Privacy Policy

Wordrealm is a vocabulary-learning app for children aged 8 to 11, including those preparing for the 11+ exam. This policy explains what personal information Wordrealm Limited ("we") collects when you and your child use the app, why we collect it, and the choices you have. Wordrealm Limited (company number 17356720, registered in England & Wales) is the data controller responsible for your information. We are registered with the UK Information Commissioner's Office as a data controller under reference ZC223802, which you can look up on the public register at ico.org.uk/register.

Wordrealm is designed to be used by children with a parent or guardian's permission. We rely on your consent, given when you create your account, to store and process your child's learning data.

We keep this deliberately small:

• Your parent account: your email address, an optional display name, and the record and date of your consent. You can sign in either with a password or with a one-tap link we email you. If you set a password, we store only a securely scrambled (hashed) version — never the password itself; if you only ever use the sign-in link, we store no password at all.
• Each child's profile: the first name or nickname you give them, their age, which exam board they're preparing for, how you'd like stories to refer to them (she, he, they or just their name, if you choose; optional), and their chosen character, look and theme. Your child also chooses, on their own “My story profile” screen, what they love (e.g. "space" or "football"), who their hero is, an optional story sidekick and its name, and how they like their stories to feel. Anything they type there is safety-checked before it is saved, and you can see all of it on your dashboard.
• Learning activity: which words they've met and mastered, quiz, test and mock-exam results, streaks, in-app coins (a game reward, not real money), and the stories they generate. This is what powers their practice and your progress reports. We also keep a simple record of when they did these things — a note that a story was started or a mock exam finished, nothing they wrote — so we can see how the app is being used overall. After twelve months we unlink those notes from your child, so what remains is a count with nobody's name on it.
• Sentences your child writes: at the end of a story we invite your child to write one sentence of their own using a word they have just learned. It is checked automatically for unsafe content before it is saved. We then keep it so your child can see it in My Words and so you can see it on your dashboard. We keep only their most recent sentence for each word. Writing one is part of finishing each story, and it only needs to be a single short sentence using the word. We delete a sentence automatically two years after it was written, because by then your child has moved on from the word and we no longer need it. These sentences are shown only to you and your child, and are never included in emails or shared with anyone else.
• Some things kept on your child's device: their profile, practice they have downloaded so they can keep going without an internet connection, and any answers waiting to be sent once they are back online. This stays on the device and is cleared if they sign out or clear their browser.
• A little technical information: a sign-in cookie to keep you logged in, and basic security records (for example, to slow down repeated failed log-in attempts). That is all of them. If you arrive through a friend's invitation link we keep the code in the web address while you look around, and write it down only if you create an account — nothing is stored on your device before then. The same goes for our own adverts and the links we share on social media: if you arrive from one, we note which it was when you create an account, so we can tell what works. We may also ask once, on your dashboard, where you heard about Wordrealm; answering is optional. That information stays with us. We also count visits to our website (which pages are viewed, which of our main buttons and videos are tapped, roughly which country, and the type of device) using our hosting provider's privacy-friendly analytics. It uses no cookies, stores nothing on your device and does not identify you. We do not use advertising or third-party tracking cookies.
• Feedback: if your child taps a reaction face after a story (for example "loved it"), we record that tap and which story world it was about. If they tap "not for me", they can tap one reason from a short list (such as "too long") — never any typed words from your child. If you send us feedback from your dashboard, we keep your message, your optional star rating and your email, so we can read it and reply. If you answer the one-tap questions we email during or just after your free trial, or when you cancel, we keep your score or the reason you tapped, and anything you type, with your account. We only quote your words on our website if you tick the box saying we may, and never with your name. We delete written feedback after two years. Your child's reaction taps are unlinked from them after twelve months, leaving only a count of which story worlds children enjoy.
• Payment details (only if you subscribe): handled by our payment provider. We never see or store your full card number.
• If you ask for the free word list: we keep your email address so we can send it to you. If you tick the box, we also send a five-day word challenge and the occasional update about Wordrealm — and nothing else. We never link this to a child, we never sell it or pass it to anyone for their own marketing, and every email has a one-tap unsubscribe. You do not need to give us an address to read the words: every one is free to browse on the site.

