What we hold, who sees it, and how to get rid of it

Who is responsible

Freedom! Family Limited

Numbula, from heartbeat.kids, is made by Freedom! Family Limited, a company registered in Hong Kong. It decides what Numbula stores and why, which makes it responsible for the data on this page.

Registered office

Room 1501, Prosperity Tower, 39 Queen's Road Central, Hong Kong

Phone

+852 2110 0990

[email protected]

Write here about anything on this page, or anything Settings cannot do for you. There is no form to fill in.

Privacy Officer

Our Privacy Officer answers a request to see, correct or delete what we hold, and any question about how we handle it. Write to them at [email protected], call +852 2110 0990, or write to the registered office above.

Words we use

The terms and the privacy notice use these words in the same way.

You

The adult who holds the account: someone aged 18 or over who signed up and agreed to the terms and the privacy notice. Each account has one.

Coach

Numbula's word for the account holder, on this website and in the grown-up area. If you hold the account, you are its coach.

Parent or guardian

A child's parent, or another adult with legal responsibility for the child.

An adult with permission

An adult the child's parent or guardian has allowed to set Numbula up for the child, such as a grandparent, a carer or a tutor.

Grown-up

The coach, or an adult the coach lets into the grown-up area. When the child app says "your grown-up", it means the coach.

Child

A child aged 4 to 12 whom the coach has added to the account. Only that coach can delete the child or reset their progress. The grown-up area calls a child a learner.

Family

One account and the children on it.

Crew

A group of children, from one family or several, who practice together and see each other's ship names and stars. Only a coach can make one.

Crew code

A code that lets another coach ask for their child to join a crew. The crew leader shares it, and so can the crew's other coaches if the crew leader lets members invite. It stops working after 7 days.

Crew leader

The coach who made a crew. The crew leader approves each child who asks to join, and can end the crew.

Crew table

Each child's place in a crew, by the stars they earned this week. The children in the crew see their places only if the crew leader turns the table on.

School crew

A crew its leader made as a class at school. The families in it see the crew leader's full name and "at school".

Grown-up area

The part of Numbula where the coach adds children, sees their progress and changes their settings, crews and plan. It asks for the grown-up PIN.

Grown-up PIN

Four digits the coach picks, which open the grown-up area. It keeps a child holding the device out of it.

Numbula's admins

The people at Freedom! Family Limited who run Numbula and can open any account to help. Never a school's admin, and never a coach.

Demo account

An account Numbula made to show how it works. Its plan changes without payment, and its visits are left out of the counts.

Where Numbula is offered, and which laws apply

• Numbula is not offered in the places the terms list under Where Numbula is offered (/terms#where-numbula-is-offered). Sign-up is refused when the connection comes from one of them.
• Freedom! Family Limited handles personal data under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486).
• For families in the United States, the Children's Online Privacy Protection Act (COPPA) applies too. If you are a parent in the United States, below, says what it gives you.

What we hold about a child

• The name the grown-up typed, and the age band they picked (4 to 5, 6 to 7, 8 to 9 or 10 to 12).
• A ship name. Numbula makes it up from two words, and the grown-up can ask for another. Nobody can type one in. Other children in a crew see it.
• Every answer: the question, whether it was right, how long it took (once leaving out any time the app was hidden, and once with it), whether a hint was used, and when.
• Each round: what kind of round it was, its stage, when it started and finished, how long it took, and the coins it earned. The child's stars, coins and ship parts.
• Where the child is on the ladder, the highest stage they have reached, whether they have done the first placement round, when each fact is next due for a check, which lessons they have seen, so each is explained once, and on each stage how quick the ship to beat in Versus is, from their last few races. If a grown-up reset their progress, when.
• Settings: accessibility, Pip's voice (which of the device's voices, if a grown-up picked one, and how fast), sounds, music, the daily cap and quiet time.
• The crews the child is in, and when they asked to join and joined each one.
• A note sent with Tell us, the speech-bubble button in the app, while the child was playing. A child can write one, but it is sent only after their grown-up reads it and enters the grown-up PIN. First the grown-up can change the words, remove a picture or switch off the 10 minutes before. Until then the note stays on the device. A note holds the words typed in it, up to 3 pictures of the app's own screen, and, unless it is switched off on the note, what happened in the app in the 10 minutes before: the screens opened, each question with the answer given, and taps on Hear it. A picture shows only Numbula's screen, never anything else on the device.
• Tell us is on or off for every account by a site setting, and one of Numbula's admins can turn it on or off for one account. To turn it off for yours, write to [email protected].
• No email address, no phone number, no photograph, no location, no device advertising ID.

