Privacy policy

For young founders

Your parent can see and review the work in your family workspace. Use a nickname or learning-profile name and anonymous customer references. Do not add home addresses, personal contact details, passwords or customer identities to your work. Ask your parent before uploading a photo or file.

Information the workspace uses

• Accounts: the parent’s email address, account identifier and authentication information needed to sign in. The sign-in form passes through the Vercel-hosted application to Supabase, which provides authentication. Account and session information also passes through the hosting service when access to private pages is checked.
• Family profiles: the workspace name, learner display names, learning tracks, programme dates and settings.
• Learning records: submitted work, reflections, feedback, reading and writing entries, experiments, skills, reviews, portfolio selections and activity timestamps.
• Business learning records: manually entered sales, costs, transaction descriptions, business details and customer-conversation notes. The app does not connect to a bank account or take payments for the businesses recorded here.
• Chosen uploads: photos and documents you select, their filenames, file type, size and storage references. Original files can contain embedded metadata; remove identifying details or location metadata before uploading.
• Technical and support information: sign-in/session information, IP addresses, browser or request identifiers, user-agent/browser information, security records, information you send when contacting support, and deletion-request references, status and timestamps. Hosting providers can infer an approximate city, region or country from an IP address. They also process diagnostic information such as request status, errors, duration and performance. These technical records can be retained in provider logs rather than processed only momentarily.

Why we use this information

We use it to provide accounts and family access, save and retrieve work, calculate the figures you enter, preserve submission history, support parent feedback, protect the service and respond to support or deletion requests. A shared parent session can access the whole household. Switching learner profiles inside that session does not create separate private accounts.

Service providers and access

Supabase provides authentication, database services and private file storage. Vercel hosts the website and its server functions. These providers process information to operate the service. Technical request information is used to deliver the app, prevent abuse, diagnose faults and understand service performance. This includes operational analytics for debugging and reliability even though the app has no marketing analytics SDK.

Supabase processes covered customer data as a service provider under its Data Processing Addendum; its logging documentation describes IP, browser and approximate geographic request information. Vercel distinguishes customer content processed on the customer’s behalf from personal technical service-generated metadata for which it acts as an independent controller. Its Data Processing Addendum and Privacy Notice explain that processing, including IP-derived city/country information, service operation, diagnostics and security. Technical data is therefore disclosed to these providers; it is not accurate to describe every transfer as processing solely on our behalf.

The current website uses Vercel's Hobby hosting plan. Parent sign-in details, account/session information and page-request activity pass through Vercel. We disclose those transfers as well as technical metadata; we do not claim that every transfer to this hosting service qualifies as processing solely on our behalf. The family workspace sends learning records, ledger entries, feedback and selected original files directly from the browser to Supabase, rather than uploading those records through our Vercel server. Account-deletion requests and their status pass through the Vercel application to Supabase. The website serves its fonts from its own origin; loading the typefaces does not contact Google Fonts. Authorised administrators may access information when necessary to provide support, maintain the service or handle a verified deletion request.

Family work is not published as a public portfolio by default. We do not sell personal information, display advertising or use an advertising SDK. There is no integrated generative-AI service: the app does not send your learning records to an AI provider. References to AI tools in lessons are curriculum content.

If you open another service or share an exported file yourself, that service and your chosen recipient handle the information under their own arrangements.

Protection and local storage

The private workspace uses sign-in, database access controls, private upload storage and HTTPS connections. These measures are not a claim of end-to-end encryption or independent security certification.

Session cookies support sign-in. The browser can remember the selected learning profile. The separate demonstration stores its sample entries locally in that browser; it is not a private cloud account. Do not put real children’s or customers’ information in the demonstration. Signing out or uninstalling an app does not delete your cloud records, and browser-held demonstration data may need to be cleared separately.

The app does not request your device’s location permission, contacts, microphone or unrestricted photo library. Approximate location can still be inferred from your IP address by the providers described above. File selection is an action you choose. A file may still contain information within its content or metadata.

Retention and deletion

Account and learning records are kept to provide the family workspace and its history until deletion is requested and completed. There is no automatic deletion when a lesson is completed, a user signs out or the app is uninstalled.

You can request deletion of the account and associated family data through our account deletion page. Signed-in users can submit and track the request directly in the app without sending an email. Requests are processed manually within 30 days, and a pending request can be cancelled until processing begins. We send completion confirmation to the verified account email. If specific records must be retained for a legitimate legal or security reason, we will explain the affected records, reason and applicable retention period. Any applicable backup retention will also be explained when handling the request. Backup expiry is separate from the request-processing window; any necessary backup retention is explained when processing the request.

You can also ask about correcting or obtaining your information, or deleting one learner’s records without closing the entire family account. Keep any copies you need before requesting deletion. Exports already downloaded or shared by you are outside the cloud account and will not be removed from your devices by an account-deletion request.

Parent control and questions

A parent or guardian manages family access and children’s participation. Public registration may be unavailable; an existing authorised parent account is needed for the private workspace. If a child has provided information without the appropriate parent’s involvement, contact us so we can investigate and arrange removal.

For privacy questions or requests, contact AIFORGE at games@astromust.com. Do not send a password, identity document or a child’s work as part of an initial support message.

Changes to this policy

We will update this page when the service’s data practices change. The date above identifies the current version.