• To run the app: sign you in, save progress and personalise each child's practice to the right level.
• To create personalised stories and keep content safe (see the AI section below).
• To read stories and words aloud in a British voice, for children who learn better by listening.
• To show you honest progress reports and a readiness picture for each child.
• To manage your subscription and send you service messages — for example confirming your email address, emailing you a one-tap sign-in link when you ask for one, a weekly progress email, and the occasional gentle reminder if your child goes quiet for a few days or a streak is about to break. You can switch the weekly email and the reminders off separately, whenever you like.
• To keep the app secure and working properly.
• To read and act on feedback — fixing problems and deciding what to improve next.

Our lawful bases under UK GDPR are your consent (for storing and personalising your child's learning data) and performance of our contract with you (to provide the app and any subscription you buy).

Wordrealm's stories are generated by an artificial-intelligence service (OpenAI). To create a story and to check that anything your child types is safe, we send a limited amount of information to OpenAI's API — the child's first name or nickname, their age, their interests, their hero and sidekick (if they chose them), how their character looks, how stories should refer to them (if you set it), and their story choices. We send only what's needed for that story.

If your child writes their own sentence at the end of a story, we send that sentence to OpenAI: once to check it is safe, once to check whether the new word has been used correctly, and once to suggest a stronger version of their sentence to show them. We do not send their name with it.

OpenAI acts as our processor. According to OpenAI's terms, information sent through their API is not used to train their models. Free text a child enters is also checked automatically for unsafe content before it's saved.

So that children who prefer to listen can follow along, Wordrealm can read words and stories aloud in a British voice using Microsoft Azure's text-to-speech service. Reading a whole story aloud means the story text — which includes your child's first name as the hero — is sent to Azure to be turned into audio. Azure acts as our processor for this and does not use the text to train its services.

Wordrealm adapts to each child. We use their learning activity — the words they've met, their scores and how well they remember words over time — to choose which words to practise next and to estimate a "readiness" picture for you, their parent. This personalisation helps them learn; it is not an automated decision that has a legal or similarly significant effect on your child, and it is never used to advertise to them.

We do not sell your or your child's data, and we never share it for advertising. We share it only with the trusted service providers we need to run Wordrealm, each under a written agreement covering data protection:

• Our AI provider (OpenAI) — to generate stories and check content safety, as described above.
• Our text-to-speech provider (Microsoft Azure) — to read words and stories aloud in a British voice.
• Our hosting provider (Vercel) and our database provider (Neon) — to run the app and store your data securely.
• Our media storage (Cloudflare) — the artwork and the recorded words are kept there. Those files are identical for every child, contain no information about anyone, and reach your child through our own website, so Cloudflare receives nothing about them. The short “how it works” videos on our public pages for parents are the one exception: they play straight from Cloudflare, which, like any web host, sees the viewer’s IP address.
• Our payment provider (Stripe) — to process subscriptions, if you choose to buy one. Card details go straight to Stripe; we never see or store them.
• Our email provider (Resend) — to send account, progress and reminder emails.
• Our error-monitoring provider (Sentry) — to alert us when something breaks. We strip out personal information before any error report is sent, so it records what went wrong, never who it happened to.

We name our providers so you can look them up. If we ever change one, we'll update this list.

We may also share information if the law requires it, or to protect the safety and rights of children using the app.

We may show you how your child is doing compared with other children of the same age preparing for the same exam — for example, "ahead of 60% of children preparing for the same exam". This is designed to protect every child's privacy:

• It is always anonymous and aggregated. We show a single percentage and a group average — never another child's name, profile or individual score.
• It only appears once a group is large enough (at least 20 other children) that no individual could be identified from it. Below that, nothing is shown.
• It is never a leaderboard.

