Privacy policy

1. Who we are

SILLYMATHS LTD (“we”, “us”) is the data controller for the personal data described in this policy — meaning we decide what is collected and why, and we answer for it under UK GDPR. We are registered in England and Wales, company number 17375311, at Suite A, 82 James Carter Road, Mildenhall, IP28 7DE. For anything in this policy, write to hello@sillymaths.com.

We are registered with the Information Commissioner’s Office, the UK’s data protection regulator, under registration number ZC236400.

2. What we collect about you, the parent

Your email address; your purchase records (what you bought, when, and the amount — card details stay with the payment provider and never reach us); and any messages you send us. If you request the free topic paper, we also send two short follow-up emails over the next ten days — you can unsubscribe from those at any time and the trial still works.

3. What we collect about your child

All of it, in one list. Some of this you type in, some of it the test screen measures while your child works:

• a silly name you pick from two wheels. It is not a box you type in, so a real name cannot reach us even by accident;
• the month and year they were born — never the day. This is only so we compare your child with children the same age: a child born in August is nearly a year younger than one born the September before, and it would not be fair to score them as equals;
• their school year, and whether they are a girl or a boy — you can answer “prefer not to say”. Single-sex grammar schools mean a fair comparison is sometimes a same-sex one;
• the school you are aiming at and the month of the exam, if you tell us. Both are optional forever, and “not sure yet” is a real answer;
• extra time, if their school has granted it — as a percentage, so their paper runs longer. We do not ask why, and there is nowhere to tell us;
• tick-marks — whether each question was answered right or wrong;
• what they typed as their answer, on every question including the ones they got right. This is the part that lets us name the mistake rather than just count it, and it is why the report can show you their answer beside the right one;
• how the sitting went: how long each question took, which of the three buttons they pressed, whether the clock ran out, what they changed at the end, and any long gap where they walked away;
• their Den — which animal was chosen, the outfit they are wearing, and what they have spent points on. See section 3a.

We never ask for, and have nowhere to store, a child’s name, their birthday, the school they attend, a photograph or contact details. There is no box anywhere in the product where a child can write something about themselves. The system is designed so that a child cannot be identified from what we hold — the identity lives in your head, not our database.

3a. The Den, the animals and the points

The Den is the part of the dashboard your child sees: a room with an animal in it, chosen in your settings — by you, or by the two of you together. Your child spends points earned from their maths on outfits, backgrounds and furniture. What we store is a list of which pictures they own and which they are using — nine animals and a fixed set of items, all drawn by us and shipped with the site. That is all of it.

It is cosmetic and it is sealed off: nothing in the Den is read by anything that decides a mark, a level or a recommendation, and nothing about it appears in your reports. The points total is not even stored — it is worked out from your child’s own results each time they open the page. There is nothing in the Den a child can type into, so nothing they write can reach us; every control is a button.

Nothing in the Den is visible to anyone outside your account. There is no chat, no leaderboard, no sharing, no profile another family can see, and no way for one child to find another. Points cannot be bought and nothing in the Den costs money.

It is deleted with the rest of the profile, at the same time and by the same request — see section 10.

4. Consent, and who holds the account

You, the parent or guardian, are the account holder and the person who gives consent — children never hold accounts and never sign in. When you create a child profile, the dashboard asks you to confirm that you are the child’s parent or legal guardian and that you consent to us processing their results as described here. No child profile can be created without that confirmation, and you can withdraw it at any time by asking us to delete the profile (section 10).

5. What we use the data for

In order of importance:

• turning tick-marks into the pattern of named mistakes that the dashboard shows you, including patterns across packs and across months;
• generating practice sheets targeted at the mistakes your child actually made;
• fulfilling purchases — receipts, refunds and account access;
• replying when you contact us.

What we do not do: advertising, profiling beyond the maths itself, or sharing data with anyone for their own purposes.

Our lawful bases under UK GDPR are: contract (fulfilling your purchase and running your account), consent (processing your child’s results, given by you at profile creation), legal obligation (keeping purchase records for tax law) and legitimate interests (keeping the service secure and preventing fraud).

6. How the analysis is produced

The marking and the analysis are done by software, not by a person. When your child finishes a paper, a programme compares each answer with the correct one, sorts the wrong ones by the mistake most likely to have produced them, and works out a level on our own scale. Nobody reads your child’s answers as part of ordinary use.