What we hold about you

• A username, the name you gave us, and your email address, with when you verified it by typing the code we sent, or by signing up with an address Google had checked. An account made before Numbula asked for an email may have none. Numbula never asks for a phone number.
• Your password, if you have one, and your grown-up PIN, both stored only as scrambled hashes, and when you last set the password. We cannot read either of them.
• If you connect Facebook or Google: the ID it gives you, your name and email as it has them, when you connected it and when you last signed in with it. Google also says whether it has checked that the email is yours. If it has, and you sign up with that address, Numbula stores the address as verified. You still get a code, to agree before you add a child. The sign-in data page (/sign-in-data) says more.
• Whether you want occasional news about Numbula, and when you said yes. It starts as no, and you can change it on Settings. We have not sent any news yet.
• If our mail provider tells us that mail to your address bounced or was marked as spam, we note when and stop sending you news, and after a bounce we stop sending to that address until you change or verify it.
• Your plan, a school code if you used one, your time zone (your browser sends it when you sign up), and when you signed up.
• That you checked the box at sign-up to say you are 18 or over and the child's parent or guardian, or an adult with the parent's or guardian's permission: when you checked it, and which version of the sign-up and this notice you saw. Then, when you typed the code we emailed you to agree before adding a child.
• If you close your account, when you closed it.
• If your account goes unused for nearly 24 months, when we emailed you to say it will be deleted.
• If you sign in with Heartbeat Kids: the last day we told Heartbeat Kids the account was used. Once a day we tell it the date of the latest day you opened the grown-up area or a child played a round, and nothing else, so it keeps the account while you use it.
• Wrong passwords and wrong PINs, counted to slow down anyone guessing. A wrong password is counted under the username or email typed with it, even if it matches no account, and against the IP address it came from. A sign-up that asks for a username or an email already taken is counted against the IP address it came from, and so is each new account. Wrong school codes and crew codes are counted against the account, and so is each code we email you. Each code we email is also counted under a scrambled hash of the address it goes to (never the address itself), so nobody can fill your inbox. A wrong sign-in code for a child's device is counted against the IP address it came from, and so is each request for a code to reset a forgotten password or PIN. Every count kept against an IPv6 address keeps only its first half, which names the network.
• Each device signed in to your account, including a child's device signed in with a code: the user agent its browser sends (which names the browser and system, shown to you as, say, Chrome on Android), when it signed in, when it was last used, and which child it is handed to, if any. A grown-up's device signed in with Heartbeat Kids also keeps the ID Heartbeat Kids gave that sign-in and its signed sign-in token, so logging out there logs that device out here, and logging out here logs that browser out of Heartbeat Kids too. Handing the device to a child drops both. It is there so Settings can list where you are signed in and let you sign a device out.
• A sign-in code for a child's device, while it works: a scrambled hash of the code (never the code itself), which child it is for, and when it was made. A code works once, for 10 minutes.
• A code we email you, while it works: what it is for (agreeing before you add a child, verifying your email, resetting a forgotten password or PIN, or confirming a new email), the address we sent it to, a scrambled hash of the code (never the code itself), how many wrong tries it has had, and when it was made.
• If you change your email: your old address, when it was verified, and a scrambled hash of the undo link we sent to it, so you can put the old address back.
• A note of who did it and when, if an admin changes your account's role, resets its password or grown-up PIN (the note never says what to), turns its demo setting on or off, turns Tell us on or off for it or sets it back to the site setting, signs it out everywhere, cancels a close, replaces its email (the note never says the address), removes its Facebook or Google connection, renames a ship on it, or renames or ends a crew it leads (the note never says a name), or if you close your account or keep it.
• Each change of plan: the plan before and after, who made the change, and when.
• When you last opened the grown-up area, to within an hour.
• Each day you opened the grown-up area: the date only, on your account's clock, so we can count how many grown-ups use Numbula each day.
• Feedback you send from the grown-up area: what you wrote, whether you marked it an idea, a problem or a question, the page you sent it from (its address, cut off before any ?), your account, when, and which version of Numbula the site was running.
• A note sent with Tell us is kept the same way, with which child was playing. What a Tell us note holds is under What we hold about a child, above.

