Privacy notice

Last updated 4 August 2026

Who we are, and the law we work under

Brainy is made by Fortbridge Technologies Ltd, a company registered in Nigeria. For the purposes of data protection law, Fortbridge Technologies Ltd is the data controller for everything described in this notice. You can reach us about anything on this page at brainy@fortbridge.app, and we aim to answer within seven days.

We work to the Nigeria Data Protection Act 2023 (NDPA), which is the law that governs us. Brainy is also used by families following the British and American curricula, so where the UK GDPR or the American COPPA rules would give someone a stronger right than the NDPA does, we apply the stronger one rather than the minimum. It is simpler to hold one high standard than three different ones.

Brainy is built for children in Basic 1 to Basic 6 and their equivalents, roughly ages 5 to 12. Every one of them is a child in the eyes of all three of those laws. That is the reason for the central design decision described throughout this notice: the child has no account, no password and nothing to sign in to. Nothing about a child is sent to us at all unless a parent switches on keeping their progress, and even then it is scores and coins, never anything they typed or got wrong.

Where a law requires a parent's involvement before a child's personal data may be processed, it is the parent who does every part of this: they open the account, they type their child's first name and age themselves, no child can sign in at all, and one tap in their own settings stops it and deletes what was kept. What we hold is the smallest set that solves a real problem for families rather than the largest we could justify, which is why their scores are kept and the questions they got wrong are refused.

Why we are allowed to hold what we hold

Every kind of data has to have a lawful basis behind it. Ours, in full:

What we collect

The account is yours, not theirs. A child has no account, no password and nothing to sign in to, and no version of Brainy will give them one. What we hold about them is deliberately short: the first name and age you typed, the class you picked, and their scores, all so your family comes back on the next tablet. Never what they typed, never the questions they got wrong, never a record of when they played.

The exception belongs to the grown-up rather than the child. When you set Brainy up you register: we store your email address, and your name and phone number if you give them. That is what your access is attached to, so it can be restored if this tablet is lost or replaced, and it is how a free place is held for a person rather than for whoever happens to be holding a code. It is the only reason it exists, and we write to you about your own access and nothing else.

If setup cannot reach us (no signal, or we are down), Brainy lets you carry on anyway and asks again in the grown-up area later, because an app sold on working offline should not refuse to start when it is offline. Nothing about your child is sent when it does reach us.

Keeping their progress

A web app added to an iPhone or iPad home screen gets its own storage, separate from Safari, so a family who set Brainy up in the browser and then installed it would open the icon and find an empty app. A new tablet has the same problem. The only way to fix it is for the progress to exist somewhere other than the device, which means uploading something about your child. We are not willing to do that quietly, so it is a switch you turn on.

On from the start, and off in one tap. We tried it the other way round, off until a parent found the switch, and it failed the people it was meant to protect: families registered, moved to the installed app or a second tablet, and were asked to set their child up again as though the account had never existed. A privacy default that produces that is not protecting anybody. So it is on, it is described plainly here and at setup, and Keep their progress in my account in the grown-up area turns it off and deletes what we held, immediately.

Moving from a browser to the installed app

This is the one moment the storage split actually bites, so the grown-up area offers two ways across and neither happens on its own:

• Sign in on the installed app. Nothing to prepare: their progress is already in your account, so signing in brings their name, class and scores across. If you had switched keeping off, the grown-up area offers a one-tap Bring their progress across instead, which turns it back on and uploads there and then.
• Move it with a file instead. Also one tap, and it uploads nothing at all. Brainy saves a backup file to your device, and the installed app reads it from the Restore a backup button on its first screen. Everything moves this way, including the session history we refuse to hold, because the file never leaves your hands. Treat it like the access code: anyone you send it to could restore it.

When it is on, we keep, per child:

• Their first name, age, curriculum and class
• A mastery score per skill: a number between 0 and 1 against a skill name like ng.maths.b3.add-3digit-regroup
• Stars, coins, XP, badges, streak, and which character and pet they chose
• Their settings: reading speed, session length, and so on

And we deliberately refuse to keep:

• Their session history: every quest, and the exact questions they answered wrongly
• A day-by-day record of when the tablet was used
• Which questions they have recently been shown

Those three are the difference between how far have they got and a log of what this child has been doing. The first is what you want back on a new tablet; the second is a record of a seven-year-old's mistakes, and it is not ours to hold. This is not a policy that lives only in a document: the server rejects an upload containing any of them, so a modified app cannot send them and a careless change on our side fails loudly rather than quietly starting to collect.

The visible cost, so it is not a surprise: a restored tablet has your child's mastery, coins and streak, but the weekly chart in the parent report starts again, and a question or two they saw recently may come round once more.

