Privacy policy

Last updated October 19, 2026

This policy covers the Learning Breaks app for Android, the Learning Breaks SDK that games use, the parents' pages and the developer portal on this website, and the rest of this website. It says what we collect, why, who else handles it, how long we keep it and how to delete it. We have tried to write it so a busy parent can read it in one sitting.

1. Who we are

Learning Breaks is made and run by Eynon Software, LLC, an Ohio limited liability company ("we", "us"). We are the operator responsible for the information described here, including information about children. You can contact us about this policy, or about a child's information, at:

For help using Learning Breaks, you can also write to support@learningbreaks.com.

2. The short version

• Children never have accounts. We never ask for a child's full name, age or contact details; a parent chooses a nickname for each child.
• A child's answers are checked on the phone. What a child types or says is never sent to us, and never to a game.
• A child's settings and homework are set up on this website by a grown-up who has signed in. A phone linked to that child only downloads them.
• Worksheet photos are sent to Anthropic, whose AI reads the questions. You can cover names on the photo before it is sent, and Learning Breaks doesn't keep the photo after it has been read. Anthropic ordinarily deletes what it receives through its API within 30 days, with exceptions set out in its own policies. Nothing written by AI reaches a child until the grown-up approves it.
• Before a child can get homework a grown-up made on this website, its words, sentences, meanings, problems and name are sent to Anthropic, whose AI checks that they suit children. Anything it flags as possibly unsuitable is reviewed by a person at Eynon Software, who sees only the flagged text, not the child's nickname or the grown-up's email address.
• Learning Breaks does not collect advertising identifiers, hardware identifiers, device model information, or persistent IP logs. It uses revocable pairing credentials to authenticate linked devices.
• A child's progress - for each word, letter or math fact, whether it was right on the first try - reaches us only if a parent turns on "save progress online" for that child and confirms by email, and only that parent sees it.
• Each email inbox has one account. Forms on this website that send email run a short check in your browser to keep bots out, using our own code: no cookies, and nothing from other companies. Part of it looks at how the page was used; only counts and timings are sent, never what you typed or where you pointed, and they are not kept.
• Until November 30, 2026, to look into misuse of our sign-in and sign-up forms, we keep a record of each email we send - the address, the kind of email, and whether it bounced or was reported as spam, never the message itself - for 30 days (section 5).
• No third-party ads in the Learning Breaks app, and we do not sell or rent anyone's information.
• You can delete what we hold at any time on this website, as described on our delete my data page.

3. Children

Learning Breaks is used by children, and set up by their parents and caregivers. We never ask for a child's full name. What a parent sets up for a child on the website - a nickname, grade, reading level, homework and, if the parent turns it on, progress - is information about that child, kept under the parent's account and handled with the care we describe here.

• Children never create an account, sign in, or type an email address.
• A parent sets each child up on this website with a nickname, a grade and other settings, and links the child's phones or tablets with a code. We keep only the name the parent gives each phone and the day it was linked (see section 5).
• What a child types, their answers, what they read and like, the games they play, and any lists or cards they make themselves stay on the phone (see section 4). The payout tokens a phone spends on a game carry nothing that identifies the child, the family or the phone (see section 5).
• Progress - for each word, letter or math fact, whether it was right on the first try, and the day; day totals; and lesson totals - reaches us only if a parent turns on "save progress online" for that child and confirms by email (see section 5).
• Learning Breaks does not collect advertising identifiers, hardware identifiers, device model information, or persistent IP logs. It uses revocable pairing credentials to authenticate linked devices (see section 5). Nothing the app sends us about games or breaks carries an id for the phone.
• A child's answers are checked on the phone, and what a child types or says is never sent to us.

If you believe we hold something that identifies a child and should not, write to teynon@eynon.software and we will delete it.

4. What stays on the phone

This information is stored on the phone. Except for the limited progress a parent chooses to save online (section 5), we don't receive it:

• everything a child types, and every answer with whether it was right (if a parent turns on "save progress online", the first-try results, day totals and lesson totals described in section 5 are also sent to us);
• lists and cards a child makes themselves, if the parent allows it - these are never sent to us;
• what a child reads and the choices they make on the reading shelf;
• the break activity log: which games asked for a break, and why a break did or didn't happen (if a parent turns on "save progress online", only each day's count of learning breaks given and refused, and of No sound presses, is sent to us, as described in section 5).

