Privacy policy
How family accounts, billing details, saved landmarks and backups are handled.
Updated
Who this policy is for
This policy covers the Brick Buddies family-account website and its separate native iPhone build. It is written for parents, carers and educators. An adult should set up a family account and help children use the app. Use a nickname rather than a full name. Do not enter sensitive information or contact details in a child’s name field.
Family accounts and the information we save
On the website, these records are sent over HTTPS to the family database when you sign in and use the app. They are used to provide your account, restore profiles, preferences and landmarks across devices. Family records are not public. Working-pad notes are temporary; the current round is kept in this browser tab so a refresh returns to the same question.
- Account details: a family username, salted password and optional grown-up PIN hashes, a hashed recovery code, sign-in sessions and account creation/update times. We do not save your password, PIN or recovery code as readable text. Adult email addresses are kept separately from children’s profiles.
- Child profiles: a name or nickname, optional emoji, grade, progression history and generated identifier. A paid family membership includes up to four children. Existing profiles are not removed when membership is introduced.
- Preferences: grade, number range, round length and other practice settings. The active child is selected separately on each device.
- Practice records include whether the question was part of Level up or practice, the readable question and correct answer for new records, topic, grade, dates, completion, help use, whether an answer needed correction or was skipped and the first-answer time when it is under five minutes. Activity uses up to 600 recent question presentations per child; older records may remain in existing saves. Grown-ups shows activity from the last seven days and can download the saved question records as a CSV. Practice uses these records to choose reviews, adjust difficulty and move to the next grade. These records are not a school assessment.
- Landmarks: earned building steps, collection progress and reset information.
- Service measurement: campaign labels, signup and trial dates, first-build completion, practice days, payments and cancellations, linked to a generated family ID. Reports combine families and exclude child names, questions and answers. These records stay on our service and are deleted with the family account.
- To avoid counting activity twice, we keep hashed child and event identifiers with completion times and building steps until the child or family is deleted. Family-level totals remain after child deletion.
- Earlier transfers may have a source-device identifier retained in existing saves. Some older practice records may not include readable question details.
Device storage, cookies and offline changes
The website keeps a local cache and a queue of changes in browser storage. A necessary HttpOnly session cookie keeps the family signed in for up to 30 days. We use no advertising or analytics cookies. Campaign attribution expires after 30 days and is removed on your next visit. Campaign labels accompany signup links between our website and app. We do not keep full referrer URLs or advertising click IDs for this purpose.
If a loaded page loses its connection, it can keep queued changes on the device and send it when connected again. Opening or reloading the website needs an internet connection. A save is backed up only after it reaches the server and the backup process copies it.
Signing out removes this browser’s cache for that family after pending changes are saved. Other signed-in devices can retain their own caches. Clearing browser data removes local copies but does not delete the online family account. One tab per browser can edit family saves at a time.
The separate native iPhone build uses app preferences on the device and does not currently sync with the website. The old website addresses also have separate saves. The app does not offer file import. On the family-account website, Grown-ups can download the recent saved practice history as a CSV and should keep that file private.
Adult account emails
When you add an email address, we send a confirmation link before account updates. We keep its verification status, your trial-reminder choice and delivery records. Email changes require the family password and a new confirmation.
Cloudflare delivers automated confirmation, trial and subscription emails and processes the adult address, message content and delivery information using its global network, including outside Australia. These messages contain no children’s names or learning records. We do not use email open or click tracking.
Trial reminders are optional. Stop them using the link in a reminder or Email settings. Essential verification and billing messages are separate. Unsent message contents are encrypted and removed after acceptance, suppression or expiry; delivery identifiers are kept to prevent duplicates. Account deletion removes these records, subject to backup retention.
Subscriptions and payment details
Stripe hosts checkout and subscription management. Card number, expiry date and security code are entered directly on Stripe’s hosted pages and never reach Brick Buddies. We share a verified adult email address and a generated family identifier with Stripe. Stripe also collects any billing name or address supplied. We do not send children’s names, grades, answers or landmarks, and we do not store card numbers.
Our database stores Stripe customer, checkout, subscription and event identifiers, plan, membership status and billing dates. We use these to provide access, confirm payments and handle billing requests. Authorised operators can see billing details and payment records in Stripe for support, accounting and refunds.
