Privacy Policy
Version 2026-08-16
Who controls this information
Miles Everest Cheng Scott is responsible for the personal information described here and operates from 6 Berrylands Road, KT5 8RA, United Kingdom. Child-privacy configuration applies to United Kingdom. Contact: miles1chengscott@gmail.com.
What we collect
We collect email address, display name and account role; an optional verified parent-child family relationship when the family chooses to link; answers, wrong choices, part marks, hints, timing, lessons, goals, rewards and assigned-paper results; saved learning progress, recent mistakes, outfits, unfinished sessions and scratchpad working notes; question reports; subscription entitlement and payment references; privacy requests; and limited security, device and service logs. We do not ask students for an age band or exact birth date. Stripe receives payment details directly; Elevenly does not store complete card numbers.
Why and on what basis we use it
We use account and learning information to perform the service requested by the account holder; use proportionate security, support and service-quality information for legitimate interests while putting the child’s best interests first; process billing and records to meet contractual and legal duties; and ask for consent where the law specifically requires it. We do not sell children’s personal information, run behavioural advertising, or use learning records to make legal or similarly significant decisions.
Who can see it
A child can see their learning record. If the family optionally links a parent using the student’s private code, that linked parent can see family progress and manage parent features. Staff access is limited to legitimate support, safety and service operation. Cloud and payment providers process only the information needed to deliver their services.
Providers and international transfers
Supabase provides authentication and database services; the configured email provider delivers account messages; Stripe processes subscriptions; and the hosting provider serves the app. They may process only what is needed under their contracts. Where information crosses borders, we use the provider’s applicable transfer safeguards and assess whether extra protection is needed. A current subprocessor list must be maintained before public launch.
Storage, security and retention
Connections use encryption in transit. Server-side permissions separate families, passwords are handled by the authentication provider, and payment entitlement comes from signed payment events. The learning app keeps a device copy of progress and unfinished-session working notes. For a verified signed-in account, it also backs up that learning data to the private account when the account service is available; pending changes remain on the device until saving succeeds. Each account has a separate learning-app backup. Active learning data is kept while the account is used. After a completed deletion request, live account data is deleted or de-identified promptly; backup copies age out under the provider’s backup cycle. Security and support records are kept only as long as reasonably needed, while payment or tax records may be kept longer where law requires. A jurisdiction-specific retention schedule must be approved before public launch.
Your choices
Settings lets you request a copy of account data and request deletion. Family linking is optional, and the linked parent can unlink the family. You may also ask to correct information or object to certain processing where the law provides that right.
Children, defaults and profiling
Elevenly uses high-privacy defaults. A verified student can learn without providing an age band or guardian email. Parent linking is optional and happens only when a signed-in parent enters the student’s private six-digit family code; after linking, the parent can view progress reports and use parent features. Elevenly does not request an exact birth date, precise location, advertising identifiers or public profiles. Learning history is used to recommend revision and explain progress, and the child and any optionally linked parent can see the result. Children may ask to exercise their own data rights; we consider age, understanding and safety when deciding whether a parent may act for them.
Your rights and complaints
Depending on local law, you may ask for access, correction, deletion, restriction, objection or portability, or withdraw consent without affecting earlier lawful use. Settings provides export and deletion tools. Contact miles1chengscott@gmail.com for another request. People in the UK may also complain to the Information Commissioner’s Office; people elsewhere may contact their local data-protection authority.
Changes to this notice
The version date changes when this notice materially changes. Important changes are shown in the app, and fresh consent is requested where required. We keep earlier consent versions with the account so acceptance is auditable.