They are deleted when the app is removed, or with "Clear this phone" in the app. The app keeps them out of the phone's cloud backup and out of transfers to a new phone.

Words and questions are read aloud by the phone's own text-to-speech engine. Whether that engine uses the internet depends on the phone's settings, not on Learning Breaks.

5. What reaches our server, and why

Checking a game is registered

Before a break, the app checks that the game asking is registered with us by looking it up by its publisher id. If the app refuses a break because a game isn't registered properly, it tells us the game's publisher id, package name, signing certificate and the reason, so the game's developer can fix it. Neither request carries anything about the phone or the child. Like any request, each reaches us over the phone's internet connection, and we don't log its IP address. Breaks reach us only as anonymous payout tokens, described next.

Paying game developers: payout tokens

Each family has a share set aside for the games its children play, and payout tokens are how that share is divided between games. A phone linked to a child asks us for that family's payout tokens, using its pairing credential. We check the family has tokens left this month and count how many its phones have taken; that count, against the parent's account, is all we keep about it. The tokens are "blind-signed" (a cryptographic method, RFC 9474): we sign them without seeing them, so we cannot recognize a token later or tell which family it came from.

When a game hosts a break, the phone sends us tokens for that game. That request carries no account, pairing credential, cookie or anything else about the family, the child or the phone. Like any request, it reaches us over the phone's internet connection, and we don't log its IP address: our server log notes only when it arrived, not who sent it or what it carried, and our rate limits keep its IP address only in hashed form, briefly (section 10). We keep only a fingerprint of each token, so it cannot be used twice, and add it to the game's total for the month. A game's developer sees only those monthly totals for their game, and a month with fewer than 20 tokens is not shown on its own but carried into the next. Nothing about a child is involved at any point.

Reports about a game

If you report a game from the Games page on this website, we receive the game, the reason you chose, and anything you typed in the details box (up to 500 characters). We keep nothing about you or the phone it came from. Only we read the details you type; the game's developer never sees them.

A grown-up account, if you create one

Setting up children and their homework, and the developer portal, need a grown-up to sign in on this website. We handle sign-in ourselves: no other company is involved, apart from our email provider, which delivers the link. We keep your email address, so we can email you a one-time sign-in link, and any passkeys you register. Parents and developers sign in with either one. A passkey never leaves your device; what we store cannot be used to sign in as you anywhere. If your account has recovery codes from the developer portal, we keep them, in hashed form, until you delete your account; you do not need them to sign in. While you are signed in on this website, we keep a session record with your IP address and your browser's user agent.

Keeping bots out, and limits

One account per inbox. Some email services deliver several spellings of an address to the same inbox: you+anything@example.com reaches you@example.com, and Gmail ignores dots and treats googlemail.com as gmail.com. So that one inbox cannot become many free accounts, we keep a simplified form of your email address with your account - lower case, without anything after a "+" and, for Gmail, without dots - and use it to find your account. Signing up or signing in with another spelling of your address signs in to the account the inbox already has, and the sign-in link goes to the address that account was made with. The simplified form is deleted with your account.

A check that runs in your browser. Before a form on this website sends an email - signing up, asking for a sign-in link, or inviting someone to a team - your browser works through a short calculation (a "proof of work") while the page says "Checking you're a person…". It usually takes about a second. It runs in your browser using our own code: it sets no cookies, stores nothing on your device and loads nothing from other companies, and it needs JavaScript to be on. Our server keeps a record of each finished check, which says nothing about you, only so that it cannot be used twice. The same forms have a hidden box that people never see; when something fills it in, we send no email. We count how often these checks stop a request, without anything about who sent it. We don't accept sign-ups from, or send sign-in links to, throwaway email services that hand out addresses for a few minutes.

How the page was used. The forms that send email also check, in your browser, how the page was used - whether taps, clicks and typing came from a person, how the pointer moved, and the timing - to tell people from automated programs. Only a short summary is sent with the form: counts and timings, such as how many keys were pressed in the email box and how evenly, never what you typed or where you pointed. It is used only for that check and is not kept: our server reads it, decides, and discards it, and counts only how often the check stopped a request, without anything about who sent it. Nothing about it is stored on your device. When the check is unsure, your browser does a longer calculation instead, which can take a few seconds. Using autofill, pasting, a password manager or only the keyboard is not, by itself, treated as automated.

