address, and a securely hashed password — Supabase's authentication service handles this, and neither we nor Supabase ever store or can see your actual password.
• Each child profile: a name or nickname, year group, target school, and their in-app progress (scores, streaks, badges, topic-by-topic history) — the same fields as the local mode above, just synced to your account instead of one device.
• Each child's PIN: stored only as a one-way cryptographic hash (via PostgreSQL's pgcrypto), never in plaintext, and never readable by the app itself — only a secure database function can check whether an entered PIN is correct. The PIN is a convenience gate for switching between siblings on a shared device, not an independent security credential recognised by the database — access to a child's data is actually controlled by the parent's own login and database access rules (Row Level Security), which restrict every child's data to their own parent's account regardless of PIN.

We do not sell this data, use it for advertising, or share it with anyone beyond Supabase acting purely as our infrastructure provider. Your database is hosted in Supabase's EU North (Stockholm) region — your data therefore stays within the EEA and is not an international transfer under UK GDPR, since the UK recognises the EEA as offering adequate protection. (Supabase Inc., the company, is US-headquartered, but the actual database storage and processing for this project happens in Stockholm, not the US.) Supabase acts as our data processor under its Data Processing Addendum, which is built into their Terms of Service — see Supabase's current sub-processor list for who else may support their infrastructure.

Geolocation: SharpY Mind has no geolocation feature — we never request, collect, or store your or your child's location, in either mode.

Retention: local-mode data lives only in your browser for as long as you keep it there — we have no way to see or delete it ourselves. Family Account data (parent email, child profiles, progress) is kept for as long as the account is active, and is automatically deleted after 24 months of continuous inactivity (no sign-in and no sync from any device). You can request deletion sooner at any time — see "Your rights, and how to use them" below.

The external requests the app makes

SharpY Mind loads its typefaces from Google Fonts (fonts.googleapis.com / fonts.gstatic.com) regardless of which mode you use — this exposes your IP address and browser details to Google under Google's own privacy policy, but includes no information about your child. If you use a Family Account, your browser also communicates directly and securely (HTTPS) with Supabase's servers to sign in and sync data — that connection is inherent to how the account system works, since that's where your account data actually lives.

Cookies & tracking

SharpY Mind does not use analytics, advertising pixels, or third-party tracking scripts. Signing in to a Family Account uses a Supabase session token stored in your browser to keep you logged in — this is functional, not a tracking cookie, and exists only to avoid asking for your password on every visit.

Children's privacy

SharpY Mind is designed for children to use under a parent or guardian's supervision, and every child profile exists only inside a parent's own account — there is no way for a child to create, control, or recover their own account independently. In local (no-account) mode, no personal data is collected, stored, or transmitted by us at all. In Family Account mode, a child's profile data is stored securely and is only ever accessible to the parent who created it. As an extra precaution, we recommend entering a first name or nickname only, rather than a child's full legal name, for any child profile.

Why we built it this way (best-interests summary): we assessed the app's gamification (streaks, badges, gems) against the ICO's Children's Code Standard 1 and designed it to reward completing practice, not to punish stopping or pressure continued use — there are no "streak-loss" penalties, urgency countdowns, or push notifications nagging a child to return. We collect the minimum needed to adapt question difficulty (year group, target school) and show progress (scores, topic history); we do not collect location, contacts, device identifiers for advertising, or any data unrelated to tutoring. This assessment, together with our record of processing activities and lawful-basis analysis, forms our Data Protection Impact Assessment for the Family Account feature, and is reviewed whenever the account system's data collection changes.

Data protection by design (the "higher protection matters" for children): these weren't afterthoughts bolted onto the privacy notice — they were design-stage decisions: recommending a nickname instead of a full legal name, storing PINs as one-way hashes nobody (including us) can reverse, using database-level Row Level Security so one parent's account can never see another family's children, and defaulting every user to the free local-only mode with no server involved at all unless they deliberately opt in to a Family Account.

Your rights, and how to use them

As the parent/guardian, you have the following rights over your and your child's personal data under UK GDPR Articles 15–21. Contact us (below) to exercise any of them — we'll respond within one month:

• Access: request a copy of everything we (and Supabase, on our behalf) hold about your account and children.
• Rectification: ask us to correct any data that's inaccurate or incomplete — or just edit it yourself in the parent dashboard, where possible.
• Erasure ("right to be forgotten"): delete a single child's profile yourself from the parent dashboard, or contact us to delete your whole account.
• Restriction: ask us to pause processing your data (e.g. while a correction or complaint is being looked into) without deleting it outright.
• Portability: receive your data in a portable format — for local-mode data, use the in-app Backup progress JSON export directly; for Family Account data, we'll provide the same on request.
• Object: object to any processing you don't think is justified; since we only process on the basis of your consent (see above), you can equally just withdraw that consent.
• Withdraw consent: delete your account at any time (see below) — this stops all further processing and doesn't affect anything already done under prior consent.
• Complain: if you're unhappy with how we've handled your data, tell us first so we can fix it — but you always have the right to complain directly to the UK's data protection regulator, the Information Commissioner's Office (ICO), at any time.

Our complaints process: email us (below) with "Privacy complaint" in the subject line. We'll acknowledge your complaint within 30 days and respond substantively without undue delay after that. If you're not satisfied with our response, you can still escalate to the ICO at any time using the link above.

Practical tools for the above:

• Backup/Restore (local mode): download or reload a full copy of your progress as a JSON file at any time.
• Delete a child profile (Family Account): the parent dashboard lets you permanently delete any child's profile and all associated progress, after re-confirming your password.
• Reset everything locally: use "reset all progress" in the app, or clear this site's data via your browser settings.

These same rights and the ICO complaints link are also shown directly inside the Family Dashboard, not just here.

A note on gamification and privacy nudges

Streaks, gems and badges in SharpY Mind exist to encourage finishing practice sessions. None of them are used to nudge you or your child into sharing more data, weakening privacy settings, or upgrading to a paid or higher-data-collecting tier — engagement rewards and privacy choices are kept completely separate by design.

Changes to this policy

If SharpY Mind introduces payments, additional data collection, or any other feature that changes what's collected or how, this policy will be rewritten to reflect that clearly before the change goes live.

Contact

Questions about this policy, to exercise any of the rights above, or to request deletion of your account data: urchandru@gmail.com.