Privacy policy

1. Who we are

Crayonbird (crayonbird.com) is run by Crayonbird, based in Nigeria. We decide how and why personal information is used in Crayonbird, which makes us responsible for it: the “controller” (called the “operator” in US law and the “data fiduciary” in Indian law).

Run by

Crayonbird

Postal address

available on request by email

Country

Nigeria

Privacy questions

[email protected]

Other questions

[email protected]

When a school uses Crayonbird through its teachers, the school also has responsibilities for its pupils’ information. See Teachers, classes and schools.

2. Who this policy is about

Different people use Crayonbird, and we collect different things from each:

• Parents and carers, who create a family account and add their children.
• Children, who learn through a profile their parent created. Children under 13 cannot have their own account.
• Teens aged 13 to 18, who may create their own Brainteen account.
• Teachers and tutors, who create classes for their students.
• Class students, who sign in with a class code, their first name and a PIN given by their teacher.
• Visitors, who use the library without signing in.

3. What we collect

We ask only for what the service needs. Here is everything, by type of user.

What we never ask for: a child’s surname, photo, voice, home address, school, phone number or precise location. We don’t use the camera or microphone, and we don’t collect contacts. Drawings, writing and flashcards are free-form, so please help children leave out personal details such as their full name or address.

4. Why we use it, and our legal reasons

We use information only for the purposes below. The last column gives the legal basis under the GDPR and similar laws.

We never use anyone’s information for advertising, we never build marketing profiles, we never make automated decisions that have legal or similarly important effects on you, and we never use children’s information or anyone’s work to train AI models.

5. Children’s privacy

Crayonbird is made for children. We follow the US Children’s Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code, and the rules for children in the GDPR and other laws. In short:

• A parent is in charge. Children under 13 can use Crayonbird only through a profile a parent creates, or through a class login made by their teacher. When a parent signs up, they confirm they are the child’s parent or legal guardian and consent to the use of their children’s information described here. We keep a record of that consent.
• Only what’s needed. We collect from children only what they need to learn and to save their work, and we never make taking part depend on giving more.
• Nothing public. Children have no public profile and cannot chat, send messages, post publicly or make their information public. Teens can choose to join private leaderboards, where members see only a nickname the teen chooses.
• No ads, no selling, no profiling. We don’t show ads, sell or rent information, or share it for advertising. We don’t profile children, and we don’t use tricks to keep them online longer. Rewards are earned by learning, never bought.
• Private by default. The most private settings apply from the start. Leaderboards and sharing progress with a parent stay off until a teen turns them on.
• Identifiers only to run the site. The sign-in cookie identifies a session only so we can keep someone signed in, keep their progress and protect the service. It is never used to contact a child, to build a profile or for ads.
• No disclosure to third parties. We don’t disclose children’s information to third parties, except to the service providers listed below, who help us run Crayonbird and may use it only for that, or when the law requires.

Parents can review their child’s information, have it deleted and refuse further collection at any time: see Parents’ rights. Children can read our privacy page for kids.

6. Teens

Teens aged 13 to 18 can create their own Brainteen account. We ask for a birth month and year only to check the minimum age, and we keep just the year. If the law where you live requires a parent’s permission at your age, please ask a parent or carer to create a family account and add you as a Brainteen learner instead.

• You decide about sharing. A parent can follow your progress only if you create a link code and approve their request. You can stop sharing at any time.
• Classes. If you join a class with its code, that teacher can see your progress on the class work. You can leave the class at any time.
• Leaderboards are optional. Private leagues and class boards show only the nickname you choose, and only to their members.
• Your rights are yours. You can download or delete your data yourself from your privacy page.

7. Teachers, classes and schools

Teachers create classes and add students by first name or nickname; each student gets a 4-digit PIN. Please use first names or nicknames only, never full names or other details.

If you use Crayonbird for a school, you confirm that your school allows it and that the school has informed parents, or obtained their consent, where the law requires. The school then decides how its pupils’ information is used, and we use class information only to provide this educational service to the school, never for any other purpose. Schools that need a data processing agreement can write to [email protected].

Parents of class students can ask the teacher or school to see, correct or delete their child’s information, or write to us and we will work with the teacher.

Teachers who share sheets in the community library choose a public name, which appears with their sheets and on a public author page. Never put a pupil’s name or work in a shared sheet.

8. Cookies and storage on your device

We use only cookies the site needs: one keeps you signed in, one tells our pages that you are signed in, one remembers the language you chose, and one (rarely) stops a too-young visitor from retrying the teen sign-up for a day. We use no advertising, social-media or tracking cookies, so you won’t see a cookie banner. Some features remember things in your browser (such as an unfinished drawing), and the installable app keeps copies of pages for offline use. Full details are on our cookies and storage page.

We count visits without cookies. Each day, the IP address and browser type are scrambled together with a secret that changes daily, so we can count a visitor once that day without knowing who they are. These codes are deleted after two days; we keep only totals, such as page views per country.

9. Who we share information with

We never sell, rent or trade personal information, and we never share it for advertising. A small number of service providers process data for us, under contracts that let them use it only to provide their service to us:

We use no other providers for personal information: no analytics companies, ad networks or social-media plug-ins. Our AI tools (the quiz maker, lesson plans, flashcards and making practice from a document) may send the generation request to an AI provider we have chosen, such as Anthropic or OpenAI, so the result is ready in seconds. The request contains only the topic, the options chosen, any notes and, for documents, an extract of the text. We remove e-mail addresses and phone numbers from it first, and we never send names, e-mail addresses, account or child details or IP addresses. Under their business terms, these requests are not used to train their models. When no provider is switched on, the AI model runs on our own server.