Busy times. Sign-ups may pause briefly when many arrive at once. Then anyone asking for a link to an inbox whose account has never been signed in to is told "We're getting more sign-ups than usual. Please try again in a little while.", and people who have signed in before still get their sign-in links. For this we count how many links went to such inboxes in the last hour and the last day, without anything about who asked or which inbox, and delete those counts within 25 hours.

Limits on sign-in links. We send at most one sign-in or sign-up link to an inbox every 10 minutes, and at most 4 in 24 hours to an inbox whose account has never been signed in to (10 once it has). If you ask again sooner, the page tells you when the last link went and when you can send another. From one internet connection, we send links to at most 10 new inboxes an hour and 30 a day. For this we keep, in our server's short-term store (its cache), the times links went to each inbox and, for each connection, which inboxes it asked for links to and when - only in a scrambled form (a keyed hash), never the email address or the IP address itself. We keep them for 24 hours after the last link and then delete them within a day. We count how often these limits hold a link back, without anything about who asked.

Daily limits. Each inbox can, each day (UTC), have up to 3 worksheet photos read, ask for example sentences 10 times, and have 200 homework items checked; in the first 7 days after its account is made, 1, 5 and 100. Each account also has a monthly limit on what its AI use may cost us; when it is reached, reading worksheets, writing sentences and checking homework pause for that account until the next month. We work these out from the records of AI use described below, and keep nothing more for them. When a limit is reached, the website says so: you can type the words or sentences yourself, and homework still waiting to be checked waits as "Checking…" and finishes the next day.

Addresses that bounce or complain. When an email we send cannot be delivered because the address does not exist, or the person who receives it marks it as spam, our email provider tells us. We then keep the simplified form of that address, which of the two happened, how many times and when, on a list of addresses we don't email, and we send nothing to it - no sign-in links, consent emails or notices. Anyone who asks us to email it is told "We can't send email to that address." We keep it for 2 years after the last bounce or complaint, or until you ask us to remove it.

"Didn't ask for this?" Every sign-in link, sign-up link, team invitation and email asking a parent to confirm saving progress ends with "Didn't ask for this? Tell us and we'll never email this address again." Its link works for 30 days and opens a page with a button, "Stop emails to this address"; opening the page changes nothing until you press the button. These emails also carry a standard unsubscribe link, which mail programs such as Gmail show as an unsubscribe button, and using it does the same. When you do, we keep the simplified form of the address, that you asked us to stop, and when, on our list of addresses we don't email, until you ask us to remove it. Anyone who asks us to email that address afterwards is told "This address asked us not to email it. To use it, write to support@learningbreaks.com."

A record of each email we send. Until November 30, 2026, to look into misuse of our sign-in and sign-up forms, we keep a record of each email we send: the address it went to and its simplified form, the kind of email (such as a sign-in link, a sign-up link or a team invitation), when we sent it, our email provider's message id for it, the account the address belongs to if it has one, and whether it bounced or was reported as spam. We never keep the message itself: not its subject, its words or its link. Each record is deleted 30 days after the email was sent. No record is made of email we send after November 30, 2026. Deleting your account deletes the records of email sent to it and to its address. A record of an email sent to the address after the account is deleted, such as the email saying a banned account has been closed, is kept until its 30 days are up.

Earlier versions of the app could sign a grown-up in on a phone with a code we emailed. The app no longer does. For a phone signed in that way we keep the date it signed in and when it last asked us for something, and nothing about the phone itself. You can sign it out from your account page, and deleting your account signs out every phone.

Children, their settings, and linked phones

On this website, a signed-in grown-up adds each child with a nickname they choose, and sets what the app does for that child: grade, how much they read, what to focus on, levels and whether they move up automatically, the lesson plan, which library lessons are on, the reading timer, learning break limits, No sound, a daily goal, and whether the child may make their own lists and cards on the phone. We do not ask for a child's age, and there is no box for notes about a child. These settings and the homework sets put on the child are sent to the phones and tablets linked to that child, which check for changes; the phone never changes them.

A grown-up can also ask for a level check: the next time the child opens Learning Breaks, the app asks a few spelling and math questions that set where practice starts. We keep when the grown-up asked, and when a linked phone tells us it has done the check. We do not receive the answers or the level it sets; those stay on the phone.

