Privacy notice
Pipkin is a learning website for children aged 4 to 11. This notice explains what happens to information when your family uses it. It is written for parents and carers.
The short version
- Your child's progress stays on your device. We never receive it.
- Children don't have accounts, don't type their names and are never asked where they live. Pipkin never looks up anyone's location.
- There are no ads on Pipkin.
- We count visits to the site, without cookies, so we know which pages help. You can turn this off in Grown-ups › Settings.
- If your child joins a school class, a little information goes to your child's school through us. The privacy notice for classes explains exactly what.
Who we are
Pipkin is run by The Build Brain Ltd, 10 Buzzard Close, Verwood, Dorset, BH31 7DH, company number 15035752 ("we"). We are responsible for the information described here, except class data, which your child's school is responsible for.
Contact us about privacy at privacy@hellopipkin.com.
What stays on your device
Everything your child does in Pipkin is saved in your browser's storage on this device, and nowhere else. That includes:
- each child's profile: the name or nickname you typed, the animal, the outfit and the year group you chose;
- progress: puzzles finished, stars, Seeds and badges;
- grown-up settings, such as the clock settings.
We cannot see any of it. If you save a "Keep progress safe" copy, that is a file you keep; we never get it. To delete it all, delete the profile in Grown-ups › Settings, or clear this site's data in your browser.
Handwriting practice stays in the device's memory while your child writes. It is never saved or sent.
Site statistics
We use Cloudflare Web Analytics to count visits to pages and to see how quickly pages load. It does not use cookies or store anything on your device, and it does not follow anyone from site to site. When a page opens, it sends Cloudflare the page's address, the page you came from, the type of browser and device, and how long the page took to load. Cloudflare works out a rough country from the connection. We only ever see totals, such as "the times-tables page had 300 visits this week". We cannot pick out you or your child.
Our reason is legitimate interests: knowing which pages are used and fixing slow ones (UK GDPR Article 6(1)(f)).
You can turn it off. Go to Grown-ups › Settings › Site statistics and switch off "Count visits from this device". Pipkin then sends nothing to Cloudflare Web Analytics from that browser. The setting is saved on the device, so set it in each browser you use, and in the Home Screen app if you added Pipkin to your Home Screen.
Cookies and device storage
- Pipkin sets no cookies for families, on children's pages or on grown-up pages.
- Teachers who sign in to the class console get one sign-in cookie. It is needed to keep them signed in, and nothing else can read it.
- Pipkin uses your browser's storage to keep your child's progress, your settings, a class link if you join a class, and your site statistics choice. This storage is needed for Pipkin to work as you asked, so no consent is needed for it.
How the website reaches you
Cloudflare, Inc. hosts Pipkin. Like any website, every page request passes through Cloudflare's network, which needs your device's internet address (IP address) to send the page back. We keep no record of visits to the site and do not store IP addresses.
Cloudflare is a US company. Where its systems outside the UK handle information for us, that is covered by the UK Addendum to the standard contractual clauses in Cloudflare's data processing terms.
Classes
If your child's teacher uses Pipkin classes and you join your child to a class, the privacy notice for classes explains what is shared, who is in charge of it and how long it is kept. How classes keep children safe: Keeping classes safe.
Teachers
When a teacher signs in to set up classes, we hold their email address (encrypted), the name their class sees, their school's name, which terms they accepted and when, and their sign-in sessions. We use these to let them sign in and to send the notices we owe their school. Our reason is legitimate interests: running the service their school chose (UK GDPR Article 6(1)(f)). An account is deleted when the teacher deletes it, or after 13 months without a sign-in, after a warning email. The privacy notice for classes has the details.
We also hold the school's country, so that the right part of our agreement with the school applies. For a teacher in the EU or EEA, the EU General Data Protection Regulation applies to their account too, and classes are not yet open there: we will name our representative in the EU in the data processing agreement (Schedule B) before they open.
If classes are not open yet for schools in a teacher's country, the teacher can ask us to email them when classes open in more countries. We then keep only the time they asked, and send that one email to the address they signed in with. Our reason is their request (UK GDPR Article 6(1)(a)). They can stop it at any time on the teacher welcome page or by writing to privacy@hellopipkin.com, and it ends when they set up classes.
Buying Pipkin Plus or a school licence
Nothing is on sale yet. When Pipkin Plus and school licences go on sale, they will be sold by Paddle (Paddle.com Market Ltd), which acts as the seller for us. Paddle takes the payment and handles card details, billing addresses, tax and invoices, under its own privacy notice. We never see card details. Paddle tells us the buyer's name and email address, the country, what was bought and whether the subscription is active, so that we can provide it. Our reason is the contract with the buyer (UK GDPR Article 6(1)(b)). We keep these records for as long as the law on tax and accounts requires (six years).
Children never pay and are never asked to buy anything. Buying is only for grown-ups, behind the grown-ups door.
Emails you send us
If you email privacy@, safety@ or hello@hellopipkin.com, we use your email to answer you. We keep it while we deal with your message, and delete it within two years unless we need it for a complaint or a safety report.
Children
Pipkin is made for children aged 4 to 11. We do not rely on a child's consent for anything, so no age check is needed. A grown-up makes every choice that involves sharing, behind the grown-ups door. We build Pipkin to the Information Commissioner's Age appropriate design code.
Your rights
You can ask us for a copy of the information we hold about you or your child, and ask us to correct it, delete it or stop using it. You can object to site statistics at any time with the switch above. Email privacy@hellopipkin.com. We will reply within one month. For class data, your child's school decides requests; we will pass yours on.
Information that only lives on your device is already yours: you can see it in Pipkin and delete it whenever you like.
Complaints
If you are unhappy with how we use information, email privacy@hellopipkin.com with "Complaint" in the subject. We will confirm we have it within 30 days, usually much sooner, and reply in full as quickly as we can.
You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or to the data protection regulator in your own country (in Ireland, the Data Protection Commission).
Changes to this notice
If we change how we use information, we will update this page and the date below before the change happens. We will never start using information for a new purpose without saying so here first.
Last updated: 9 October 2026.
Contact
The Build Brain Ltd, 10 Buzzard Close, Verwood, Dorset, BH31 7DH. Company number 15035752.
ICO registration: applied for in October 2026, fee paid. We will add the registration number here when the ICO issues it.