Privacy Policy
Age Dictionary Last updated: July 2026
This document should be reviewed by a qualified solicitor before being published. It is written to reflect Age Dictionary's actual data practices as implemented, but does not constitute legal advice.
Age Dictionary is a vocabulary learning service for children, operated as a sole trader business in the United Kingdom. This policy explains what personal data we collect, why we collect it, and how we protect it.
We take children's privacy seriously. Age Dictionary is designed so that children never provide personal data to us directly — all child accounts are created and managed by a parent or teacher.
Who We Are
Age Dictionary is operated by [YOUR FULL NAME], trading as Age Dictionary, based in the United Kingdom. You can contact us at: hello@agedictionary.com (or your contact email).
For the purposes of UK GDPR, we are the data controller for the personal data described in this policy.
What Data We Collect and Why
Parents and Teachers
When you create an account, we collect:
- Email address — to identify your account, send you progress updates, and billing communications
- Name (if provided) — to personalise communications
- Role (parent or teacher) — to show you the right features
- Billing information — handled entirely by Stripe. We never see or store your card number. Stripe provides us with a customer reference ID and subscription status only.
We collect this data because it is necessary to provide the service you've signed up for (GDPR Article 6(1)(b) — performance of a contract).
Child Profiles
Child profiles are created by parents or teachers, never by children themselves. We collect:
- Child's first name — displayed within the app
- Age band or date of birth — used to calibrate vocabulary difficulty. We store only an approximate age band, not the full date of birth where avoidable.
- Vocabulary tier (1, 2, or 3) — set by the parent, used to personalise word definitions
We do not collect email addresses, phone numbers, or any contact information from children. We do not knowingly collect personal data directly from children under 13 without verifiable parental consent. A child profile is always created under a parent or teacher account, which constitutes that consent.
For children in the United States under the age of 13, our practices are designed to comply with the Children's Online Privacy Protection Act (COPPA). If you believe a child has provided personal data to us without parental consent, contact us immediately and we will delete it.
Usage Data
For all users, we collect data about how the service is used:
- Words searched — to return definitions and track learning progress
- Words saved (the journal) — to power the spaced repetition review system
- Review results — whether a word was marked "got it" or "not quite", used to schedule future review sessions
- Streak data — daily activity tracking to display the streak counter
- Device tokens — to enforce the two-device limit per child profile. We store a hashed token, not device identifiers.
- Search history — retained for a limited period for service improvement and support purposes
We collect usage data on the basis of legitimate interest (GDPR Article 6(1)(f)) — it is necessary to provide the core features of the service and cannot reasonably be separated from them.
Billing and Subscription Data
We use Stripe to process payments. When you subscribe:
- Stripe collects and stores your card details on their servers (governed by Stripe's own privacy policy)
- We receive and store your Stripe customer ID and subscription status
- We do not store card numbers, CVV codes, or full card details at any point
The Classroom Invitation Feature
If you are a teacher using Age Dictionary, you may share a classroom invitation link with parents of your students. Here is exactly how this works from a data perspective:
- The invitation link contains only a classroom code — no personal data
- When a parent follows the link and creates an account, they are creating a direct relationship with Age Dictionary, not with you
- We do not share parent personal data (email address, name, or payment information) with teachers at any point
- Teachers can see that a parent has joined their classroom (a count of joined parents), but not who they are by name or email
- The commercial relationship (subscription, billing) is entirely between the parent and Age Dictionary
If you are a teacher sharing a classroom invitation link, you are acting as a data processor in a limited sense — you are distributing a link. You are not processing any personal data by doing so, and Age Dictionary remains the data controller for all data collected through the signup process.
Who We Share Data With
We share data with the following third-party services, all of whom process data on our behalf under appropriate agreements:
- Stripe (stripe.com) — payment processing and subscription management. Stripe is certified to PCI DSS Level 1.
- Supabase (supabase.com) — database hosting. Data is stored on servers within the European Union.
- Vercel (vercel.com) — application hosting and deployment.
- Resend (resend.com) — transactional and weekly email delivery.
We do not sell personal data to any third party. We do not share personal data with advertisers. Age Dictionary does not run advertising.
How Long We Keep Data
- Account data — retained for as long as your account is active, plus 90 days after account deletion to allow for disputes or reactivation
- Child profile data — deleted when the parent deletes the child profile, or when the parent account is deleted
- Usage data (searches, saved words, review results) — retained while the account is active. You may request deletion at any time.
- Billing records — retained for 7 years as required by UK tax law, even after account deletion
Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you and your child's profile — contact us to request a copy
- Correct inaccurate data — you can update most data directly within the app
- Delete your data — you can delete your account from your profile page. Child profile data is deleted when you delete the profile.
- Port your data — we can provide your data in a machine-readable format on request
- Object to processing based on legitimate interest — contact us and we will review
- Withdraw consent for marketing emails — use the unsubscribe link in any email we send
To exercise any of these rights, contact us at: hello@agedictionary.com
We will respond within 30 days. We may ask you to verify your identity before processing requests.
Cookies and Tracking
Age Dictionary uses only functional cookies necessary to keep you signed in. We do not use advertising cookies, tracking pixels, or analytics that follow you across other websites.
Security
We take reasonable technical measures to protect personal data, including:
- Encrypted connections (HTTPS) for all data in transit
- Hashed device tokens (we cannot reconstruct the original token)
- Child sessions using separate JWT credentials from adult accounts, with no connection to your email or billing information
- Restricted access to production data (only authorised personnel)
No system is completely secure. If you become aware of a security issue, please contact us immediately.
Changes to This Policy
We will notify you by email if we make material changes to this policy. The "last updated" date at the top of this page will always reflect the most recent version.
Contact
Age Dictionary Email: hello@agedictionary.com
If you are not satisfied with how we handle a complaint, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.