To link a phone, the grown-up makes an eight-character code on the child's Phones page, optionally names the phone ("Kitchen tablet"), and types the code into the app. The phone then gets its own key for that child: a pairing credential that tells our server which linked phone is asking, and that the grown-up can revoke at any time by unlinking the phone. We keep only the key in hashed form, the name the grown-up typed, and the day it was linked: not the phone's model, not an id from it, not when it last checked, and not where it is. Checking for changes records nothing about the phone or the child; it only adds one to an hourly count of requests (section 10). Codes are kept in hashed form, work once, and stop working after 10 minutes. A one-time code brings a single set onto a phone that is not linked, once, within 7 days.

The grown-up can unlink one phone at a time; the others keep working. When unlinking, they can also ask for the phone to be cleared: we then keep only the hashed key for 30 days, and when that phone next checks in it is told to erase what it holds for that child. A phone that never checks in again is not reached. A phone can also unlink itself from the app.

Worksheet photos, example sentences and checking homework suits children

On the homework pages, a grown-up can make a homework set from a photo of a worksheet. Worksheet photos are sent to Anthropic, the company whose AI reads the questions. Before the photo is sent, the grown-up can draw black boxes over names, faces or handwriting; the boxes are painted into the photo in their browser, and only that covered copy is uploaded. Our server then removes the details a phone stores inside a photo, such as where and when it was taken and the phone's model, and passes the photo to Anthropic's AI service, which is told to leave out names and other personal details. Learning Breaks doesn't keep the photo after it has been read: it passes through our server without being saved, and the temporary copy made while it uploads is deleted by the time the request ends. What we keep is the homework set the grown-up saves. Anthropic ordinarily deletes what it receives through its API within 30 days, with exceptions set out in its own policies, and does not use it to train its models by default. A grown-up can also ask for example sentences for a spelling list, and the words and any meanings are sent to Anthropic the same way. Anthropic processes these requests as our service provider (see section 9).

Nothing written by AI reaches a child until the grown-up approves it. Every sentence or meaning AI wrote waits until the grown-up approves it, changes it, asks for another or deletes it, and a set read from a photo waits until the grown-up confirms they checked it against the page. We record which grown-up approved each one and when. Until then the set cannot be put on a child or given a code, and a set already on a child stays off their phones.

Every homework set a grown-up makes on this website is checked before a child can get it. The words, sentences and meanings a grown-up types or that AI writes, the words and problems read from a worksheet photo, and the name the grown-up gives the set, are sent to Anthropic, whose AI checks that they are suitable for children and don't contain personal information such as a full name, an address, a phone number, an email address or a school's name. We send only that text, whether it is a spelling list or a math worksheet, and the grade set for the youngest of the children it is for (or, before it is given, of the grown-up's children), if one is set. We don't send a child's nickname or other settings, or the grown-up's email address; anything typed into the homework itself, including its name, is sent as it was typed. Anthropic handles it on the same terms as worksheet photos: it ordinarily deletes what it receives through its API within 30 days, with exceptions set out in its own policies, and does not use it to train its models by default. Each item, and the name, is checked again whenever its text changes.

Until an item and the set's name have been checked, the set cannot be put on a child or given a code. If the check finds what looks like personal information, the grown-up is asked to remove it (or rename the set), and the set cannot be given until they do. If it finds something that may not be suitable, the item or name is held and reviewed by a person at Eynon Software, who sees only the held text, the reason it was held, whether it is a spelling list or a math worksheet, and the grade it was checked for: not the child's nickname, the grown-up's email address or which account it belongs to. The reviewer allows it or removes it - a removed item comes out of the set, and a removed name is replaced with "Spelling list" or "Math worksheet" - and may leave a short message that only the grown-up sees; meanwhile the grown-up can change or remove it themselves. We keep the result of each check, and which reviewer decided about a held item and when, with the item. They are deleted when the item is changed or deleted, or when the set or the account is deleted; the record that a reviewer removed an item, without its text, stays with the set until the set is deleted.

Please photograph the worksheet as it was handed out, and cover a child's name before sending.

Keeping track of what AI and email cost

We keep a record of AI and email use for each grown-up account: each time AI reads a worksheet photo, writes example sentences or checks that homework suits children for that account, and each email we send to it, we note which feature it was, when, how much text the AI processed, how many homework items a check covered, and what it cost us. The record never includes the content: not the photo, the words, the sentences, the homework or the email, and nothing about a child. We use it to control our costs and prevent abuse, and we can pause these AI features for one account or for everyone. While reading worksheets or writing sentences is paused, the website says so and you can type the words yourself; while checking is paused, new or changed homework waits as "Checking…" and doesn't reach a child until checking resumes. These records are kept for 13 months (section 10).