Turning it off (grown-up area → Access → the same switch) deletes what we were keeping, immediately. Nothing on the tablet changes. You can also remove one child's kept progress on its own and leave a sibling's alone. If nobody signs in to an account for two years, we delete the kept progress anyway.

Daily reminders, if you ask for one

The grown-up area can set one notification a day, at an hour you pick, on the days your child has not played yet. It is off until you turn it on, your browser asks permission before anything is set, and one tap in the same place stops it.

To send it we keep what your browser gives us: an address the push service assigns to that browser, two keys it needs to decrypt the message, the hour you chose and how far your clock is from UTC. No name and nothing about your child. The notification itself never mentions your child, not even their first name, because it appears on a lock screen anybody holding the phone can read. To know whether they have played we look at when their progress last reached us, which we already hold, so nothing new is collected to decide it.

Turning it off deletes the row. So does signing out on that device, and so does a push service telling us the browser is gone.

The grown-up code

The four digits that guard the grown-up area are kept on your account as well as on the tablet. Two reasons, both practical: a second tablet is then guarded by your code rather than by the one Brainy ships with, and a parent who forgets it can set a new one instead of wiping the app. To reset it we email a six-digit code to your address, exactly as signing in does, because that is the one thing a child holding the tablet cannot reach.

We store those four digits as you typed them rather than scrambled, and we would rather say so than imply otherwise. It guards a settings screen from a young child, not an account from an attacker: there is no money behind it and nothing there a child could not see by using the app. Scrambling four digits would be ten thousand guesses to undo, so it would buy the look of protection and cost us the ability to put your code back on your next tablet. We never send it in an email and never show it to anyone but you.

How signing in works

There is no password. You give us your email address, we send a six-digit code, and typing it back proves the address is yours, which is the same thing a password reset would have proved, with fewer steps and nothing to forget. That code works once and expires after fifteen minutes, and five wrong guesses kill it.

Once you are in, the device keeps a long random token so it stays signed in. Two things worth being straight about:

• It is stored in the browser on that device, which means a script running on the page could read it. Brainy loads no third-party script anywhere in the app, and the security policy we publish with it forbids one. That is the protection, and we would rather state it than imply the token is safer than it is.
• Each device gets its own, so signing out on a tablet you have lost does not disturb the one in your hand. Sign out in the grown-up area revokes that device immediately.

We keep a rough label for each signed-in device, "Chrome on Android" for instance, purely so you can tell them apart. It is not a fingerprint and cannot identify the device to anybody else.

What is stored on your device

So that the app can remember where your child got to, the following is saved in your browser's local storage, on your device only:

• The first name and age you entered, and the class and curriculum you chose
• Which questions have been answered, and how well, per skill
• Coins, level, streak, badges, and the characters and pets collected
• A short history of recent sessions, including questions answered incorrectly
• Your settings, including the four-digit grown-up code

You can see all of it, export it as a file, remove one child, or delete everything, including anything shared with us, from the grown-up area. Clearing your browser data also removes it.

What leaves your device

The usage counts described below, unless you switch them off. Nothing else, unless you choose one of these:

• You export a backup file and move it somewhere yourself. The file holds your children's progress, your grown-up code and your access code, so treat it like the access code itself: anyone you send it to could restore it. It never holds the sharing id, so a restored tablet is counted as a new one rather than as the old one.
• You send the weekly learning summary, which rides along with the usage counts.
• You write to us using the feedback form.
• You claim a free place, enter a code, or buy a licence, which sends your email address and the code, and nothing else. See Sign-ups, licences and payments below.

With sharing switched off and none of the rest chosen, Brainy makes no network requests at all after the page has loaded. That is also why it works offline, and it stays true of the child-facing part of the app on every plan.

Anonymous usage counts

This one is on unless you switch it off. Setup says so, with the box already ticked, and the grown-up area turns it off in one tap. While it is on, Brainy sends us a small amount of information so we can tell whether it is working:

• That Brainy was set up, and which curriculum and class you chose
• That it was opened on a given day, and how many children use this device
• For each quest: the subject, how many questions, how many were right, and how long it took
• A weekly summary of which topics are scoring worst
• A random code, generated when Brainy is set up, so one tablet is not counted twice

It never includes your child's name, their age, or anything they typed.

About that random code

We want to be straight about this rather than call it "anonymous" and leave it there. The code does not identify your child, is not linked to a name or an email, and cannot be resolved to a person. But because it stays the same between visits, it lets us see that the same device came back, and under Nigerian and European data protection law that makes it pseudonymous data, not fully anonymous data. So we will not pretend it is nothing. What we will say is what it is never used for: no advertising, no profiling, no decision about your child, and no joining it to your email address or to anything else we hold. It exists to tell one tablet from another when counting, and for nothing else.