If you would prefer your child not to be included in this anonymous benchmarking, contact us at privacy@wordrealm.co.uk.

Most of your family's data never leaves the UK or the EU:

• The database (Neon) holding your account and your child's learning progress is hosted in London, United Kingdom.
• Reading stories aloud is done by a text-to-speech service running in the UK — so the story text, which includes your child's first name, is not sent overseas to be turned into audio.
• Error monitoring (Sentry) is hosted in Germany, and personal information is stripped out before any error report is sent.

Some of our other providers are based in the United States — our AI provider (OpenAI) and our email provider (Resend) — so some information is transferred there. Our app hosting provider (Vercel) also runs a global network, so a request may be handled outside the UK.

Our payment provider is Stripe Payments UK Ltd. They process subscription payments and, depending on the service, some of that processing takes place outside the UK. Your card details are collected by Stripe directly and never reach Wordrealm. For the payment itself Stripe acts on our instructions. For a number of other things — preventing fraud, meeting the anti-money-laundering and sanctions rules they are legally required to follow, and improving their own services — Stripe decides for itself what to do with the information and is responsible for it in its own right. Their explanation of which is which is in Stripe's own Privacy Center, and they have a data protection officer at dpo@stripe.com.

Where data does go to the United States, we rely on safeguards recognised under UK data protection law. For OpenAI, that safeguard is the International Data Transfer Addendum to the EU Standard Contractual Clauses, which forms part of the data-processing agreement we have entered into with them. OpenAI is not certified under the UK–US Data Bridge, so those Clauses are the safeguard we rely on, not a fallback. Some of our other US providers are separately certified under the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework); where a provider is not certified, the same Clauses apply.

We keep your account and your child's learning data for as long as your account is active. When you delete a child's profile, that child's learning data is removed. When you delete your account, we remove your family's data, except for a small amount we may be legally required to keep (for example, billing records).

If you asked for the free word list, we keep your email address until you unsubscribe. When you do, we keep a record that you unsubscribed — that is what stops you being added back by mistake — and nothing else. You can ask us to erase it entirely at any time.

When we run a giveaway on Instagram or Facebook, we use entrants' names, handles and comments only to run it: checking who can enter, picking and contacting the winner, delivering the prize and answering any complaint. Our lawful basis is legitimate interests in running a promotion people chose to enter. Entering does not sign anyone up to emails.

We keep entry details for 6 months after the draw, then delete them, except the winner's, which stay with their Wordrealm account. Each giveaway's own terms are at wordrealm.co.uk/giveaway-terms.

You can, at any time:

• Delete a child's profile yourself from the parent dashboard — this removes their data.
• Ask for a copy of the personal data we hold about you and your child.
• Ask us to correct anything that's wrong.
• Ask us to delete your account and data.
• Withdraw your consent, which will stop us storing your child's learning data going forward.

To make any of these requests, email us at privacy@wordrealm.co.uk. If you're unhappy with how we've handled your data, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk.

We protect your information with encrypted connections, any password you set stored only in a scrambled (hashed) form, a secure database, and access limited to what's needed to run the service.

Wordrealm is intended for children aged around 8 to 11, used with a parent or guardian's permission. Almost everything your child does in the app is tap-to-choose, so they are not asked to type information about themselves. The one exception is the sentence they may write at the end of a story, described above — it is optional, it is checked automatically before it is saved, and only you and your child can see it. Children cannot make payments in the app. We rely on you, as the parent or guardian, to give consent on your child's behalf.

If we make important changes to this policy, we'll update the date at the top and, where appropriate, let you know in the app or by email.

Questions about your privacy, or any of the requests above? Email us at privacy@wordrealm.co.uk and we'll help.

You can also write to us at: Wordrealm Limited, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.