WORDGOAL PRIVACY POLICY

WordGoal is owned and operated by Roost Education Ltd (“Roost Education”, “WordGoal”, “we”, “us”, “our”).

• Roost Education Ltd
• Company number: 17456657
• Registered office: to be added
• Privacy contact: use the privacy request form in section 22 below

For family accounts and the running of WordGoal, Roost Education Ltd is generally the data controller. Where a school creates and manages pupil accounts for educational purposes, the school is normally the controller for that pupil information and we act as processor on the school's instructions. We remain a controller for things we do for our own purposes, such as account security, abuse prevention and running the service.

The UK's Children's Code expects services used by children to use high-privacy defaults, collect as little personal information as possible and share children's information only where there is a compelling reason. Those principles shape how WordGoal is designed.

Parents and family accounts

• name
• email address
• account and sign-in information
• subscription status (WordGoal is currently free while we finish pricing; no card details are collected yet)
• the children connected to the family account
• messages you send us
• account preferences

When paid subscriptions launch, card details will be handled by a specialist payment provider and WordGoal will not store full card numbers. We will update this policy before that happens.

Children using family accounts

• first name, and a surname where the adult provides one (used only to build a unique Player Name)
• the Player Name WordGoal creates from that name, with a number added if it is already taken
• a four-digit PIN, chosen by the adult and never stored in readable form
• school year (optional)
• chosen avatar and player customisation
• an internal WordGoal learner ID
• spelling progress, game activity and results
• XP, achievements and rewards
• words practised and spelling attempts
• Word DNA activity and clues used
• whether the activity happened at home or at school

A child added at home does not need an email address or password of their own. A parent can sign in and choose the child, or the child can sign in with their Player Name and four-digit PIN. Both routes open the same learner profile and the same progress.

School pupils

• first name, and a surname where the school provides one (used only to build a unique Player Name)
• Player Name and four-digit PIN issued by school staff
• year group
• school and class memberships
• an internal WordGoal learner ID
• learning and progress information

Pupils do not need a personal email address. Each pupil has a unique Player Name and a four-digit PIN issued by an authorised adult. PINs are stored using a secure one-way hash, plus a separately encrypted copy so an authorised teacher or parent can reveal a forgotten PIN. Sign-in works through an internal, non-public identifier that is never shown, searched, or used for email sign-in or password recovery.

Player Names and PINs give one consistent child sign-in route, whether the child is at school or at home. WordGoal no longer uses the earlier secret-word logins.

Learning information

To make WordGoal work we record words attempted, whether an answer was correct, spelling attempts, games completed, points and XP, playing time, progress, achievements, Word DNA support used, and whether learning happened at school or at home. This lets WordGoal remember progress and choose useful practice.

Technical and security information

• browser and device information
• sign-in timestamps and authentication events
• security events
• temporary anti-abuse records
• pseudonymised network information used for rate limiting (IP addresses are converted using a keyed one-way code and are not stored in readable form)

WordGoal does not need a child's precise location and we do not track children's location.

We do not ask children for a home address, personal phone number, personal email address, exact date of birth, precise location, photographs, health information or safeguarding information in order to play WordGoal.

Schools and parents should not enter sensitive information about a child into WordGoal unless we have provided a feature specifically for it.

A child may use WordGoal through a family, through a school, or both. WordGoal is designed so a child has one underlying learner profile rather than separate school and home records.

A parent can securely connect an existing school pupil profile to their family using a one-time connection code, which works once and expires after 10 days. We never match children automatically by name or school — a secure code and parent confirmation are always required.

Connecting a learner does not open everything up: parents do not get school administration information, teachers do not get parent account information, and access stays controlled by the relevant family, school and class relationships.

• create and run WordGoal accounts
• provide spelling games and educational content
• remember a child's learning progress and choose suitable practice
• let children carry on learning between school and home
• let parents and teachers see appropriate progress information
• manage schools, classes and family memberships
• provide subscriptions and payments in future
• provide support and diagnose technical problems
• protect accounts and prevent misuse
• meet legal obligations and improve WordGoal

We do not use children's information for behavioural advertising and we do not sell children's personal information.

WordGoal uses a child's previous spelling activity to decide what practice helps most — spotting words that need more work, choosing a spelling clue, showing relevant Word DNA support and tracking when a word is mastered. This supports learning. It is not used to make legal or similarly significant decisions about a child, and never for advertising.

• Contract — to provide the WordGoal service an adult has asked for, including running a family account.
• Legitimate interests — to provide, secure and improve WordGoal, giving particular weight to children's rights and best interests. Examples: maintaining a learning profile, protecting accounts from abuse, service security.
• Legal obligation — where the law requires us to keep or process information, such as accounting records.
• Consent — for optional things such as marketing emails or any non-essential cookies. Consent can be withdrawn.

For pupil information provided through a school, the school decides the lawful basis for its educational processing and we act under our agreement with the school.