We rely on legitimate interest for this rather than consent, because a pre-ticked box is not consent and we would rather not dress it up as one. That basis comes with an obligation we take seriously: it has to be a fair trade, it has to be easy to refuse, and refusing has to actually stop it. So the switch is one tap in the grown-up area, turning it off deletes the code from your device and the counts held under it, and the whole thing is described here rather than buried. If you would rather Brainy never sent a single byte about your family, switch it off during setup and it never starts.

Changing your mind

Grown-up area → Settings → Share anonymous usage data. Switching it off stops all sending immediately, asks us to delete everything already received under your code, and then deletes the code from your device. Deletion happens first and on purpose: the code is the only handle on those records, so once it is gone nothing could find them again.

If your tablet is offline at that moment the sending still stops, but the earlier records will remain. They carry no name, no contact details and no date beyond the day, and nothing will ever be added to them. The app tells you which of the two happened rather than assuming. Delete everything in the same screen does the same erasure and additionally wipes the whole app back to a fresh install.

How we learn whether the app works

The counts tell us that a topic is scoring badly. They do not tell us why, and for that the only source is you. In the grown-up area you can read the exact summary, then copy it, send it once, or leave it to go automatically each week. There is also a shortcut for the thing that matters most: your child can tap I think this is wrong on any question, which saves it for you to look at. Nothing about it is sent until you have read it and decided to send it.

That summary deliberately contains:

• The curriculum and class, and rough bucketed counts (for example "100–249 questions")
• Overall accuracy, and which of our topics had the lowest scores

It deliberately does not contain:

• Any name, device identifier or account of any kind
• Any dates or timestamps
• Any question text, or anything your child typed

We are being careful about the difference between de-identified and anonymous. A persistent identifier plus a detailed history would still be personal data even with the name removed, because it describes one individual. The summary avoids that by carrying no identifier and no timeline at all. Nothing is sent automatically, and nothing is sent unless you choose to send it.

The feedback form

The grown-up area has a feedback form. Whatever you type in it is sent to us, along with the category you picked and, only if you tick the box, the anonymous summary. An email address is optional and used solely to reply to you. Please do not include your child's name or other personal details; we do not need them and ask you not to send them.

Sign-ups, licences and payments

Mathematics (your child's class and every earlier class as revision) is free permanently for everybody, and needs no card at any point. The other subjects are covered by a licence, and the first twenty families get a free year of all of them. Registering is what attaches any of that to you; paying only comes into it if you are not on a free place.

We email you three things and nothing else: your access code, a confirmation if you paid, and a warning about a week before a licence runs out. No newsletter, no offers, no reminders to play.

When you claim a place, enter a code, or buy a licence, we store:

• Your email address, and your name and phone number if you chose to give them
• Which plan you are on, when it started, and when it runs out
• Your family access code, and how many tablets have used it
• For a purchase: the amount, the currency, a payment reference and whether it succeeded
• If you pay by bank transfer: the name on the sending account, the date, the reference you gave us, and the receipt you attached if you chose to attach one. We need those to find your payment on our statement. Only we can see them, and they are never on a public address. You can ask us to delete the receipt once your code has arrived.

We do not store card details. We never see them. Nothing about your child is attached to any of it: no name, no age, no answers, no progress. The link between a licence and a child is the code on your tablet, and it stops there.

Your access code is checked with us about once a week when the tablet is online, which also records that the tablet used it. That is how we notice a code being passed around a hundred families. If we cannot be reached, nothing changes and your child keeps playing.

You can remove the licence from a device at any time in the grown-up area, under Access. That closes the paid subjects on that tablet and cancels nothing: entering the code again reopens them.

Google Analytics: on this website, not in the app

This website, the pages you are reading now, can use Google Analytics to tell us which pages people actually read, so we know what is worth writing and what is being skipped. It is the ordinary business of running a website, and we would rather do it openly than guess.

Google Analytics sets a cookie and receives, for this website only:

• Which pages you looked at, and when
• Roughly where in the world you are, from your IP address, which Google truncates
• Your device type, browser and screen size
• Which site or search sent you here, if any

We have switched off Google's advertising features: no Google Signals, no ad personalisation, no remarketing audiences. Nothing collected here is used to advertise to you or sold to anybody, and we cannot see who you are from it.

The app has none of this. Brainy itself, at brainy.fortbridge.app/play, contains no Google script, no analytics service and no third-party code whatsoever, and the build refuses to publish if one ever appears there. So nothing your child does is measured by anybody, which is the point. The grown-up dashboard is excluded too.

Opting out. Nothing here is required for the website to work, so you can block it without losing anything. Any tracker-blocking extension stops it, as does Google's own opt-out add-on; clearing your browser data removes the cookies already set, and blocking third-party scripts for this site prevents new ones. If you would rather not be counted at all, we would rather you blocked it than felt watched.

