Privacy

Who we are

explayn is operated by Alex Neil, trading as explayn, 57 Goldstone Road, Hove, BN3 3RG. For anything in this policy, including a request about your data, write to alex@ajneil.co.uk.

We are the data controller for teacher accounts. Where a school signs teachers up, that school is responsible for its own staff records; we remain the controller for the account data described below.

Students: what we collect

Nothing that identifies them. This is the most important thing in this policy, so it comes first.

Students do not have accounts. They are not asked for a name, an email address, a date of birth or anything else. They type a six-digit code and play.

When a round finishes we record which words were guessed and which were missed, so a teacher can see what their class found hard. That record contains no identifier for the student, the device or the session — there is no way to connect it back to a person, by us or by anyone else.

There is one exception, and it is under the teacher's control. If a teacher turns on student word submission, a student adding a word may optionally type a name so their teacher knows who suggested it. It is free text, optional, and limited to 40 characters. Teachers should ask students to use a first name or nickname rather than a full name.

If you send us a testimonial

The form on the About page is optional and is nothing to do with having an account. If you use it we store what you wrote, the name and role you asked to be credited as, and the email address you gave us if you gave one.

We ask you to tick a box before you send it, and that tick is the only basis on which we would ever publish your words. Nothing is published automatically: a person reads every submission and we will come back to you before anything appears on the site.

The email address is used to check a submission is genuinely from you, and is never published. Ask us at alex@ajneil.co.uk and we will take a published testimonial down, or delete an unpublished one, without asking you why.

Teachers: what we collect and why

To give you an account and the sets that belong to it:

• Your email address and, if you give one, a display name — so you can sign in and so your school's organiser can recognise you on their roster.
• The sets you create: their titles, levels, words and join codes.
• The school you belong to, if any.

If you subscribe, we also store an identifier for your Stripe customer and subscription, the subscription's status and its renewal date. That is what tells the app whether your plan is active.

The lawful basis is performance of a contract: this is the information needed to provide the service you have signed up for.

Payments

Payments are taken by Stripe. Card details are entered on Stripe's own pages and never reach our servers — we never see, handle or store them.

Stripe tells us only whether a subscription is active and when it renews. Stripe is a data controller in its own right for the payment itself, and has its own privacy policy.

What we do not do

• No advertising, and no sale or sharing of data with advertisers.
• No analytics or tracking scripts. The site loads no third-party JavaScript at all.
• No tracking cookies. We use no cookies for advertising or analytics.
• No profiling and no automated decisions with legal or similarly significant effects.

Cookies and browser storage

We do not set tracking cookies, so there is no cookie banner to dismiss.

Signing in uses Firebase Authentication, which stores a session in your browser so you stay signed in. That is strictly necessary for the service to work.

We also store two small preferences in your browser, which never leave your device: whether you dismissed the prompt to install the app, and, in demo mode only, a stand-in session so a page refresh does not sign you out.

Who else processes your data

We use two providers, both acting on our instructions:

• Google (Firebase Authentication, Cloud Firestore and Firebase App Hosting) — sign-in, the database and the servers that run the app.
• Stripe — subscription payments.

Both may process data outside the UK. Where they do, they rely on the safeguards in their own terms, such as standard contractual clauses.

Server logs briefly record the IP address of requests so we can rate-limit the public endpoints and stop people guessing at class codes. Those counters are held in memory only, are not written to the database, and are discarded within minutes.

How long we keep things

• Account data: for as long as your account is open, and for 12 months afterwards in case you come back or a billing question arises.
• Sets and words: until you delete them, or until your account is deleted.
• Round results: 24 months. These contain no personal data.
• Payment records: as long as tax and accounting law requires, currently six years in the UK.

Your rights

Under UK data protection law you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another provider. You can also withdraw consent where we have relied on it.

Write to alex@ajneil.co.uk and we will respond within one month. There is no charge.

If you think we have got something wrong, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can put it right.

Children

Accounts are for teachers, who must be 18 or over. Students play without an account and we hold no personal data about them.

This is deliberate. A classroom tool should not need to know anything about the children using it, and this one does not.

Changes

If we change this policy we will update the date at the top. If a change materially affects how we use your data, we will email account holders rather than rely on you noticing.