Saving progress online, only with a parent's consent

"Save progress online" is off for every child until a parent turns it on for that child. To turn it on, the parent reads what is collected, confirms they are the child's parent or legal guardian, and opens a link we email to their account's address and presses its button. A day later we email them again to say it is on and how to turn it off. Neither email names the child or carries any progress. When what we say about progress changes, saving stops until the parent agrees again.

With it on, the phones linked to that child send us: for each word, letter or math fact the app asked, whether it was right on the first try, and the day; for each day, minutes practiced, questions answered, learning breaks given and refused, and how often No sound was pressed; and for each lesson, how many of its words or facts are learned. The word is the one the app asked - from our library or the parent's own lists - never what the child typed, and we refuse anything else. That is all: not the child's answers or misspellings, nothing the child types, no times of day, no photos or recordings, not what they read or like, not which games they play, not lists or cards they made themselves, and no advertising or hardware identifiers or the phone's model. We note which linked phone sent each result, by its pairing credential, so that two phones' results add up. It is used to show that parent how the child is doing, and to put the child's progress back on a phone the parent links later. Only that parent sees it, on the child's Progress page. We never share it or sell it, never put it in an email, and never send it to Anthropic. Our hosting provider stores it for us and does nothing else with it.

On the Progress page a parent can see all of it, delete a day or all of it, and turn saving off, which stops it being collected and deletes everything it kept. Deleting the child or the account deletes it too. Each of these removes it immediately from our live database; copies in our database backups expire within 35 days. We keep a record of each consent - when it was given, confirmed and turned off - until the child or the account is deleted.

What we use it for, and our legal basis

We use this information only to run Learning Breaks: to check that games are registered, run the parents' pages and the developer portal, send a child's settings and homework to the phones linked to them, read worksheets, check that homework suits children, show a parent the progress they turned on and put it back on a newly linked phone, work out what each game has earned from payout tokens, review reports about games, prevent abuse, and answer you when you write to us. We do not use it for advertising, and we do not sell it. Where the law asks for a legal basis, it is that the processing is needed to provide the service you asked for, or our legitimate interest in keeping it working, fair and safe.

6. What games receive

A game that uses Learning Breaks learns only whether a break happened (finished, ended by the time limit, or didn't really happen) and an opaque token that means nothing to it. It never receives the questions, the answers, whether they were right, the subject, how long the break took, or anything about the child. Breaks open in the Learning Breaks app's own screen, so that material never enters the game. The SDK inside the game makes no network calls of its own.

Games are made by other companies, and each has its own privacy policy. Learning Breaks does not control what a game itself collects. If a game asks your child for personal information, please report it from the Games page on this website.

7. Game developers' information

If you use the developer portal, we hold:

• your email address, when it was verified and when you last signed in;
• your passkeys, if you add any (public keys only; the private key never leaves your device), and your emailed sign-in links and any recovery codes in hashed form;
• while you are signed in, a session record with your IP address and browser's user agent;
• your organization, its members and their roles, and invitations you send (including the invited email address);
• for a publisher: the legal name, country, postal address, support email, privacy policy address and website domain you give us, who accepted the publisher agreement and when, and our review decisions;
• your apps: package names, signing certificates, store listings and icons, break statements, monthly payout-token totals per game, and our moderation decisions and the messages exchanged about them.

We hold these so that every game on Learning Breaks has a publisher someone answers for.

8. This website and cookies

The public pages of this website (the home page, the games list, the pages for developers, this policy, the terms and the delete my data page) set no cookies, start no session, and load nothing from other companies: no analytics, no fonts, no trackers. The pages where you sign in on this website (the parents' pages and the developer portal) use two cookies: one keeps you signed in, and one protects forms from forgery. Both are strictly necessary for those pages to work. The check that runs in your browser before a form sends an email (section 5) is our own code, sets no cookie and loads nothing from other companies.

Our server receives the IP address of a phone or browser as part of each connection, because that is how the reply finds its way back. We don't write it to our logs: our server logs don't record visitors' IP addresses, and our error logs are kept for at most 14 days. To limit abuse, rate limits keep only a scrambled (hashed) form of the address, which is deleted within a day after the limit ends; the limits on sign-in links (section 5) keep a keyed hash of it, for 24 hours after the last link, then delete it within a day.