Third parties

The app contains no analytics service, no advertising, no tracking pixels, no third-party fonts and no embedded content. Usage data, summaries and feedback go to our own server and are not shared with anyone else.

Three third parties are involved, and not one of them on a child's tablet:

• Google Analytics measure these website pages, as described in the section above. Not the app.
• Resend deliver our email: your access code, a payment confirmation, and a warning before a licence runs out. They process your address in order to deliver those messages and for nothing else. We do not run a mailing list, and there is nothing here to unsubscribe from: every message is about your own access.
• Paystack take the payment, and only if you buy a licence. You go to their page to enter your card details, and they hold those details and the receipt. We receive only your email address, an amount and whether it worked.

Each has its own privacy notice covering what they do with what they are given. None of them receives anything about your child, because nothing about your child exists on our side to send them.

Advertising

There is no advertising in Brainy, and there will not be any in future versions.

Children's safety

Brainy has no chat, no messaging, no user-generated content and no way for a child to communicate with anyone. There are no external links anywhere in the child-facing part of the app. The only place that can navigate away is the grown-up area, which is behind a code.

Hosting and where data is kept

The site is served as static files by Vercel, our hosting provider, who may keep standard server logs including IP addresses for security and reliability. We do not read those logs to build any profile, and they are not joined to anything above.

Anything you do choose to send (usage data, summaries, feedback) is stored in our own database and is not shared with, or sold to, anyone. No third-party analytics service is involved in any of it. Google Analytics runs on these website pages only, never in the app, and the two are never joined.

How long we keep it

These are real periods, not intentions. A scheduled job runs every week and deletes anything past them; the numbers below and the numbers in that job are deliberately the same, so this table cannot quietly drift away from what actually happens.

You do not have to wait for any of it. Turning off Share anonymous usage data or using Delete everything in the grown-up area erases the usage records immediately. Ask us and we will delete a licence record too. That ends the access it was holding, so we will say so before we do it rather than quietly closing subjects your child is using.

Where your data is processed

Our website, the app and our small server all run on Vercel, and our database is hosted by a managed Postgres provider. Their servers may be outside Nigeria and outside the UK, which means the little we hold (your email address, a licence, a payment reference) may be processed abroad.

Where that happens we rely on the safeguards the NDPA requires for transfers out of Nigeria, and on our contracts with those providers, which bind them to process data only on our instructions and never for their own purposes. Nothing about a child is included, because nothing about a child ever leaves the tablet in the first place.

If something goes wrong

If we ever suffer a breach that puts personal data at risk, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware, as the NDPA requires, and we will tell the people affected directly where there is a real risk to them. We would rather say so plainly than manage it quietly.

The blunt version of what a breach could expose: a list of parents' email addresses and which licence each holds. Not one child's name, age, answer or score, because we do not have them.

If this changes

Should Brainy ever add cloud backup of a child's progress, that would be opt-in, would require a parent's explicit consent, and this notice would be updated before it launched. It would not be switched on quietly for existing users. A licence is not that: it holds a grown-up's email address and nothing about a child, and it never uploads a child's work.

Your rights

Almost nothing personal reaches us, so for the most part there is nothing for us to disclose or correct on your behalf. You hold all of it, on your device, and can export or destroy it at any time.

Your email address, if you gave us one, is the exception: that is personal data, it is yours, and you have the usual rights over it. Write to the address below and we will tell you exactly what we hold, correct it, or delete it. Deleting it ends the licence attached to it, so we will confirm that with you first rather than quietly closing subjects your child is using.

Erasure is the exception, and it is handled in the app rather than by writing to us: turning off Share anonymous usage data, or using Delete everything, deletes the usage records held under your code. We would rather you did not have to ask us, because asking us would mean telling us who you are. If something has gone wrong, or you have a question, contact us at the address below.

Your rights in full

Under the NDPA, and the UK GDPR where it applies to you, you have the right to be told what we hold about you, to get a copy of it, to have it corrected, to have it erased, to object to what we are doing with it, to restrict it while a dispute is resolved, and to take it elsewhere in a portable form. You also have the right not to be subject to a decision made purely by a machine that significantly affects you; we make no such decisions.

Exercising any of them costs nothing and takes one email. We will not ask you to prove who you are beyond replying from the address we already hold, because demanding a copy of somebody's ID in order to honour a privacy request collects more than the request itself.

If you are not satisfied

Please tell us first, because we would rather fix it. But you do not have to come to us at all, and you can complain directly to a regulator:

• In Nigeria, the Nigeria Data Protection Commission (NDPC), at ndpc.gov.ng
• In the UK, the Information Commissioner's Office (ICO), at ico.org.uk

Contact

Fortbridge Technologies Ltd
brainy@fortbridge.app