Privacy Policy
Last updated July 1, 2026
Draft — pending legal review. This document is a good-faith draft and is not yet legally binding. It is being reviewed by a qualified Canadian privacy lawyer before public launch and does not constitute legal advice.
Brightwick(“Brightwick,” “we,” “us”) provides a self-study learning app for Canadian children in Grades 3–8. We are built privacy-first for young learners and designed around data minimization. This policy explains what we collect, why, and the choices you have. It is written to align with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).
Who controls the account
A subscribing parent or guardiancreates and controls the account. Children do not sign up on their own — a parent creates each child profile and provisions the child’s sign-in. Parents consent to this policy on their child’s behalf at signup.
What we collect
- Parent account: email address and an encrypted password (handled by our authentication provider; we never store passwords in plain text).
- Child profiles: a nickname, grade level, and an avatar choice. We deliberately do notrequire a child’s real name or email.
- Learning activity: lessons viewed and quiz attempts (questions answered, correctness, timestamps) used to score progress and power the parent dashboard.
- Billing: subscription status. Payments are processed by Stripe; we do not store your full card number.
- Operational logs: limited, security-relevant events (e.g. sign-in attempts and IP address) kept to protect accounts, never to build advertising profiles.
What we do not do
- We do not show ads or embed third-party advertising trackers.
- We do not sell, rent, or trade personal information.
- We do not require a child email address or real name.
Why we collect it
We use the information above only to run the service: to authenticate users, deliver curriculum-aligned lessons, score quizzes, show parents their child’s progress, process the subscription, and keep accounts secure. We do not use children’s data for advertising or profiling.
How we share it
We share personal information only with the service providers needed to operate Brightwick — our hosting/database provider (Supabase), payment processor (Stripe), and infrastructure providers — each under contractual data-protection obligations. We may disclose information if required by law. We never sell data.
Data retention
We keep account and learning data for as long as the account is active. When a child profile or the account is deleted, we remove the associated personal data within a reasonable period, except where we must retain limited records to meet legal or security obligations.
Your rights and choices
Parents can review, correct, export, or delete their child’s profile and data at any time from the parent dashboard, and can cancel the subscription from the billing page. To make a broader access or deletion request, contact us using the details below.
Security
We apply a security baseline including row-level access controls, server-side authorization checks, a strict content-security policy, rate limiting on sign-in, and audit logging. No system is perfectly secure, but we hold a higher bar because we build for children.
Changes to this policy
If we make material changes we will update the “last updated” date and, where appropriate, ask parents to review the revised policy.
Contact
Questions about privacy? Email privacy@brightwick.ca. See also our Terms of Service.