Open Grown-ups → Subscription settings → Manage billing to update billing details on Stripe’s hosted page or see invoices. Stripe uses its own cookies and security checks and may process data overseas. Payment records may remain with Stripe after family-account deletion for legal, accounting and fraud-prevention purposes.
Hosting and backups
Fly.io hosts the application and its SQLite database on a persistent volume in Sydney. Litestream copies database changes to a private Tigris backup bucket, configured for Sydney. We target a backup sync every 60 seconds and use daily volume snapshots as an additional recovery source. These are recovery systems, not a guarantee against all data loss or service interruption.
Backup history targets 30 days. Expiry is periodic, and the newest recovery snapshot may remain longer until a replacement exists. Deleted records may therefore remain in restricted backups for a period. Backups are used for recovery, not ordinary access or advertising.
Requests to the hosting services can include IP address, requested URL, browser information, time and diagnostic information. Sign-in abuse controls store short-lived keyed hashes of IP addresses and usernames with attempt counts. App logs avoid passwords, recovery codes and child record contents.
Although the database and backup locations are configured for Sydney, providers use global networking, support and operational systems. Technical information may be processed outside Australia. Provider terms and privacy practices also apply. The old transfer website remains hosted by Cloudflare.
What we do not do
There is no advertising, public child profile, messaging, behavioural analytics SDK or runtime AI/LLM service in the app. We do not sell children’s learning records or share them for advertising or AI training. Public llms.txt and policy pages describe the app; they do not expose private family data.
External resources
The national curriculum link opens an external service with its own privacy practices; the app does not attach saved child profiles or learning records to it.
Access and deletion
- Manage profiles in Grown-ups → Kids. You can add or delete children, edit their names, change their picture, set their grade and manage their settings. Level up is first in the activity menu and can be chosen at any time.
- Contact the operator about access to records held for your family. Keep any previously downloaded files private.
- Delete the entire family account at the bottom of Grown-ups using the family password. This cancels any subscription and removes live profiles, learning records, landmarks, sessions and the family’s app billing record. Restricted backups expire under the retention described above; Stripe may retain payment records. Other devices and exported files may still hold copies; clear their website data too.
- Cancelling a subscription alone does not delete the family account or its saved children and landmarks. Deleting a child does not cancel or change the price of a family subscription.
- Deleting a child removes their live profile, settings, earlier learning records and landmarks. An identifier-only deletion marker prevents an older device from restoring them. Offline deletions reach the family database when the device reconnects. Backups expire under the retention described above.
- Clearing data for an old website or deleting the native app can remove its local saves. Device backups and exports are controlled separately. We cannot remotely recover records that were only saved locally.
Security and retention
Accounts and saved data remain until deleted. Activity uses the latest 600 question presentations; older records may remain in existing saves. Expired sessions and rate-limit records are removed during subsequent authentication requests.
Payment event identifiers and processing times are retained to prevent duplicate billing updates. These records contain no child data.
Family accounts use hashed passwords and recovery codes, secure cookies, request validation and family-scoped database access. Authorised operators and hosting providers may access data when necessary to run, secure or restore the service. No system can guarantee complete security.
Children do not have separate account passwords. Anyone using a signed-in browser can switch children and see landmarks. On the family-account website, changing grown-up settings requires the family password, or an optional grown-up PIN. Use the device’s screen lock and sign out on shared devices. Browser caches are not a separate encrypted vault.
Keep your family username, password and recovery code safe. Resetting a password with the code revokes existing sessions and produces a new code. There is no email reset. If you lose both the password and recovery code, we cannot promise to restore access.
Contact, requests and complaints
An adult can contact the operator about privacy, access, correction, deletion or a concern. Describe the issue without sending a child’s full name, password, recovery code or unnecessary learning records. If you contact us, we receive the contact details and content you choose to send and use them to answer, investigate or meet applicable obligations.
Fastmail hosts our support email in the United States. Messages and attachments sent to hello@brickbuddies.com.au are processed there to provide support.
We retain correspondence only as needed for those purposes and may disclose information where legally required. You can also ask the Office of the Australian Information Commissioner about privacy rights and whether it can handle a complaint.
Changes to this policy
We update this page and its date when the app’s data practices change. Read it before using a new feature that requests additional information.
Operator and contact
Kingfisher Systems Pty Ltd trading as Brick Buddies