Why we hold it

• To pick the next question, to show you which facts are secure and which are slipping, and to put the facts a child missed or was slow on first on a sheet built for them.
• To see whether Numbula works. Our server counts totals across every account, such as how many children practiced each week, how many came back, which facts are missed most and which settings are used. Admins see those totals. Those totals name no child. They come from the records above, and from daily totals the child app sends of how often each screen and a few buttons are used, which carry no name, account or device.
• To see how many people visit this website and the grown-up area, where they come from and which pages they read, as the next section explains.
• To keep a child out of the grown-up area, and to slow down anyone guessing a password or PIN.
• To read the feedback you send and fix what it points at.
• To email you. After you sign up, we send a code that you type to agree before you add a child: the mail says what we will hold about your child and why, and that we delete your account and your email if you don't agree within 14 days. A day or two after you agree, we send one mail to confirm it: the date you agreed, what it covers, and how to take it back. We send a code when you verify your email, reset a forgotten password or PIN, or change your email. We send a notice when your password changes, when your PIN is reset with a code, and when Facebook or Google is connected or disconnected, and a notice with an undo link to your old address when your email changes. When an admin replaces your email, your old address gets a notice that says so, with no undo link. When an admin disconnects Facebook or Google, the notice says an admin did it. If your account goes unused for nearly 24 months, we send a warning 30 days before we delete it. Notices go only to an address you have verified. News goes only if you said yes.
• Not to advertise, not to profile, and not to train a model.

How we count visits

• When you open a page on this website or in the grown-up area, your browser tells our server which page it was (its address, cut off before any ?), the name of the website you came from (such as google.com, never the full address), and any campaign tags in the link (utm_source, utm_medium and utm_campaign).
• When you leave the page, your browser sends how many seconds you spent on it: only time when the page was on screen and you had scrolled, tapped or pressed a key in the last minute, up to 30 minutes.
• Our server adds the country Cloudflare names for the request, whether the device is a phone, a tablet or a computer, and the browser's name, such as Safari.
• To count people rather than pages, the server mixes your IP address and your browser's user agent with a random value that changes every day at midnight UTC, and keeps only the scrambled result. The server keeps that day's value until midnight UTC, then replaces it and keeps no copy. After that, the scrambled results cannot be matched to a person. The same person counts as someone new the next day. A backup made during the day holds that day's value until the backup is deleted.
• We keep no IP address, no user agent and no cookie for this. Nothing is kept on your device for it. If you are signed in, the server reads the sign-in cookie only to mark visits from Numbula's admins and demo accounts, so the totals can leave them out. A visit is not linked to your account. Only admins see the totals and the list of recent visits.
• The child app and the page where a child's device types its sign-in code send none of this.
• Instead, the child app counts how often each of its screens is opened, how many seconds each is on screen (up to 30 minutes at a time), and how often a few buttons are tapped: Hear it, Show me, leaving a round early, picking a ship part, picking a stage on the map, and full screen. About once a minute it sends those counts for the day, and nothing else. Our server adds them to one total per day for every child together, which carries no name, account or device. It checks the device's sign-in only to throw the counts away when they come from an admin or demo account, or from an account that turned counting off.
• You can stop this counting. Turn on Global Privacy Control in your browser, or turn off Count my visits on the counting page (/counting), and this browser sends nothing, the child app included. Turn off counting on Settings in the grown-up area, and nothing is counted on any device signed in to your account.
• We delete each visit record, and each day's screen and button totals, once it is 400 days old.

