Data processing statement (education)
Purpose. This statement is for school leaders, operators and data protection officers who need a filed document answering one question: does this service process personal data about students, and is a data processing agreement required?
The statement
We do not process personal data about students. No data processing agreement is required, because there is no processing to agree about.
Why this is the case — verifiable facts
- No student accounts exist. None can be created, so none can be breached, exported or subpoenaed.
- Progress stays on the device. Results, streaks and settings are written to the browser's local storage on the student's own device and are never transmitted to us.
- Assignments carry no identity. A teacher's assignment settings are encoded
in the part of the link after the
#character. Browsers do not send that part to any server; it is decoded inside the student's browser. - Our usage events contain no identifiers. The complete list of fields we record is: timestamp, site, event name, game name, visitor category, day counters, input method, referral source, outcome and score, sampling interval. There is no name, no e-mail, no IP address, no device identifier and no cookie identifier — and no field from which an individual could be re-identified.
- It can be checked. Open an assignment link, open the browser's developer tools, and watch the network activity. We invite you to.
What we do hold
For a paid licence we hold the customer's business data — the name of the teacher or institution, for licensing and invoicing. That is customer data, not student data, and it is processed by us as controller for the purpose of the contract.
Scope and standing
This statement covers all three sites and every game and teaching page on them. If the service ever begins to process student personal data, this statement is withdrawn and a data processing agreement is offered before that change goes live — not after.