Privacy Policy

Last updated: 14 July 2026

Plain-English summary: Treenwich is a learning service for children, used through a parent or guardian account. We collect as little personal data as possible, we never sell it, and we do not show advertising to children. This page explains what we collect and your rights under UK and EU data protection law, with an extra section for California residents.

1. Who we are

Treenwich ("we", "us") operates the website at treenwich.co.uk and its learning programmes (11+, School and GCSE). We are the "data controller" for the personal data described here. You can contact us about privacy at yungqifr@gmail.com.

2. Children and parental consent

Our service is designed for children but is set up and managed by a parent or guardian. Under UK GDPR, a child can only consent to online services from age 13; because our learners are typically younger, the account holder must be a parent or guardian aged 18 or over, who provides consent on the child's behalf. We follow the Information Commissioner's Office (ICO) Age Appropriate Design Code (Children's Code): high privacy by default, data minimisation, and no manipulative "nudge" techniques.

3. What we collect

Account data: the parent/guardian name and email address, and an encrypted password.
Child learning data: a display name (a first name or nickname is enough — please do not use a full name), questions answered, scores, XP and progress.
Subscription data: plan and billing status. Card payments are handled by Stripe — we never see or store card numbers.
Technical data: strictly necessary cookies to keep you signed in, and basic security logs.

We do not collect more than we need, and we do not build advertising profiles of children.

4. How we use it

To provide the learning service and track progress for you and your child.
To manage your account, trial and subscription.
To keep the service secure and prevent abuse.
To send service emails (e.g. password resets, reward notifications). Marketing emails are sent only if you separately opt in, and you can unsubscribe at any time.

5. Legal bases

We rely on contract (to provide the service you sign up for), consent (for optional marketing and non-essential cookies), and legitimate interests (to keep the service secure), always balanced in favour of protecting children.

6. Who we share it with

We use a small number of trusted processors, only to run the service:

Supabase — secure database and accounts (EU region).
Vercel — website hosting.
Stripe — payment processing.
Resend — sending service emails.
Anthropic — the AI tutor ("Professor Pixel") processes the text of a question and the child's message to give a hint. We instruct it not to train on this data.

We never sell your data or share it for advertising.

7. Where your data is stored

We store data in the UK/EU where possible. Where a processor operates outside the UK, we rely on approved safeguards (such as the UK International Data Transfer Addendum).

8. How long we keep it

We keep account and learning data while your account is active. If you delete your account, we remove personal data within 30 days, except where we must keep limited records (e.g. payment records) for legal reasons.

9. Your rights

Under UK GDPR you (on behalf of your child) can ask us to:

access the personal data we hold;
correct or delete it;
restrict or object to certain processing;
withdraw consent at any time;
receive a copy in a portable format.

Email yungqifr@gmail.com and we will respond within one month. You also have the right to complain to the ICO (ico.org.uk).

10. Security

Passwords are encrypted, data is transmitted over HTTPS, and access is restricted. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

11. EU / EEA users

If you or your child are in the European Economic Area, your data is processed under the EU GDPRand you have the same rights as in section 9. Because our learners are children, we apply the higher of the UK and EU age-of-consent rules and keep privacy settings high by default. You can complain to your local Data Protection Authority as well as, or instead of, the UK ICO.

12. California residents (CCPA / CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request access to or deletion or correction of it, and to opt out of any "sale" or "sharing" of it. We do not sell or share personal information, and we do not use it for cross-context behavioural advertising — this is especially true for children. We will not discriminate against you for exercising these rights. To make a request, email yungqifr@gmail.com; we may need to verify your identity before we act.

13. Changes

We may update this policy. We will show the date above and, for significant changes, notify you by email.