Trust and safety

Safe for children, clear for grown-ups

This page says in plain words how Crayonbird treats children’s information. It matches our privacy policy, which is the full text.

What we collect

Only what is needed to learn and to save progress.

Children: a first name or nickname, a colour, an age group and their learning activity (scores, stars, saved work). No email address and no password.
Class students: a first name or nickname and a 4-digit PIN. Teachers are asked to use first names only.
Grown-ups (parents, teachers, teens with their own account): a name, an email address and a password, which we keep only as a secure hash.
We never ask a child for a surname, photo, voice, home address, school, phone number or exact location.

What we never do

Show ads.
Use advertising, social-media or tracking cookies, or analytics companies. Visits are counted without cookies.
Sell, rent or trade anyone’s information.
Let children chat, message each other or post anything in public. Children have no public profile.
Ask a child for an email address.
Use children’s information or work to train AI models.

Where the data lives

Learning data is kept in our own database, on our own servers. A few service providers help us run the site (delivering pages, email, backups and, if you buy a plan, payments). They may use data only to do that. The privacy policy lists them.

Your control: see, export, delete

Parents can download everything we hold as a ZIP file, and delete a child profile, a class or the whole account, from the privacy page. Deleting removes it straight away (backups clear within 30 days).
Teachers can remove a student or delete a whole class at any time, and export the gradebook.
Parents of class students can ask the teacher or school, or write to us and we will help.

Open your privacy page

Security we really use

We list only what is in place today.

All connections use HTTPS, and browsers are told to always use it.
Passwords are stored only as strong one-way hashes (bcrypt). Children have no passwords.
A class PIN locks after 5 wrong tries, for longer each time, and repeated sign-in attempts from one place are limited.
The sign-in cookie cannot be read by page scripts.
A strict content security policy lets our pages run only our own scripts.

Payments

Payments are handled by our payment provider, on its own checkout page. We never see or store card details. We keep only a customer reference, the plan, and payment dates and amounts.

AI stays on our server

Where Crayonbird uses AI, such as the quiz maker, the AI model runs on our own server, on a private network with no internet access. What people type is not sent to any outside AI company.

For schools

Teachers add students by first name or nickname, and each student gets a PIN. The school decides how its pupils’ information is used; we use class information only to provide Crayonbird to the school.

We can sign a data processing agreement on request. Write to [email protected] with your school’s name and what you need.

You can also ask us to show, correct or delete a class’s data.

What this page is, and is not

We built Crayonbird with children’s privacy rules in mind, such as COPPA in the US, the UK Age Appropriate Design Code and the GDPR rules for children. These are our own practices. We hold no certification or official approval, and we do not claim any.

Questions about data? Write to [email protected]. We answer within one month, free of charge.