School Word

Privacy Notice

By the Schoolword Team. For privacy questions or account requests, contact info@schoolword.com.

Our vision

A world where language brings people together. We want everyone to feel welcome learning a new language and to respect the languages, cultures and identities of others.

Our mission

To make language learning clear, encouraging and accessible to people around the world through guided classes and meaningful practice. We help learners communicate with confidence, understand one another and build connections with kindness and mutual respect.

Information used by the service

Account signup collects your email, first name and age group. Surname is optional; you can leave it blank. Passwords are handled by the authentication provider. Your gamer profile contains a username, country, native language and learning language. We use this information to provide your account, communicate about account security and apply your learning preferences. We collect an age group rather than a full date of birth.

Supabase Auth handles password authentication. School Word's profile database does not store plain-text passwords. Authentication/session identifiers are used to keep you signed in securely.

Gameplay preferences and a device copy of progress are stored in your browser. When signed in, learning progress and classroom work are also backed up to your account on the Netcup server so they can be restored on another device. These study backups are not treated as verified leaderboard scores. The database also has fields prepared for XP, level, streak, rank and achievements, but public ranking and trusted score calculation are separate features.

The web server and service providers process technical information such as IP addresses, request times, delivery status and error logs to operate and protect the service. Account emails include verification, recovery, welcome and security notifications.

Cookies and local storage

The sw_cloud cookie is an essential account-session cookie, kept for the browser session; server-side sessions expire within seven days. The separate administrator session normally lasts up to eight hours. Browser local storage saves game settings and progress until you clear it. Clearing cookies signs you out; clearing local storage may remove local game progress.

Service providers and data processing

We use service providers for website hosting, secure account access, data storage and account emails. Providers may use infrastructure and subprocessors outside the European Economic Area. A selected hosting region does not mean every support, email or technical record stays there. Contact us for the current recipient, destination and transfer arrangement applicable to your information; provider privacy policies give additional details. We do not claim that all processing is confined to one country.

Provider privacy policies: Netcup, Supabase and Resend. Public rankings show gamer usernames, countries and XP. Your email, password, surname and age group are not included in leaderboard entries.

Purposes and processing grounds

We use essential account, profile and study information to provide the learning service requested under our Terms. Security information is used to protect accounts and prevent abuse. Where we rely on consent, including guardian permission when applicable, it must be specific and can be withdrawn by contacting us. Accepting the Terms is separate from reading this Privacy Notice; the signup form does not ask for a blanket consent to all data processing. We do not add a marketing subscription through signup.

When you set a password, our server checks for known breached passwords using the Have I Been Pwned service. It sends only the first five characters of a password hash, never your password or email address. See the Have I Been Pwned privacy policy.

Guardian approval records

The approval system stores hashed learner and guardian email identifiers, the age group, reviewer, a private evidence reference, issue/expiry dates and whether the code has been used. It stores a hash of the code rather than the code itself. Permission correspondence is handled through our contact email. These records document permission and help prevent code reuse; send only the information needed to review the request.

Retention and requests

Account and study records remain until the account is deleted or a removal request is completed; there is currently no automatic deletion based only on inactivity. Guardian codes stop working after seven days or first use. Expiry does not itself erase the approval record. Server-side account sessions expire within seven days; expired session rows are cleared when new sessions are created. Contact us to request deletion of an account, study saves, ranking entry or guardian records. We review related operational and provider records as part of the request and explain any retention required by law or for a specific security issue. There is no fixed published retention period covering every server log, mailbox item and provider backup; contact us for the applicable record-specific information. You may request access, correction or deletion by contacting us from the registered email address. We may verify your identity before acting. Security, backup or legally required records may need to be retained for a limited period after an account is removed.

Depending on the law that applies, you may also have rights to object, restrict processing, receive a copy of your data, withdraw consent where processing relies on consent, or complain to a data-protection authority. Essential account processing is needed to provide the account you request; security processing is used to protect the service.

Children and changes

Learning activities and classes are open to learners of all ages; School Word does not impose a blanket 13+ learning restriction. Children should learn with support from a parent or guardian. Where local law requires parental consent for account data, that permission must be arranged before registration. New accounts in either under-18 age group require a one-use guardian approval code before registration. A parent or guardian must contact info@schoolword.com so we can review their authority and permission through a manual process. A code is bound to the learner email and age group, expires after seven days and can be used once. This is a reviewed manual process, not automated identity verification. Public guides remain available to learners of all ages. Contact us if a child account may already have been created without required permission.

This notice describes the current service. We will update it when our data practices change. Contact us before registering if you need clarification about your information.