Privacy at Learn Rally

What we collect

Parents: your email address, a password or sign-in code managed by Supabase Auth, and the settings you choose (daily goal, notifications, theme).

Children: only what the learning flow needs — a nickname you choose, a grade, an avatar, and learning records (lessons, answers, XP, streaks, placement results). We never ask a child for an email address or any other contact detail. Please use a nickname, not a full name.

Free trial: trying a lesson without an account creates a guest learner on that device, with no name or email, and a cookie that keeps its progress for up to 30 days. A parent can create an account to keep that progress.

Support: if you write to us we keep your message, its category and the address you gave us to reply to.

Who handles it

Supabase stores the database and accounts. Vercel serves the app. Resend delivers email. Cloudflare Turnstile checks the sign-in, sign-up, account recovery and support forms, and the free trial, for automated abuse. Your browser contacts Cloudflare when one of those pages loads, and Cloudflare may set its own cookies while it checks.

We do not run ads, sell data, or show one child's writing to another child. There is no chat and no public user content.

Cookies and tracking

Learn Rally sets only first-party cookies that it needs to run: your sign-in session, the learner you chose, the theme, paired devices and the free-trial guest.

We do not run advertising trackers, session replay, heatmaps or background key logging. Typing activities that use our new capture system temporarily record only character insertions, end-of-text Backspace and line breaks inside the typing exercise. The server uses these events to check the copied text, accuracy and corrections; it cannot verify physical finger technique. Events are not sent to analytics or operational logs.

How long we keep it

Learning records stay while the account is active so progress, reports and sibling history keep working.

For the new Typing capture system, temporary exercise events and copied text are available only to the service for validation and retry. They are purged after finalisation and its 24-hour recovery window. Compact typing results remain with learning records. The new system is not yet enabled.

When you ask us to delete the family account we remove the live records. Copies inside encrypted backups can take up to 30 days to age out; they are never restored to production except to recover the service.

Messages sent through the support form are kept with the reply address you gave us, apart from your account, so deleting the account does not remove them automatically. Write to us through Support if you want one removed.

Your choices

You can change the daily goal, notification emails and devices from Settings at any time.

You can request deletion of the whole family account from Settings → Delete account, or through Support if you cannot sign in.