Children's information is private by default. Depending on how WordGoal is used, it may be available to:

• the child
• their parent or carer
• authorised teachers and school staff for their own school and classes
• authorised WordGoal personnel where needed to run or support the service
• service providers acting on our behalf

One family cannot reach another family's children. One pupil cannot reach another pupil's profile. Children cannot search for other children, and there are no public child profiles.

We use specialist providers for cloud hosting, our database and authentication, email delivery, read-aloud speech, security monitoring and technical infrastructure. WordGoal's read-aloud voice is produced by sending the spelling word or sentence to a speech service — no child's name or profile information is sent with it.

Providers may only process information where necessary to provide their service to us, under appropriate contract and security terms. We will publish a list of key providers alongside this policy; you can request the current list at any time from the form in section 22. We do not give children's personal information to data brokers or advertising networks.

Some providers may process information outside the United Kingdom. Where that happens we rely on an appropriate legal mechanism under UK data protection law, such as UK adequacy regulations or UK-approved contractual safeguards, and we review those arrangements before relying on them.

• encryption in transit, and encryption at rest through our infrastructure providers
• secure authentication and generated pupil player names
• PINs stored as secure hashes, with a separately encrypted copy only adults can reveal
• database-level access controls and role-based permissions
• pseudonymous internal learner identifiers, separated from sign-in identities
• rate limiting and brute-force protection
• security event monitoring and restricted administrative access

Two-factor authentication is available on our administrative tooling and we are in the process of making it compulsory for privileged access; until that is complete we do not claim it is enforced for every administrator.

When an authorised adult changes a pupil's PIN, the old PIN stops working. A pupil already signed in on another device can in some cases stay signed in for up to an hour before being asked to sign in again.

No internet service can promise absolute security, but WordGoal is designed to hold as little children's information as possible and to limit who can reach it.

• Sign-in attempt security records: about 24 hours.
• Security event records: up to 180 days, longer only where needed to investigate an incident.
• One-time family–school connection codes: single use, expiring after 10 days.
• Learner profiles and learning progress: kept while the relevant family or school account is active, then deleted or anonymised.
• Account information: kept while the account is active and for a short period afterwards to complete deletion, resolve disputes or meet legal duties.
• Financial records: kept longer where UK tax or accounting law requires it.

We are finalising our exact deletion timetable, including how quickly deleted information disappears from backups; we will state those periods here once they are confirmed. We do not keep children's information indefinitely just because storage is available.

Parents can remove a child from their family in the Family Zone, and can ask us to delete a child profile or the whole family account by emailing the privacy address above. Schools manage pupil access through their own WordGoal school area and arrangements with us. Self-service full-account deletion is not yet built into the app, so account deletion is currently handled by request.

When an account or learner profile is deleted we delete or anonymise the associated personal information unless we have a lawful reason to keep something. Where information came from a school, requests about the school's records may need to go to the school as controller. Removing a child's school membership does not require deleting their family profile.

You can ask for a copy of the personal information we hold about you or your child where you are entitled to it, using the privacy request form in section 22. Parents and teachers can already view and print progress reports inside WordGoal; a full self-service data download is not yet available, so we handle those requests manually. Schools can request pupil information in line with their agreement with Roost Education.

• access your personal information
• correct information that is wrong
• ask for deletion
• restrict how information is used
• object to certain processing
• receive certain information in a portable format
• withdraw consent where processing relies on consent
• complain about how information has been handled

Children have these rights themselves; parents or carers may exercise them on a child's behalf where appropriate. Use the privacy request form in section 22. We may need to check who you are before we share or change personal information.

Where a school provides WordGoal to pupils, the school normally decides why pupil information is used for school purposes. If your question is about information your school entered or viewed, contact the school directly — we will help schools respond to data protection requests. When a pupil profile is connected to a family account, permissions stay separate, so linking does not give either side unrestricted access.

WordGoal uses only what it needs to keep you signed in, keep the service secure and remember essential settings, such as which player a parent last chose. We do not currently use analytics or advertising cookies. If we add anything non-essential and UK law requires consent, we will ask first. We never use advertising cookies to profile children.

We may send adults information about WordGoal where they have asked for it or another lawful basis allows it, and they can unsubscribe at any time. We never use children's learning data to market to them.

• collect as little child information as possible
• high-privacy settings by default
• no child email addresses required
• pupils cannot search for other children
• no public child profiles
• no location tracking
• no targeted advertising
• pseudonymous internal identifiers
• privacy explained in child-friendly language
• clear routes for children, parents and schools to raise concerns

These reflect the ICO's Children's Code on data minimisation, high-privacy defaults and transparency.

Please contact us first using the form in section 22. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

We may update this policy as WordGoal develops or the law changes, and we will update the date at the top. Where a change significantly affects how we use personal information, we will take reasonable steps to tell affected users.

Send a privacy question or request here and it goes straight to the WordGoal team at Roost Education. We aim to reply within one month, and sooner where we can.