9. Who else handles data

We use a small number of service providers, who handle data only on our instructions:

On first run, the app asks Google Play for an age range on the phone, to choose where to start. That answer stays on the phone; nothing about it reaches us.

We do not share information with advertisers or data brokers. We may disclose information if the law requires it, or to protect children, our users or the service from harm.

10. How long we keep it

When one of these periods ends, we delete the information; we don't just hide it.

• Worksheet photos, sentence requests and suitability checks: Learning Breaks doesn't keep what it sends to Anthropic after it has been read, beyond the homework set itself and the result of each check. Anthropic ordinarily deletes what it receives within 30 days, with exceptions set out in its own policies (section 5).
• Children's nicknames and settings, and homework sets: until the grown-up changes or deletes them, deletes the child, or deletes their account. Only the current settings are kept, not earlier versions. When a grown-up last asked for a level check, and when a linked phone last did one, are kept with the child's settings. Who approved each AI-written sentence or meaning, and when, is kept with the set. The result of each suitability check, and which reviewer decided about a held item and when, are kept with the item until it is changed or deleted; the record that a reviewer removed an item, without its text, is kept until the set is deleted.
• Linked phones: the hashed key, the name the grown-up gave the phone and the day it was linked, until the phone is unlinked (by the grown-up or from the phone), the child is deleted, or the account is deleted. If the grown-up asks for a phone to be cleared, its hashed key alone is kept for 30 days, then deleted within a day.
• Pairing and one-time codes: a pairing code works once within 10 minutes and a one-time code once within 7 days. A code is deleted as soon as it is used, and within a day of running out.
• Saved progress: day totals and lesson totals are deleted automatically 12 months after we receive them. Right-or-not answers are kept while the child's phones still send progress, and deleted automatically 12 months after the last time one does. Everything is removed immediately from our live database when the parent turns saving off or deletes it, deletes the child, or deletes their account, and copies in our database backups expire within 35 days. The Progress page shows what will be deleted in the next 30 days, and on what date.
• Progress consents: the record of when consent was given, confirmed and turned off, until the child or the account is deleted. A request that is never confirmed is deleted within a day of its email link running out.
• Reports about games: anything typed in the details box is deleted 30 days after we have dealt with the report, and the rest of the report 12 months after it was sent. Nothing in them leads back to a phone. Our decisions about a game are kept, with the reason but without the reports.
• Payout tokens: a family's token count for a month is kept with the parent's account and deleted with it. The fingerprints of spent tokens are deleted within a day of the month's tokens expiring, 7 days after the month ends. Each game's monthly totals are kept with the game; they say nothing about any family or child.
• Games the app refused: what the app tells us when it refuses a game that isn't registered properly (section 5) is kept for 90 days.
• Grown-up and developer accounts: until you delete your account, or we ban it (below), including the simplified form of your email address we use for one account per inbox (section 5). For a developer, break statements and the apps they belong to are then kept without the developer's name, email or domain, because closed statements must still add up.
• Suspended accounts: if we suspend an account that breaks our terms, nothing is deleted. Until we reinstate it, the account can't sign in, no AI features run for it, and the phones linked to its children stop syncing: they get no settings or homework, send no progress and get no payout tokens, and show that the account is paused. When we reinstate it, everything works again as before.
• Banned accounts: if we ban an account for breaking our terms, we delete it as if its owner had, with every child, setting, linked phone, set, code, saved progress record and consent in it, and each phone linked to its children erases that child's information the next time it checks in. We send one email to the account's address saying it has been closed. We keep a ban record for 3 years, then delete it within a day: the date, our reason, who decided, and a scrambled form of the email address (a keyed hash, not the address itself), used only to stop the same inbox signing up again.
• Records of admin actions: which of our admins did what to an account in our admin panel (section 12), and when, with the account's number but no email address and nothing about a child, are kept for 3 years, then deleted within a day, including after the account is deleted.
• Sign-in links: an emailed sign-in link works once, for 15 minutes, and is deleted within a day of being used or running out.
• Sessions on this website: a session record, with your IP address and browser's user agent, ends when you sign out or after 2 hours without use, and is deleted within a day after that.
• Phones signed in by earlier versions of the app: until you sign the phone out from your account page, or delete your account.
• Team invitations: an invitation works for 7 days, and is deleted within a day of being accepted or running out.
• Records of AI and email use: which feature a grown-up account used (reading a worksheet photo, writing example sentences, checking that homework suits children, or an email we sent), when, and what it cost (never the content) are kept for 13 months, then deleted within a day. If you delete your account, the records that remain no longer show which account they belonged to.
• Records of email we send: until November 30, 2026, the address each email went to, the kind of email, when, our email provider's message id and whether it bounced or was reported as spam (never the message) are kept for 30 days after the email was sent, then deleted within a day. No record is made of email sent after November 30, 2026. If you delete your account, the records of email sent to it and to its address are deleted with it.
• Addresses that bounced or complained: the simplified form of the address, which of the two happened, how many times and when, for 2 years after the last bounce or complaint, then deleted within a day; sooner if you ask us to remove it. Deleting your account doesn't remove it, because it is what stops us emailing an address that can't or doesn't want to receive our email.
• Addresses whose owner asked us to stop emailing them: the simplified form of the address, that you asked, and when, until you ask us to remove it. Deleting your account doesn't remove it, because it is what stops us emailing you.
• Limits on sign-in links: the keyed hashes of inboxes and IP addresses, with the times links were sent, for 24 hours after the last link, then deleted within a day.
• Browser checks on forms that send email: the record that a check was used, which says nothing about you, is deleted within a day of the check expiring, 10 minutes after it was given.
• How the page was used: the summary sent with a form that sends email (counts and timings, never what you typed or where you pointed) is used for the check and not kept. We keep only hourly counts of how often the check stopped a request, which say nothing about anyone.
• Busy times: the counts of links sent to inboxes whose account has never been signed in to, which say nothing about anyone, are deleted within 25 hours.
• Counts of how busy our server is: hourly counts, such as how many emails we sent or how many requests we refused, say nothing about any person and are kept for 90 days.
• Rate limits: the hashed IP addresses we use to limit abuse are deleted within a day after the limit ends.
• Server logs: our server logs don't record visitors' IP addresses, and our error logs are kept for at most 14 days.
• Backups: deleted information may remain in our encrypted database backups for up to 35 days before those copies expire; we don't use backups to bring back deleted information in normal running.

