Privacy Policy

Last updated: 27 October 2026

This policy covers the WordRunner app (app.word-runner.com) and this website (word-runner.com). It includes our approach to children's privacy and parental consent for users under 16 and our reading exposure analytics.

1. Data Controller

2. Data We Collect

When you use WordRunner, we may collect the following information:

• Account Information: your email address, password and the invite code you signed up with, and the name you choose to show in the app; if you change that name in Settings, we also keep the name it replaced and when you changed it
• Date of Birth and Country: we ask for both when you sign up, to stop anyone under 13 registering and to decide whether a parent must consent. We keep the date and the country only for accounts that need a parent's consent. For everyone else we keep only the result of the check — whether a parent's consent was needed and whether you were 18 or over at the time, plus, if you were under 18, the month and year you turn 18 (never the day) — when and how the check was made, and the region it used (for example "EU" or "Switzerland").
• Parent/Guardian Information: for accounts that need consent, a parent's or guardian's name and email address, to obtain and manage consent, and the record of their decision, including the IP address it was made from, which is also stored on the child's account record (see §7 and §9)
• Learning Data: your vocabulary progress, quiz results, a running score for each reading skill (from reading quizzes), XP earned, learning statistics, the words you save with any notes, and where you stopped in each text, so that you can carry on
• What You Write: answers to exercises, essays and the evidence you collect for them, posts in the community hub, labels you give audio bookmarks, and bug reports, with any screenshots you attach
• Payments: if you buy credits, the amount, your payment message or reference and, if you add one, a screenshot of the payment
• Usage Data: How you interact with the platform, session duration, and feature usage
• Technical Data: for accounts that need a parent's consent, the time zone your device reported when you signed up, used to give your age in the email asking for your parent's consent; your IP address and browser type in consent records and some security records; your browser type in bug reports; and your IP address to limit repeated requests
• Reading Exposure Data: Which vocabulary words you encounter while reading and how long each word is visible on screen. See §9.5 for details.
• Messages to Us: if you use the contact form on this website, your name, email address, the kind of enquiry and your message. We also hold the requests for access to the app we have received: the name, email address, phone number, English level, learning goal, how the person heard of us, who invited or referred them (if given), age group and message

3. How We Use Your Data

We use your data to:

• Provide and personalise the WordRunner learning experience
• Track your vocabulary progress and choose words for your practice
• Mark written answers and give feedback using AI: some answers (such as sentences you write in exercises and essays) are sent to Google's Gemini models, provided through Google Cloud (Vertex AI). Text you paste into Sift is also sent to Gemini to pick out words, and Sift does not keep the text. Essays are also checked by Gemini for personal information a learner has shared and for signs that a learner may be at risk (a safety check).
• Enable teachers and administrators to monitor student progress (if applicable)
• Improve our platform and develop new features
• Communicate with you about your account and updates
• Ensure security and prevent abuse

4. Legal Basis for Processing

Under the Swiss Federal Act on Data Protection (DSG) and GDPR, we process your data based on:

• Contract Performance: To provide the learning services you signed up for
• Legitimate Interests: To improve our services and ensure platform security
• Consent: For optional features and marketing communications

5. Data Sharing

We do not sell your personal data. We may share data with:

• Service Providers: Google Cloud (hosting, and AI through Vertex AI), Firebase (sign-in, database and the app's web hosting), Resend (email delivery) and Cloudflare (hosting this website)
• YouTube: some lessons show a YouTube video through YouTube's privacy-enhanced service (youtube-nocookie.com). When such a lesson opens, your browser connects to YouTube, which receives your IP address.
• Your Class: if you join a class, its teacher or group leader sees, for each learner, the name they show, their score, streak and stability score, their sessions and XP this week, and when they were last active; and, once at least five learners in the class have read, what each learner has read and for how long. Admins can also be emailed a list of learners who have not been active for three days.
• Other Users: other users of WordRunner see the name you show in the community hub (each study group has its own board, and one board is open to everyone signed in) and in squad games. In a squad game, the list of players also shows an "Under 16" or "Over 18" badge and a language-background badge (whether English is their first language, or one they speak fluently or are learning), if a learner has chosen to show them, and the scoreboard shows the language-background badge only. A parent's account always shows "Over 18" in the list of players. A post in the community hub can show "Over 18" when its author has that badge, but never "Under 16" or a language badge.
• Sponsors: if you sponsor a class, your name (and, for larger sponsorships, your logo) is listed on our For Sponsors page for twelve months after your latest sponsorship, unless you ask to be listed anonymously or not at all.
• Legal Requirements: If required by Swiss law or valid legal process

6. International Data Transfers

Your learning data and the files you upload are stored in Switzerland (Google Cloud, Zürich). Your written answers, and any other text of yours that we send to AI, are processed by Google Cloud in the EU. Sign-in accounts are held by Google's Firebase sign-in service, which runs in the United States. Emails are sent by Resend from its EU region. Some service providers may process data in other locations. We ensure appropriate safeguards are in place, including Standard Contractual Clauses where required.

