Privacy policy

1. Who we are

Crayonbird (“we”, “us”) runs crayonbird.com. We are the controller of the personal information described here. You can reach us at hello@crayonbird.com.

2. What we collect

Grown-up accounts: name, email address, a securely hashed password, language, and plan details. If you subscribe, our payment provider handles your payment details; we only receive a customer reference and the status of your subscription.

Child profiles (created by a parent): a first name or nickname, a colour, an age group and an optional birth year. We do not ask for a child's surname, email, photo, address or school.

Class students (created by a teacher): a first name or nickname and a 4-digit PIN used with the class code to sign in.

Learning activity: which sheets were played, scores, stars, badges, streaks and time spent, and any drawings or writing a child chooses to save to their portfolio.

Technical information: basic server logs (such as IP address and browser type) kept for a short time to keep the service secure and working. Library searches are stored without any link to a person to help us decide which sheets to make next.

3. Children's privacy

Crayonbird is designed to meet the expectations of the US Children's Online Privacy Protection Act (COPPA), the EU and UK GDPR, and the UK Age Appropriate Design Code (Children's Code).

Children cannot create accounts on their own. A parent creates child profiles and gives consent when they do so; a teacher creates class students under the school's authority to use educational tools.

Children cannot chat, post publicly or share personal information with other users. Settings are private by default, there are no nudges to stay online longer, and rewards are earned through learning, never bought.

A parent can review a child's activity, change their profile or delete it at any time from the parent dashboard.

4. How we use information

To run the service: signing in, showing the right sheets, marking answers, keeping progress, stars and badges, and sending reports to grown-ups.

To keep it safe and improve it: preventing abuse, fixing problems, and understanding (in aggregate) which sheets are useful.

To communicate with grown-ups: account emails, receipts and, only if you opt in, occasional product news. We never email children.

Our legal bases (for GDPR) are performing our contract with you, our legitimate interest in keeping the service secure and useful, consent where we ask for it, and legal obligations.

5. Cookies

We use only two cookies, both strictly necessary: one keeps you signed in, and one remembers your chosen language. We do not use advertising, analytics or social-media cookies, so we don't need a cookie banner.

6. Who we share it with

We never sell, rent or trade personal information, and we never share it for advertising.

We use a small number of service providers who process data on our behalf under written contracts: hosting and database providers, an email delivery service for grown-ups, and a payment provider for subscriptions. They may only use the data to provide their service to us.

We may disclose information if the law requires it, or to protect the safety of a child or others.

7. How long we keep it

We keep account data for as long as the account is open. When you delete an account, child profile or class, we delete the related personal information within 30 days, and from backups within 90 days. Server logs are kept for up to 30 days.

8. Your rights and choices

You can access, correct, download or delete your data, and your children's data, at any time from your account settings. You can also email hello@crayonbird.com and we will respond within 30 days.

Depending on where you live, you may also have the right to object to or restrict some processing, to withdraw consent, and to complain to your local data protection authority (for example the ICO in the UK).

9. Security

Passwords are hashed, connections are encrypted, access to data is limited to people who need it, and sessions expire automatically. No system is perfectly secure, but we work hard to protect your information and will tell you promptly if a breach affects you.

10. International transfers

Our providers may store data in other countries. When data leaves the UK or EU, we use recognised safeguards such as standard contractual clauses.

11. Changes to this policy

If we make important changes, we will tell grown-ups by email or in the app before they take effect, and ask for fresh consent where the law requires it.