Who can see it

• You, in the grown-up area.
• Children in the same crew see your child's ship name, which Numbula made up. They also see the stars your child earned this week, and whether they practiced today. If the crew leader turned on the crew table, they see each child's place too. They never see your child's name or age band.
• The crew leader sees each child's ship name and stars this week, and who added the child: your first name and the first letter of your last name.
• Numbula's admins, who can open any account to help when you write to us. They see your username, name and plan, your email, whether it is verified, and when mail to it bounced or was marked as spam, whether and when you agreed by emailed code, whether you have a password and a Facebook or Google connection (its name and when you connected it), how many devices are signed in, each child's name, age band, ship name and stage, the crews you lead or have a child in, and any feedback you send.
• Admins also see the totals across every account described above, a list of recent single visits to this website and the grown-up area (the time, the page, where the visit came from, the country and the kind of device, with no IP address and no account), and recent plan changes by username. Only admins read feedback.
• Admins read each Tell us note in full, with what it recorded: the screens opened, each question with the answer your child gave, and taps on Hear it. They use it to improve the app. Outside Tell us notes, admins cannot see a child's answers or rounds.
• Admins cannot see an IP address, the counts of wrong passwords, PINs and codes, or the ID Facebook or Google gives you.
• Fly.io, a company in the United States, runs the server Numbula runs on, in Singapore. Requests reach that server through Fly.io's network, with your IP address in them.
• Cloudflare, a company in the United States, carries every request between your device and that server, so it sees your IP address and which pages you open. On a page that shows an email address, Cloudflare adds a small script of its own that hides the address from robots that collect addresses, and shows it to you as normal. Cloudflare also asks your browser to tell it when a page fails to load, with the page's address and the error. Those reports go to Cloudflare, and Numbula never sees them.
• Neon, a company in the United States, stores the database, in Singapore.
• Better Stack, a company in the United States, checks every few minutes that the website answers. It sees no one's data: it only loads public pages.
• Pip's voice is your browser's own speech. Some of those voices are online: Chrome's Google voices and Edge's online voices send the words Pip says to Google or Microsoft to turn them into sound. Those words are the questions and Pip's own lines, never a name. Pip's voice starts on Automatic, which uses only a voice on the device, never an online one. On a device with no English voice of its own, Pip stays quiet. An online voice is used only if you pick it from the voice list in the child's settings in the grown-up area, which marks each online voice before you hear it. On Automatic, on a voice marked On this device, or with Pip set to Off, the words stay on the device.
• If you are a crew leader, the families in it see your first name and the first letter of your last name, or your full name on a school crew.
• Our server logs each request's method, page address (cut off before any ?), status, size and how long it took, but not your IP address.
• Amazon Web Services (Amazon SES), which sends Numbula's email. It gets your email address and the email itself (a code, a notice, or news if you said yes), never anything about your child. It processes them in US East (N. Virginia) (us-east-1). It may store each email and scan it for spam and viruses, and AWS does not say for how long. If an email to your address bounces for good, Amazon SES keeps the address on a list so Numbula stops writing to it, until we take it off.
• Meta, which runs Facebook, only if you choose to sign in with Facebook. It learns that you signed in to Numbula, and receives nothing about your child.
• Google LLC, only if you choose to sign in with Google. It learns that you signed in to Numbula, and receives nothing about your child. The sign-in data page (/sign-in-data) says what Numbula gets from Facebook and Google and how to remove it.
• Nobody else, except where the law requires us to share it. If Numbula is ever sold or merged, the buyer keeps to this notice, and we email you before your data moves.
• We do not sell data or share it for advertising, and no page loads an advertising or analytics script from another company, so there are no advertising or analytics trackers. The only script from another company is Cloudflare's, above, on a page that shows an email address.

Keeping it safe

• Passwords and grown-up PINs are stored only as scrambled hashes, so nobody can read them, not even us.
• The sign-in cookie is signed, so it cannot be changed, and scripts on the page cannot read it.
• Every request between your device and Cloudflare goes over HTTPS, so nobody along the way can read it.
• Only Numbula's admins can open an account, to help when you write to us.
• No system is perfectly secure. If a breach affects you or your child, we tell you.

