Privacy Policy

1. Who we are

Lost in Learning is a website that gives UK primary school children maths practice, and lets a parent attach a reward to the effort they put in.

Lost in Learning is a business established in the United Kingdom. We are the "data controller" for the information described here, which means we decide what is collected and what happens to it. If you need our full legal details, for example to make a formal request or a complaint, email us and we will give them to you.

You can reach us any time at [email protected]. Our postal address is at the end of this page.

2. What we collect

Your account

When you register we collect your name, your email address and a password. The password is stored as a one-way hash, so nobody at Lost in Learning can read it or recover it for you. We also record whether you have confirmed your email address.

Your children's profiles

For each child you add, we store:

• the name you enter for them (see the note under Children's privacy about using a first name or a nickname);
• their school year group, which sets the difficulty of the questions;
• an avatar they choose from a fixed set of pictures we provide;
• whether the AI tutor is switched on for them;
• if you turn on child sign-in, a four digit PIN, stored as a one-way hash, alongside the family code for your household.

Learning activity

Every practice session records the year group, how many questions were asked, how many were right, the score, how long it took and when it finished. For each question we keep the topic, the wording of the question, the correct answer, what your child answered and whether it was right. This is what the progress screens are built from.

Worksheets you upload

If you use the worksheet feature, you upload a photo or PDF of your child's school maths worksheet. We never store the file. It is read once, in the moment, to write a fresh set of practice questions, and it is discarded when that request finishes - it is not saved to our servers, not even temporarily. What we keep is what we made: the generated questions, a short title, and a note of the topics covered.

A worksheet photo can show your child's name, school or teacher's marking. Since we do not keep the image, none of that is retained - but we would still encourage you to crop or cover your child's name before uploading.

Rewards

If you use the reward feature, we store the reward you have set up (what it is, the rate and the unit, for example pocket money or minutes of game time), the running balance your child has earned, and a record of each payout you mark as made.

AI tutor credits

If the AI tutor is used we keep a credit balance on your account and a line for each change to it: what happened, how much, the balance afterwards and a short description.

Technical information

Like almost every website, our server keeps a session record so you stay signed in as you move between pages. That record includes your IP address and your browser's user agent string (the browser and device type it reports). Our hosting provider also keeps standard server logs.

3. What we do not collect

It is worth being explicit about this, because a lot of children's sites do collect these things and we do not:

• No photographs of children. Avatars are chosen from a set of pictures we supply. The only upload anywhere on the site is the optional worksheet photo, and that is read once and discarded, never stored - see section 2.
• No email address, phone number or date of birth for any child.
• No location data. We do not ask for it and we do not derive it.
• No advertising, no ad networks and no advertising cookies.
• No analytics or session recording. There is no Google Analytics and no session-recording tool anywhere on this site. The one exception to "no tracking" is the Meta advertising pixel described in section 11, which only ever runs if you accept it.
• No card details. If we introduce paid features, payment will be handled by PayPal on their own systems. Card numbers will never reach ours.

4. Why we use it, and our legal basis

Under UK data protection law we have to have a lawful basis for using your information. Ours are these:

5. Children's privacy

This is a service for children, so we have tried to design it so that very little about a child is collected in the first place.

The account belongs to an adult. Only a parent or guardian aged 18 or over can register. Children do not create accounts, cannot change account settings and cannot reach anything outside their own practice and progress screens.

You decide what your child is called here. The name you enter is only ever shown back to your household. We would encourage you to use a first name or a nickname rather than a full name. Nothing on the site needs a surname.

Children are never contacted. We have no email address or phone number for your child, so we cannot message them and never will. All email goes to you.

No profiling, no advertising. We do not build advertising profiles, we do not run automated decision-making that has legal or similarly significant effects, and there are no third-party trackers on the site. The only automated processing is marking maths answers and, if you enable it, generating an explanation.

You are in control. You can see everything recorded against a child, switch the AI tutor on or off per child, turn child sign-in on or off, and delete a child profile entirely. Deleting a profile removes their practice history with it.

6. The AI tutor

The AI tutor is optional and switched off unless you turn it on for a particular child. When it is on and your child asks for help with a question they got wrong, we send the following to Anthropic, who provide the AI model:

• the wording of the maths question;
• the correct answer;
• the answer your child gave;
• the topic, and the year group, so the explanation is pitched correctly.

We do not send your child's name, your name, your email address, or any account or profile identifier. Anthropic receives a maths question and two answers, with nothing attached to say who it came from.

Anthropic acts as our processor for this. Under the terms of their commercial API, content sent through it is not used to train their models. We keep the explanation that comes back in a cache for up to 30 days so that the same question does not have to be sent again.