We keep information longer only when the law requires us to, and only for as long as it requires.

11. Deleting your data, and your rights

You can delete your account, with every child, setting, linked phone, set, code, progress record and consent in it, on this website (sign in, then Delete my account), or delete one child on the Children page. A parent can look at, delete or turn off saved progress at any time on each child's Progress page, and unlink any phone on the child's Phones page. Deleting removes it immediately from our live database; copies in our database backups expire within 35 days. You can also write to us. Our delete my data page explains each way, and what is kept afterwards and why. Removing the app, or "Clear this phone" in the app, deletes everything stored on the phone.

If your address is on our list of addresses we don't email because it bounced or you marked our email as spam (section 5), or because you pressed "Stop emails to this address", write to us from that address and we will remove it.

Depending on where you live, you may also have the right to ask what we hold about you, to correct it, to object to how we use it, or to complain to a data protection authority. Write to teynon@eynon.software and we will answer.

12. Security

Connections to our server are encrypted. Secrets such as recovery codes, sign-in links, pairing and one-time codes, and linked phones' keys are stored only as hashes, and signing in on this website uses emailed links and passkeys rather than passwords. Access to our systems is limited to the people who run Learning Breaks. No system is perfectly secure. If a security incident affects your information, we will tell you as the law requires.

To run the service, help parents and act on abuse, the people who run Learning Breaks can see account details in our admin panel: a grown-up's email address, when the account was made and last signed in, how many children, phones and homework sets it has, what its AI use cost, our record of each email we sent (section 5), and, on that one account's page, its children's nicknames and settings and the names given to its linked phones. The admin panel doesn't show saved progress, and shows homework only as the held items a reviewer checks (section 5), without the account they belong to. Signing in to it takes a passkey as well as an email address. Each action taken on an account there, such as suspending it, unlinking a phone or sending a sign-in link, is recorded with who took it and when; the record names no child.

13. Changes, and contact

If we change what we collect or how we use it, we will update this page and the date at the top before the change takes effect. Questions about this policy, or about a child's information, go to us at the address in section 1, or by email to teynon@eynon.software.