What Numbula keeps on your device

__numbula (a cookie)

Keeps you signed in, and remembers which child is playing, when the grown-up PIN was last entered, and when you last confirmed it is you. While you reset a forgotten password or PIN, it holds the username or email you typed for up to 15 minutes. While you sign in with Facebook or Google, it holds random values for up to 10 minutes, to check that the answer comes from the sign-in you started, and for a sign-up with Facebook or Google, it holds the ID, name and email it sent, and whether Google checked the email, for up to 15 minutes. Once a step has run out, the first page you open on Numbula removes it. It holds an ID for this device's sign-in, so Settings can sign it out from another device. It is signed, so it cannot be changed, and scripts on the page cannot read it. It expires 30 days after Numbula last updates it, which happens when you sign in, pick who is playing, enter the PIN or change your password, and when it removes a sign-in step that has run out. Logging out removes it and signs this device out; your other devices stay signed in. With Heartbeat Kids, it also holds random values for up to 10 minutes while you sign in there, and the time Numbula last tried to sign you in by itself or you logged out, so it waits 10 minutes before trying again, and, on a device a child used, that it never signs in by itself until a grown-up signs in or enters the PIN. Logging out leaves only those in it.

numbula.install-prompt.dismissed (local storage)

Set when you press Not now on the Install Numbula prompt in the grown-up area, or turn down your browser's own install dialog there, so it stops asking on this device. It holds the number 1 and nothing else. Logging out clears it.

numbula.tell.trail (session storage)

What happened in the app on this device in the last stretch of play: the screens opened, each question with the answer given, and taps on Hear it, so a note sent with Tell us can include them. It stays in this browser tab, goes when the tab closes or you log out, and leaves the device only in a note you send with it switched on.

numbula.tell.draft (session storage)

A note you have started in Tell us and not sent yet, with any pictures you took for it, so it survives moving between screens. It goes when you send it or throw it away, when the tab closes, or when you log out.

numbula_no_count (a cookie)

Set only if you turn off Count my visits on the counting page (/counting), so Numbula counts nothing from this browser. It holds the number 1 and nothing else. It lasts a year, or until you turn counting back on. Logging out keeps it.

numbula_canvas_debug (a cookie)

Set only if you turn on the app's frame-time panel, used to test how smoothly the app draws on this device. It holds the number 1 and nothing else. It lasts a year, or until you turn the panel off.

numbula_canvas_debug_hud (local storage)

Where that frame-time panel sits on the screen and whether it is folded, on this device. Nothing about you or your child. Logging out clears it.

The app's own files

The installed app keeps copies of Numbula's code, styles, pictures and fonts so it opens quickly. They hold nothing about you or your child.

What you can do

A copy

Press Download our data on Settings in the grown-up area. You get one JSON file, which any text editor opens, with everything we hold about you and your children: your account, your signed-in devices, your Facebook or Google connection if you made one (its name, email and dates, not its ID), your feedback and Tell us notes and the pictures sent with them, your plan changes, your Stripe customer ID if you have been to Stripe's checkout, your subscriptions and the renewal terms you agreed to at Checkout if you pay for a plan, the copy of your Heartbeat Kids account we keep if you sign in with Heartbeat Kids (your name, email, plan, children and subscription as the account service last sent them), the days you opened the grown-up area, the admin notes on your account, the codes we email you (what each is for, the address, its wrong tries and dates, never the code), an old address while its undo link works, when your password last changed, the counts of wrong passwords, PINs and codes kept under your username or account ID, the crews you lead, and each child with their settings, answers, rounds, facts, lessons seen, Versus pacing, stars, ship parts, crews and sign-in codes. Other children in a crew appear by their full ship name only, as on the grown-up screens, and only in a crew your child has joined: a crew still waiting for its crew leader's approval appears by its name alone. In a crew someone else leads, only children who have joined are listed, not ones still waiting. Your password and PIN are not in it, not even scrambled, and nor is anything that would sign a device in.

A correction

Change a child's name, age band or ship name on the child's settings, and your own name, username, email, password, PIN, time zone and news choice on Settings. You do not need to ask us.

Deletion

Delete a child yourself from the child's page in the grown-up area: the child goes at once, with every answer, round, star, ship part, lesson seen and crew place of theirs, their Versus pacing, and every note sent with Tell us while they played, pictures included, and a device handed to them is signed out. Or reset a child's progress on the same page: every answer, round, star, coin, ship part, fact and lesson seen of theirs goes at once, with their Versus pacing, and what each of their Tell us notes recorded about play and the pictures sent with them; the words of each note, the child, their settings and their crews stay.