⚠️ It is a most-likely explanation, not a certainty, and it produces information for you rather than a decision about your child. Nothing automated here decides anything with a legal or similarly significant effect: we do not grade or select anybody, and we do not share any of it with a school, an exam board or anyone else. What you do with it is entirely yours.

We do not currently compare your child against other children. If we ever do, it will be in the form of a position among children who sat the same paper, shown to you and to nobody else, and we will tell you before it starts.

If you think the analysis has your child wrong, tell us — you can ask us to look at it, to correct it, and to explain how a particular conclusion was reached.

7. How we keep it safe

Data is held in encrypted databases in the United Kingdom, reached only over encrypted connections. Access is limited to the people who need it to run the service, which today means one person. Passwords are never stored in a form anybody can read, including us — which is why we can reset one but never tell you what it was.

No system is perfect, and we would rather say so than imply otherwise. What we can promise is that if something goes wrong you will hear it from us — see the section below on data being lost or exposed.

8. Aggregated insights

We intend to publish research about which mistakes are most common across the children who use SillyMaths, and will do so in due course. Anything published will use irreversibly anonymised outcomes: the mistake names and right/wrong counts, with every link to an account or profile stripped, so the process cannot be run backwards to reach a child. Raw answer data is never published, never shared and never sold.

9. Where your data lives, and for how long

We store data in the United Kingdom, and choosing UK data residency is a design requirement for the service, not an afterthought. The providers we rely on to run the service, each handling only what its job needs, are:

• Supabase — our database and sign-in (holds your email, purchase records, and your child’s nickname and tick-marks), hosted in the UK (London);
• Vercel — hosts and runs the website;
• Stripe — takes card payments; your card details go straight to Stripe and never reach us;
• Resend — sends our emails (receipts, account set-up and demo follow-ups).

Each may use the data only to provide its service to us. Two of them are based outside the UK and only ever see a narrow slice: Stripe sees your payment and billing details, and Resend sees your email address and the contents of the emails we send you. Where either moves that data outside the UK, the transfer is covered by the safeguards UK data protection law requires. No data about your child ever leaves the UK — your child’s nickname, year group and tick-marks stay in the London database and are never sent to a payment or email provider.

Retention is different for the two kinds of data we hold:

• Child profiles: if a profile has no new results for 24 months, we delete it automatically — nickname, year group and every tick-mark. We do not keep dormant child data.
• Your purchase records: the fact of a sale — the date, the amount and the email it was billed to — is kept for six years, because UK tax law requires it and because it is the proof that you paid. It contains nothing about your child. Their nickname, their answers and their analysis are covered by the rule above and go when it says they go, whatever a receipt from three years ago still shows.

10. Your rights, and how to use them

UK GDPR gives you rights over this data. Here is how each one works with us:

• See your data: dashboard settings shows everything we hold — your account, your children, every result and every purchase — on one screen you can read and print. For a machine-readable copy, email us and we’ll send one.
• Delete a child’s data, or your whole account: email hello@sillymaths.com from your account email and we delete it promptly and permanently. We handle deletion by email on purpose, so a child’s results can never be wiped by an accidental tap. Deleting a child’s data never touches your purchase records or your access to the packs you bought; purchase records themselves are retained only as long as tax law requires.
• Correction: a child’s nickname and year group can be edited any time in dashboard settings; for anything else, email us.

For anything not covered by a button — including a formal subject access request — email hello@sillymaths.com with the subject line “Data request”. We respond within one calendar month. If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner’s Office at ico.org.uk.

11. Cookies

We set only strictly necessary cookies — signing in, staying signed in, and remembering your basket. No advertising trackers of any kind. The detail is on the cookies page.

12. If data is ever lost or exposed

No one can promise a breach will never happen, so here is what we do if one does. If personal data is lost, stolen or exposed in a way that puts anyone at risk, we report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and we tell affected account holders directly — in plain English, and without waiting to be asked.

13. Changes to this policy

If we change how we handle data — for example, when the dashboard gains features — we will update this page and its date, and for any significant change to how child data is processed we will email account holders before it takes effect.

We review this page at least once every 12 months, whether or not anything has changed, so it never quietly falls out of date.