Privacy & your child's data

Version 2026-09-19

The short version. We store your child's first name, their year group, and how they did on practice questions. Nothing else. Children have no email address here, and we never ask for a surname, date of birth, address, photograph or school name. We don't show adverts and we don't sell anything to anyone.

Who we are

Brain Gym Lab, contactable at braingymlabs@gmail.com. We are the data controller for the information described here.

What we collect

From the adult who signs up:

Your name and email address
Your password, stored encrypted — we cannot see it
If you subscribe later: payment is handled by Stripe. We never see or store your card details.

For each child:

A first name — please do not enter a surname
Their school year group
A username you choose, and a password
Their answers to practice questions, and the scores that follow

Children are not asked for an email address and cannot receive email from us. There is no chat, no messaging, no way for one user to contact another, and no way for a child to be contacted through the service.

Why, and on what basis

To run the service you asked for — showing questions, marking them, keeping progress. This is necessary to provide the service.
To send a weekly progress email to the adult on the account. You can turn this off at any time from the link in the email.
Practice answers may be sent to an AI provider to mark worded answers and to turn a photographed worksheet into questions. Questions and answers are sent — a child's name is not.

A child's account is created by their parent or guardian, who gives consent on their behalf. Only a parent or guardian can create a child's account.

Who can see a child's data

The parent or guardian on the account
Us, only when needed to fix a fault or answer a support question

We do not sell data, share it with advertisers, or use it to build profiles for marketing.

Who else sees it

We do not sell data and we do not use it for advertising. We use these companies to run the service, and each only receives what it needs to do its job:

Supabase — stores accounts and practice history (EU).
Railway — runs the website itself (EU).
Stripe — handles subscription payments. Card details go straight to Stripe and never reach us.
Resend — sends emails to the adult on the account, such as the weekly summary. Children are never emailed.
Sentry — records technical errors so we can fix them.
Google (Gemini) — marks written answers where a simple right/wrong check is not enough, and helps generate practice questions. It receives the words a child typed as their answer, the question they were answering, and their school year — and nothing that identifies them: no name, no email address and no account number.

Google processes this in the United States, so that answer text leaves the UK. It is covered by the UK-approved transfer terms in our agreement with them. Everything else stays in the UK or EU.

Where it is kept, and for how long

Data is held by our hosting and database providers on servers in the UK or EU.

You can delete it yourself at any time from My Data — this removes the account, any child accounts on it, and all their practice history immediately and permanently. There is no grace period and no backup copy we can restore it from.

We also delete accounts nobody uses. If an account and its children have not been used for two years, we email the adult on the account to say so, and delete it 30 days later unless it is used again. Signing back in at any point cancels that and starts the clock over. We do this because there is no good reason to still hold a child's practice record years after they have stopped using the app — and we never email a child about it, only the adult.

Your rights

You can download everything we hold about you and your children, or delete the account outright, from My Data — both are immediate and need no request. To have something corrected, or for anything else, email braingymlabs@gmail.com and we will respond within one month. If you are unhappy with how we handle it, you can complain to the Information Commissioner's Office at ico.org.uk.

If something goes wrong

If data is lost or exposed, we will tell the ICO within 72 hours where required, and tell you directly if it affects you or your child. Passwords are stored encrypted, so a breach would not expose them.

Changes

If we change this notice in a way that matters, we will tell the adult on the account by email before it takes effect.

‹ Back to sign up