← Back to Home

Privacy Policy

Last updated: May 9, 2026

This policy includes our approach to children's privacy and parental consent for users under 16 and our reading exposure analytics.

1. Data Controller

2. Data We Collect

When you use WordRunner, we may collect the following information:

• Account Information: Name, email address, and authentication credentials when you create an account
• Date of Birth: To verify whether you are old enough to consent on your own behalf (16 or older). We only store the date.
• Parent/Guardian Information: For users under 16, we collect a parent or guardian's name and email address to obtain and manage consent
• Learning Data: Your vocabulary progress, quiz results, XP earned, and learning statistics
• Usage Data: How you interact with the platform, session duration, and feature usage
• Technical Data: Device type, browser information, IP address, and timezone for security, consent verification, and service improvement
• Reading Exposure Data: Which vocabulary words you encounter while reading and how long each word is visible on screen. See §9.5 for details.

3. How We Use Your Data

We use your data to:

• Provide and personalize the WordRunner learning experience
• Track your vocabulary progress and optimize spaced repetition
• Enable teachers and administrators to monitor student progress (if applicable)
• Improve our platform and develop new features
• Communicate with you about your account and updates
• Ensure security and prevent abuse

4. Legal Basis for Processing

Under the Swiss Federal Act on Data Protection (DSG) and GDPR, we process your data based on:

• Contract Performance: To provide the learning services you signed up for
• Legitimate Interests: To improve our services and ensure platform security
• Consent: For optional features and marketing communications

5. Data Sharing

We do not sell your personal data. We may share data with:

• Service Providers: Google Cloud (hosting), Firebase (authentication and database), Resend (email delivery)
• Educational Institutions: If you are part of a school cohort, your teacher/administrator may view your learning progress
• Legal Requirements: If required by Swiss law or valid legal process

6. International Data Transfers

Your data is primarily hosted in Switzerland via Google Cloud. Some service providers may process data in other locations. We ensure appropriate safeguards are in place, including Standard Contractual Clauses where required.

7. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where retention is required for legal or legitimate business purposes.

Consent Records: To comply with Swiss commercial records requirements and demonstrate regulatory compliance, we retain parental consent audit logs for 10 years. These records include timestamps, consent decisions, and verification evidence.

8. Your Rights

Under Swiss data protection law and GDPR, you have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data ("right to be forgotten")
• Data Portability: Receive your data in a structured format
• Objection: Object to certain processing activities
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at richard.whittle@equalex.com.

9. Children's Privacy & Parental Consent

WordRunner is designed for learners of all ages, including students under 16. We take children's privacy seriously and comply with Swiss DSG and EU GDPR requirements.

9.1 Age Verification

When creating an account, we ask for date of birth to determine whether parental consent is required. If you are under 16, you cannot use WordRunner until a parent or guardian has approved your account.

9.2 Parental Consent Process

For users under 16:

• We collect a parent/guardian's name and email address
• We verify the parent's email through a confirmation code
• We send the parent a consent request explaining what data we collect and how it's used
• The account remains locked until the parent approves via a secure link
• If consent is declined, we schedule the account for deletion within 30 days

9.3 Parents' Rights

As a parent or guardian who has provided consent, you have the right to:

• Withdraw Consent: You can withdraw consent at any time. This will trigger account deletion with a 14-day grace period, and we will notify your child.
• Access Data: Request a copy of your child's data
• Delete Data: Request deletion of your child's account and all associated data

To exercise these rights, contact us at richard.whittle@equalex.com or use the consent management link in your original approval email.

9.4 What We Collect from Minors

We collect only the minimum data necessary for the educational service: account credentials, learning progress, and quiz results. We do not collect location data, social connections, or any data for advertising purposes.

9.5 Reading Exposure Analytics

When you read chapters with vocabulary tracking enabled, we count how many times you encounter each vocabulary word and how long each word is visible on your screen. This helps you understand which words you have seen most often during reading.

What we collect:

• Which vocabulary words appeared on screen while you were reading
• How long each word was visible (we pause the timer when you switch tabs)
• Which chapter you were reading
• The date of each reading session

What we do NOT collect:

• Your reading speed or comprehension scores
• How far you scrolled on the page
• The content of what you read (only word identifiers)
• Screen recordings or eye tracking

Who sees your reading data:

• You: Your reading exposure appears on your profile page
• Your teacher: Can see aggregated reading patterns for the whole class (never individual student data — we require at least 5 students before showing any group statistic)
• No one else: Your individual reading data is never shared with third parties

Legal basis: Legitimate Interest — this data helps you track your vocabulary exposure as part of the educational service. You do not need to opt in separately.

Deletion: All reading exposure data is deleted when your account is closed.

10. Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit and at rest, access controls, and regular security reviews.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the platform.

12. Contact & Complaints

For questions about this policy or to exercise your rights:

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local data protection authority.