The tutor is also a conversation: after the first explanation your child can ask follow-up questions, and the messages they type in that chat are sent to Anthropic as part of the conversation, still without any name or identifier attached. The tutor is instructed never to ask for personal information and to steer the chat back to the maths; even so, it is worth telling your child that the chat is for maths questions, not for sharing things about themselves.

Spoken replies and the microphone

The tutor can read its replies aloud. To make the audio we send the text of the tutor's own reply - never your child's messages - to OpenAI, whose speech engine turns it into sound. Nothing identifying anyone is included, and under OpenAI's API terms content sent this way is not used to train their models.

If your child uses the microphone button to speak instead of typing, the speech-to-text happens through your browser's own dictation service (in Chrome, for example, that is Google's). We never receive or store any audio - what reaches us is the words, exactly as if they had been typed.

If you would rather none of this happened, leave the AI tutor switched off. Everything else on the site works exactly the same without it.

Worksheet reading

The optional worksheet feature also uses Anthropic. When you upload a worksheet we send Anthropic the image or PDF itself and your child's year group - never your child's name, your name, or any account identifier. Anthropic reads the sheet and writes new practice questions; under the terms of their commercial API, content sent through it is not used to train their models. We keep the generated questions; the uploaded file is discarded without being stored, as described in section 2.

7. Who we share information with

We do not sell your information, and we do not share it for anyone else's marketing. We do rely on a small number of suppliers to run the service. Each is bound to use the information only on our instructions.

We may also disclose information if the law requires it, or to establish or defend legal claims. If the business is ever sold or transferred, account information may pass to the new owner, who would be bound by this policy or one at least as protective.

8. Transfers outside the UK

Our servers are in Germany. Anthropic and PayPal are based in the United States, and Amazon Web Services and Cloudflare operate internationally. Where information goes outside the UK we rely on the safeguards recognised by UK law for those transfers, which in practice means standard contractual clauses together with the UK Addendum, or an adequacy decision covering the country concerned.

9. How long we keep it

• Account and child profiles: for as long as your account is open.
• Learning activity: for as long as the child profile exists, because it is what the progress screens show. Deleting a child profile deletes their sessions and answers.
• AI tutor explanations: cached for up to 30 days, then discarded.
• Uploaded worksheet files: not retained at all - read once and discarded in the same request. The generated questions are kept until you remove the worksheet or delete the child profile.
• Session records and server logs: a short period, for security and fault diagnosis.
• Records of payments, if paid features are introduced: six years, which is how long UK tax law requires us to keep them.

When you delete your account we remove your account and your children's profiles, along with their practice history and reward ledgers. Backups are overwritten on their normal cycle.

10. Cookies

We set one cookie of our own. It keeps you signed in and protects forms against cross-site request forgery. It is strictly necessary for the site to work, so it needs no consent and cannot be turned off without breaking the site.

We use no analytics cookies. The only other thing that can set anything on your device is the advertising pixel in the next section, and that requires your agreement first.

11. Advertising and the Meta pixel

When we are advertising Lost in Learning on Facebook or Instagram, our public pages offer you Meta's advertising pixel. Its only job is to tell us whether people who clicked an advert went on to register, so we can stop paying for adverts that do not work.

Nothing loads until you say yes. On a first visit your browser makes no request to Meta at all. The banner is ordinary text on our own page; the Meta script is only fetched after you press Accept. If you press "No thanks", nothing is loaded, then or on any later visit.

If you do accept, Meta receives your IP address, information about your browser, and the fact that you visited a page or completed registration. Meta is a separate controller for what it then does with that, and its own privacy policy governs it.

Three limits we hold ourselves to:

• The pixel never runs on the practice screens your child uses.
• We never send Meta any information about a child: no name, no year group, no scores.
• We do not use it to build advertising audiences from your child's activity.

You can change your mind at any time:

Change my advertising choice

Clearing your browser's site data for lostinlearning.uk has the same effect, and you will be asked again on your next visit.

12. Keeping it safe

The site is served over HTTPS. Passwords and children's PINs are stored as one-way hashes, never as readable text. Access to the account, and to everything under it, requires signing in, and each account can only ever reach its own children's data. We keep the software the site is built on up to date.

No system is perfectly secure, and we cannot promise otherwise. If a breach ever puts your rights at risk we will tell you, and the Information Commissioner's Office, as the law requires.

13. Your rights

Under UK data protection law you can ask us to:

• give you a copy of the information we hold about you and your children;
• correct anything that is wrong;
• delete it, which you can also do yourself at any time from your account;
• restrict or object to how we use it;
• send it to you or another provider in a portable format;
• withdraw consent for the AI tutor, which you can do yourself by switching it off. That does not affect anything done before you withdrew it.

You can exercise any of these by emailing [email protected]. We will respond within one month, and it costs nothing.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

14. Changes to this policy

If we change this policy we will update the date at the top of the page. If the change materially affects how we use your information, or your children's, we will email you before it takes effect.

15. Contact us