Closing the account

Press Close the account on Settings and confirm it is you with your password, Facebook or Google. Every device signs out at once, and nobody can use the account after that, so no child can play. 30 days later Numbula deletes it, and every child, answer, round, star, crew, setting and piece of feedback on it goes at the same moment, with the notes admins keep about it and the counts of wrong passwords, PINs and codes kept under its username or ID. A crew you lead ends for everyone in it, so children from other families lose their place in it, but their own answers, stars and progress stay on their accounts. Until then, log in and choose Keep my account to change your mind. If you would rather it went now, write to [email protected] with your username and an admin deletes it straight away. After an admin deletes an account, Numbula keeps one line: that the account with its ID was deleted, which admin did it, and when. It holds no username, name or anything else of yours.

If you are a parent in the United States

Before Numbula holds anything about your child, it asks for your agreement by a code it emails you: typing the code is your agreement. An account that never agrees is deleted, with its email, after 14 days.

COPPA gives you these rights over what Numbula holds about your child. Each is something you can already do yourself, as What you can do, above, says.

• To review it: press Download our data on Settings in the grown-up area. The file holds each child's data, and the Tell us notes sent while they played.
• To have it deleted: delete the child from their page in the grown-up area, or reset their progress to delete their answers and rounds and keep the child.
• To refuse any further collection: delete the child, or close the account. Either way, Numbula collects nothing more about them.
• Or write to [email protected] with your username, and we help you do any of these.
• If someone else added your child, such as a relative or a tutor, that person holds the account, and only they can delete your child or reset their progress. Ask them. Or write to [email protected] with your child's name and who added them, and we pass your request on to them.

How long we keep it

• We keep what we hold about you and your children while the account is in use: until you delete a child, reset a child's progress or close the account, or the account goes unused, below.
• To keep the database small, we may remove answers and rounds that are more than a year old. What your child has learned stays: the facts they know, their stage, their stars, coins and ship parts.
• An account with no visit to the grown-up area and no round played for 24 months is deleted, with every child on it, in the daily check. 30 days before, we email a warning to the account's email, if it is verified and mail to it has not bounced. Opening the grown-up area, or a child playing a round, starts the 24 months again.
• A closed account is deleted 30 days after it was closed. Numbula checks once a day, so it can go up to a day after that.
• An account that never agrees, by typing the code we email, is deleted with its email 14 days after sign-up, in the same daily check. It holds no child, because a child can only be added after agreeing.
• When an account or a child is deleted, everything on it goes from Numbula at once: for an account, that includes your email, your Facebook and Google connections and your news choice. A backup can hold it for up to 30 days more, below.
• A signed-in device's record goes when that device signs out, when the password changes, or 30 days after the device was last used, when its cookie has expired. Those unused records are deleted the next time anyone signs in. A sign-in code for a child's device goes when it is used, when you stop it or make a new one, when you close the account, and after its 10 minutes if nobody used it: the next time anyone makes or types a code.
• A code we email you works once, for 10 minutes. It is deleted when it is used, after 5 wrong tries, or when a new code for the same thing replaces it. A code that runs out is deleted when you next type it, or the next time anyone asks for a code.
• The undo link we send when your email changes works for 7 days. Your old address and the link's scrambled hash go when the link is used, when the account is deleted, or in the daily check once the 7 days are up.
• Disconnecting Facebook or Google deletes what it gave us at once.
• The counts of wrong passwords, PINs and codes, and of the codes we email you, kept under your username or your account's ID go when the account is deleted. Counts kept under an IP address, under the scrambled hash of an email address, or under a username or email that matches no account, are deleted 30 days after the last try, in the daily check.
• A record of a page visit, and a day's screen and button totals from the child app, belong to no account. Numbula deletes each once it is 400 days old, in the same daily check.
• Neon keeps the last 6 hours of the database's history, so it can be put back as it was at any moment in that time. Our own copies of the database, kept as backups, are deleted once they are 30 days old. So a deleted account or child can still be in a backup for up to 30 days after it goes from Numbula.
• Our server's log is kept by Fly.io, which keeps logs for 7 days. Its lines hold no IP address.