7. Data Retention

We retain your data for as long as your account is active. Some records are deleted or anonymised sooner: essays are anonymised 13 months after they are written, community posts are deleted after 12 months, and bug reports 12 months after they are resolved.

You cannot yet delete your account in the app. To delete it, email us (the app's Settings page has a ready-made email for this), and we will delete your personal data within 30 days, except where retention is required for legal or legitimate business purposes. A child's account is also deleted automatically 14 days after a parent declines or withdraws consent. If a parent never answers, the account stays locked, with its data, and is not deleted until someone asks us to delete it.

At present we keep these records after an account is deleted: the parental consent records and the consent audit log (see below); records of credit purchases (email address, the name shown in the app, amount and payment reference) and any payment screenshot; records of paid word enrichment; the results of essay safety checks; squad game records that include the account's ID; and our own record that we deleted the account, which includes its email address and is deleted after 24 months. Unless a period is given, there is no end date yet. Records of requests, kept under an IP address to limit repeated requests, are not linked to the account and are not deleted with it; they are deleted automatically about 30 days after the last request.

Consent Records: To comply with Swiss commercial records requirements and demonstrate regulatory compliance, we retain parental consent audit logs. We have not yet put an end date into effect, so at present they are kept indefinitely. These records include timestamps, consent decisions, and verification evidence, including IP addresses and browser types.

8. Your Rights

Under Swiss data protection law and GDPR, you have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data ("right to be forgotten")
• Data Portability: Receive your data in a structured format
• Objection: Object to certain processing activities
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at richard.whittle@equalex.com. You can also download a copy of your data yourself, on the app's Transparency page.

9. Children's Privacy & Parental Consent

WordRunner is for learners aged 13 and over, including students under 16. We take children's privacy seriously and comply with Swiss DSG and EU GDPR requirements.

9.1 Age Verification

When creating an account, we ask for date of birth and country to determine whether parental consent is required. Nobody under 13 can register. If you are under 16 and live in the EU/EEA, the UK or Switzerland, you cannot use WordRunner until a parent or guardian has approved your account.

9.2 Parental Consent Process

For these users:

• We collect a parent/guardian's name and email address
• We verify the parent's email through a confirmation code
• We send the parent a consent request explaining what data we collect and how it's used
• The account remains locked until the parent approves via a secure link
• If consent is declined, we schedule the account for deletion after 14 days
• If the parent does not answer within 14 days, the request expires and the account stays locked until someone asks us to delete it

9.3 Parents' Rights

As a parent or guardian who has provided consent, you have the right to:

• Withdraw Consent: You can withdraw consent at any time. This will trigger account deletion with a 14-day grace period, and we will notify your child.
• Access Data: Request a copy of your child's data
• Delete Data: Request deletion of your child's account and all associated data

To exercise these rights, contact us at richard.whittle@equalex.com or use the link in the email we sent asking for your consent.

9.4 What We Collect from Minors

We collect the same kinds of data from a child as from any learner (see §2), plus a parent's or guardian's name and email address and the consent record. We do not collect any data for advertising purposes.

9.5 Reading Exposure Analytics

When you read chapters with vocabulary tracking enabled, we count how many times you encounter each vocabulary word and how long each word is visible on your screen. We use it to show your reading activity to you and to your teacher.

What we collect:

• Which vocabulary words appeared on screen while you were reading
• How long each word was visible (we pause the timer when you switch tabs)
• Which chapter you were reading
• The date of each reading session

What this tracking does not record:

• Your reading speed
• The content of what you read (only word identifiers)
• Screen recordings or eye tracking

The app separately remembers where you stopped in each text, and keeps a running score for each reading skill from your reading quizzes (see §2).

Who sees your reading data:

• You: your reading activity appears on your Progress page, and all of it is in the copy of your data you can download on the app's Transparency page
• Your teacher: once at least 5 learners in the class have read, your class's teacher or group leader can see, for each learner, the texts opened, the number of word views, when they last read and for how many minutes. They can also see totals for the class, whatever its size.
• No one else: Your individual reading data is never shared with third parties

Legal basis: Legitimate Interest — this data helps you track your vocabulary exposure as part of the educational service. You do not need to opt in separately.

Deletion: All reading exposure data is deleted when your account is closed.

10. Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit and at rest, access controls, and regular security reviews.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the platform.

12. Contact & Complaints

For questions about this policy or to exercise your rights:

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local data protection authority.