Privacy notice for classes

Pipkin works without classes. If you never join one, nothing about your child leaves your device.

A school can use Pipkin to see how much practice its pupils do. A teacher gives you a class code. You can then join your child's Pipkin profile to the class in Grown-ups › Settings › Class. Before you agree, Pipkin shows you exactly what will be shared. Joining is your choice, and you can leave at any time.

How classes keep children safe, what is never allowed and how to report a problem: Keeping classes safe.

Who is in charge of the data

• Class data (your child's class nickname and weekly counts): your child's school is in charge. It is the controller. We, The Build Brain Ltd, store and show the data for the school and follow its instructions. We are its processor. The school uses it for its public task of educating your child (UK GDPR Article 6(1)(e); an independent school relies on legitimate interests, Article 6(1)(f)).
• Teacher accounts (a teacher's email, the name the class sees, the school's name and its country): we are in charge. We use them to let the teacher sign in and to send the notices we owe the school. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)): running the service the teacher's school has chosen to use. The agreement is with the school, not with the teacher personally, so we do not rely on a contract with the teacher.

To ask about your child's class data, or to use your rights over it, please contact the school first. You can also write to us and we will pass it on.

What leaves your device

Only these: the class nickname, your child's animal picture, three numbers each week (puzzles finished, Seeds earned, times-tables facts learned), the version of the joining wording you agreed to, and a technical key that links this device to the class. We keep the key only as a one-way hash. Once class boards arrive, your child's "Show me" or "Just me" choice will be sent too. Nothing else leaves the device.

What is held about your child

• a class nickname made of two words from fixed lists (for example "Brave Otter"), which you pick with your child;
• your child's animal picture;
• each week: how many puzzles they finished, Seeds they earned and times-tables facts they learned (only from play after the teacher lets them in);
• whether they chose "Show me" or "Just me" for the class board, and their team if the class has teams;
• up to 3 initials the teacher may add so they know who is who (only the teacher sees these);
• the dates they asked to join and were let in, the version of the joining wording you agreed to and when;
• for each device linked to the class (at most 2), a one-way hash of that device's key.

We never receive your child's name, age, year group, date of birth, answers, typed text, how long anything took, location, photo or device id. We do not store IP addresses. To slow down people guessing codes, we count requests using a scrambled form of the address that changes every day. These counts are kept for about a day and then deleted.

Where it is kept

In a Cloudflare D1 database in Cloudflare's EU jurisdiction. Cloudflare, Inc. hosts Pipkin for us and is our only sub-processor. Requests pass through Cloudflare's data centre nearest you, usually in the UK. UK law approves sending personal data to EU and EEA countries (Data Protection Act 2018, Schedule 21), so no extra safeguard is needed for storing it there. Cloudflare is a US company. If its staff or systems outside the UK and EU ever reach the data, that is covered by the UK Addendum to the standard contractual clauses in Cloudflare's data processing terms.

How long it is kept

• Leaving the class deletes your child's class data at once. So does the teacher removing your child.
• Weekly counts are deleted after 20 weeks.
• If your child's device sends nothing for 10 weeks, your child is removed from the class.
• A request to join that the teacher does not answer is deleted after 14 days.
• A class is deleted 30 days after it ends (normally 31 August), unless the teacher keeps it for another school year.

Backups. Deleted data can still be restored from our database provider's restore points for up to 30 days. We only restore after a fault, and if we do, we delete again every class, class membership and teacher account that was deleted after the restore point, and no class code that was changed or deleted works again. To make that possible we keep, for 30 days, the random id of each deleted class and class membership (never a name or nickname) and a scrambled form of each class code that stopped working (never the code itself). After 30 days it is gone.

Teacher accounts

We hold a teacher's email address (encrypted), the name the class sees, the school's name, the school's country (and, in the United States or Australia, its state or territory), which terms and agreement versions (and which regional schedule of the agreement) they accepted and when, and their sign-in sessions. If classes are not open yet for schools in a teacher's country, the teacher can ask us to email them when classes open in more countries. We then keep only the time they asked, and send that one email to the address they signed in with. Our reason is their request (UK GDPR Article 6(1)(a)). They can stop it at any time on the teacher welcome page or by writing to privacy@hellopipkin.com, and it ends when they set up classes. A teacher can delete their account at any time; it is also deleted after 13 months without a sign-in, after a warning email. A record of teacher actions is kept for up to 13 months. When a teacher's account is deleted we keep one scrambled form of their email address for 30 days only, so that a restore from backup cannot bring the account back.

Your rights

You have the right to see the data held about your child, to have it corrected or deleted, and to object to its use. For class data, the school decides these requests; leaving the class deletes the data straight away.

If your child's school is outside the UK

Everything above applies wherever the school is. The school is still in charge of class data, and we still only handle it for the school. These extra points depend on the school's country.

Ireland, and other EU and EEA countries

The EU General Data Protection Regulation applies. Class data is stored in the EU. We are in the United Kingdom, which the European Commission has decided protects personal data adequately. Before classes open for schools in the EU or EEA, we will name our representative in the EU in the data processing agreement (Schedule B), and you will be able to contact them instead of us. You can complain to the Data Protection Commission in Ireland (dataprotection.ie) or to the regulator in your own country.

United States

This section is our notice under the Children's Online Privacy Protection Act (COPPA).

• Who we are: The Build Brain Ltd, 10 Buzzard Close, Verwood, Dorset, BH31 7DH, United Kingdom; privacy@hellopipkin.com.
• What we collect from children in a class, and how: the items listed under "What is held about your child" above. A parent or carer chooses the nickname with the child and joins the class; the device then sends the weekly counts. The device's key is a persistent identifier, which COPPA counts as personal information. Children cannot type anything, or make anything public, in a class.
• How we use it: only to show the child's school how much practice each child does, as the school's service provider. Never for advertising, profiling, selling or any other commercial purpose.
• Who we share it with: the child's teacher and school, and Cloudflare, which hosts Pipkin for us under contract. Nobody else.
• Consent: the school agrees to this collection for parents, as the FTC allows when the data is used only for the school. You can still see what is shared before you join, and leave at any time.
• Your rights: you can review your child's class data, have it deleted, and stop further collection. Leaving the class deletes it at once and stops collection. You can also ask the school or email us.
• How long we keep it: as "How long it is kept" above says. That section is our written data retention policy. We never keep children's data longer than we need it for the school.

Australia

Class data is held outside Australia, in the EU, by us for the school and under its control. If you are unhappy, talk to the school first. You can then complain to the Office of the Australian Information Commissioner (oaic.gov.au) or your state or territory's privacy regulator, depending on the school.

New Zealand

Class data is held outside New Zealand, in the EU, by us for the school, which stays responsible for it under the Privacy Act 2020. If you are unhappy, talk to the school first. You can then complain to the Privacy Commissioner (privacy.org.nz).

Anywhere else

The school is responsible for checking that its law allows it to use Pipkin. You can complain to your own country's data protection regulator.

Complaints

If you are unhappy with how your child's data is used, please talk to the school or to us first. You can complain to the Information Commissioner's Office (ICO) at any time: https://ico.org.uk/make-a-complaint/. If the school is outside the UK, see the section above for your regulator.

Contact

privacy@hellopipkin.com

The Build Brain Ltd, 10 Buzzard Close, Verwood, Dorset, BH31 7DH.

ICO registration: applied for in October 2026, fee paid. We will add the registration number here when the ICO issues it.