We also share some public information that contains nothing personal: we tell search engines about new public library pages (through IndexNow), and our own social-media accounts automatically post about new public library pages.

We may disclose information if the law requires it, to protect the safety of a child or anyone else, or to protect our rights. If Crayonbird is ever transferred to another organisation, it must keep the promises in this policy, and we will tell you before that happens.

Videos. Some lessons include a short video. Videos we host ourselves play from our own server. Other videos come from YouTube, but our pages load nothing from YouTube until you press play: before that you see only our own copy of the picture and the title. When you press play, we load YouTube’s player in its privacy-enhanced mode (youtube-nocookie.com). From then on, YouTube receives what any video player needs, such as your IP address and browser type, and it may store information in your browser under Google’s privacy policy. We never tell YouTube who you are. Child profiles and class students see only videos we have marked as made for children or checked ourselves.

10. International transfers

Crayonbird is run from Nigeria, and our servers are in the data centre of our hosting provider. Cloudflare and our email and backup providers may process data in other countries. So your information may be handled outside the country where you live, including in countries whose laws protect data differently.

Where the law requires, we protect these transfers with recognised safeguards, such as the European Commission’s standard contractual clauses, the UK international data transfer addendum and the transfer rules of the Nigeria Data Protection Act. Where a law requires your separate consent before your data leaves your country, we ask for it. You can ask us about these safeguards at [email protected].

11. How long we keep information

We keep information only as long as we need it, then delete it. These are our deletion periods:

12. How we protect information

• All connections are encrypted (HTTPS).
• Passwords are stored only as strong one-way hashes. Children have no passwords, and class PINs lock after several wrong tries.
• The sign-in cookie can’t be read by scripts, and sessions end automatically.
• IP addresses are stored only as salted hashes (the one exception is the payment-dispute record of paying account holders), and repeated attempts are limited.
• Children’s drawings and written pages are private files that only their owners can open.
• Secret keys are stored encrypted, and backups are encrypted before they leave our server.
• Our pages load no scripts from other companies (except Paddle’s payment window, when you choose to pay), and a strict security policy blocks others.
• Only the site owner can use the admin area, and privacy-related actions are logged.

No system is perfectly secure. If a data breach is likely to put you at risk, we will tell you and the authorities without undue delay, as the law requires.

13. Your rights and how to use them

Wherever you live, you can:

• see the information we hold about you (and your children or class), and get a copy you can take elsewhere;
• correct it;
• delete it;
• object to some uses, or ask us to limit them;
• withdraw consent at any time (for example by switching off weekly emails), without affecting what happened before;
• complain to a data protection authority.

The quickest way: your privacy page lets you download all your data as a ZIP file, delete a child profile, a class or your whole account, and change your email choices. You can view and edit your children’s profiles in the parent dashboard. You can also write to [email protected]. We answer within one month (sooner where the law says so), free of charge. We may need to check that a request really comes from you, and we ask only for what we need to do that.

Depending on where you live, you also have these rights:

• UK, EU and EEA (GDPR): data portability, and not to be subject to decisions based only on automated processing. We don’t make such decisions.
• United States: parents have the COPPA rights in Parents’ rights. California residents can ask to know, delete and correct their information. We don’t sell or “share” personal information for cross-context behavioural advertising, and we don’t use sensitive information to infer characteristics. Using your rights will never mean worse service, and you can act through an authorised agent.
• Nigeria (NDPA): to ask us to stop processing in certain cases, to have your data transferred, and to complain to the Nigeria Data Protection Commission.
• India (DPDP Act): to get a summary of your data and of who received it, to correct, complete or erase it, to nominate someone to act for you, and to use our grievance contact, [email protected], before going to the Data Protection Board.
• Brazil (LGPD): to confirm that we process your data, to have unnecessary data anonymised or deleted, to know who we share it with, and to know what happens if you refuse consent.
• Canada, Australia, Indonesia, Saudi Arabia, China and elsewhere: similar rights to access, correct and delete your information and to withdraw consent, which we honour in the same way.

14. Parents’ rights

If you are a parent or legal guardian, you can at any time:

• review what we hold about your child: their profile, progress and saved work are in your parent dashboard, and your privacy page downloads everything;
• correct their profile;
• delete their profile and everything they made, straight away;
• refuse further collection: delete the profile or ask us to stop, and we will no longer collect information from that child;
• agree to our use of your child’s information without agreeing to any disclosure to third parties (we don’t make such disclosures anyway).

For a child in a class, ask the teacher or school, or write to [email protected] and we will help. We will ask only for what we need to check that you are the child’s parent.

15. Complaints

If you’re unhappy with how we handle information, please tell us first at [email protected] and we will try to put it right. You can also complain to the data protection authority where you live, work or think a problem happened, for example:

16. Changes to this policy

We will update this policy when our service or the law changes. The date at the top shows the current version (17 October 2026). For important changes, we will tell account holders by email or in the app before they take effect, and ask for fresh consent where the law requires, in particular before using children’s information in any new way.

17. Contact us

For anything about privacy, write to [email protected]. For other questions, write to [email protected]. Postal address: Crayonbird, available on request by email. You can write in English or in any language of the site.