This Privacy Policy explains how 11+ Daily collects, uses and protects personal information when you use the service. We are committed to protecting privacy and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and the Information Commissioner's Office (ICO) Age Appropriate Design Code (the "Children's Code").
1. Who we are
11+ Daily is operated by Egghead Studios Ltd, the data controller responsible for personal information processed through the service.
- Company: Egghead Studios Ltd, registered in England and Wales
- Company number: 17398942
- Registered office: 124 City Road, London, EC1V 2NX, England
- Contact: support@11plusdaily.co.uk or our contact form
2. Who this service is for, and children's data
11+ Daily is designed for children aged 9 to 11, and it is built around a parent or guardian account. Accounts must be created and held by a parent or legal guardian aged 18 or over. The parent or guardian is the account holder, the person we contact, and the person responsible for the account. The child does not create or hold their own account.
We ask for one piece of information about the child: a first name or nickname, so the app can address them by name. A nickname is fine. We do not ask for or store a child's date of birth, age, gender, school, address, telephone number or photograph, and we never ask a child for their own contact details.
The study activity recorded under an account is about the child. That includes the questions they answer, whether each answer was right, which topics they find hardest, which days they practise, and their streak and progress. We treat this as the child's personal data and we protect it accordingly, whoever holds the account.
How we personalise practice. The app works out what your child should practise next from their own answers. It notices which questions they got wrong and brings those back at spaced intervals, it identifies the topics where their accuracy is lowest, and it adjusts the mix of new and repeated questions as the exam date you have entered gets closer. This is a form of profiling under data protection law, and we are open about the fact that we do it, because it is the main thing the service is for. It uses only your child's own practice history. It never compares your child to other children, it never infers anything about them beyond how accurate they are on each topic, it never restricts access to any part of the service, and it is never used for advertising or shared with anyone else.
Streaks, points and achievements. The app records a daily streak, awards experience points and unlocks achievements as your child practises. These are designed to support a regular study habit. They are visible only to your child and to you, and they are never used to decide anything about your child.
What we do not do. We collect only the data we need to run the service. We do not show advertising. We do not use analytics, tracking or session-recording tools of any kind. We do not collect location data. We do not sell children's data, and we do not share it with anyone for marketing purposes. There is no way for your child to be contacted by another user, because the service has no messaging, no chat and no public profiles.
We have assessed the impact of this service on children through a data protection impact assessment, in line with the Children's Code, and we keep that assessment under review.
If you believe we hold data about a child that we should not, please contact us via our contact form or at support@11plusdaily.co.uk and we will look into it and delete anything we should not be holding.
3. What data we collect
We collect the following information when you use 11+ Daily:
- Account information: the child's first name or nickname, the parent or guardian's email address, and a hashed password
- Study and usage data: sessions completed, scores, streaks, bookmarks, project activity and the exam preferences you choose (such as exam month, year, board and the school you are aiming for)
- Subscription data: whether you hold a Pro subscription, the plan and its expiry date. We use RevenueCat to keep track of subscription status across the website and our mobile apps. Card details are handled by Stripe for purchases made on the web, or by Apple or Google for purchases made inside a mobile app, and are never seen or stored by us
- Communications: contact form submissions and emails you send us for support, including your name, email address, selected reason, message content and limited anti-abuse data
- Technical information you send when you contact us: if you use the contact form or send feedback from inside the app, we receive your message together with the page you were on, your browser or device type and version, your browser language and your time zone. We use this only to understand and reproduce the problem you are describing
- Security data: a one-way encrypted form of your IP address, stored to prevent abuse of our public forms. We do not use it to track you
We do not collect your postal address or phone number. We do not use advertising or tracking cookies, and we do not run analytics on the service.
4. How we use your data and our lawful bases
We use your data to:
- provide and maintain the 11+ Daily service and your account
- track study progress and show personalised statistics
- choose which practice questions to show your child next, based on their own previous answers, as described in section 2
- process subscriptions and send receipts and renewal reminders
- send transactional emails such as password resets, email verification and account security notices
- respond to support queries and contact enquiries
- keep the service secure and prevent abuse of the public contact form
- comply with our legal and accounting obligations
Our lawful bases under UK GDPR are:
- Performance of a contract with the account holder, to provide the service you signed up for, manage your account and process subscriptions
- Legitimate interests, to keep the service secure, prevent fraud and abuse, and maintain a clear support record, balanced against your rights and especially the interests of children
- Legal obligation, to retain records we are required to keep, for example for tax and accounting
5. Marketing emails and your choices
During your free trial we may send a small number of product emails covering progress updates, trial-end reminders and guidance on getting the most out of the service. These rely on the soft opt-in under Regulation 22 of PECR, because you provided your email address while signing up for a free trial of our paid service. Every marketing email includes an unsubscribe link, and you can opt out at any time using that link or by contacting us. Transactional emails (password resets, verification, account security and billing) are necessary to provide the service and are sent regardless of marketing preferences.
6. Cookies and local storage
We use only strictly necessary cookies and similar local storage, for the sole purpose of keeping you signed in and operating the service securely. We do not use cookies or similar technologies for analytics, tracking or advertising, so no cookie consent banner is required.
7. Third parties we use
We use a small number of trusted service providers (processors) to operate 11+ Daily. They act on our instructions under data processing agreements:
- Neon, database hosting. Data is stored in the UK (Amazon Web Services London region, eu-west-2)
- Cloudflare, hosting and content delivery
- RevenueCat, subscription management
- Resend, transactional and product email delivery
For subscriptions bought on our website we are the seller. Card payments are processed for us by Stripe, who handle your card details so that we never see or store them, and who send your receipts and billing notices. Stripe acts as our processor for taking the payment, and as an independent controller for its own fraud prevention and legal obligations.
A subscription bought inside one of our mobile apps works differently. There the store is the seller of record, not us. These companies are not our processors: they sell the subscription to you in their own right, take the payment, and decide for themselves how they handle the personal data involved:
- Apple and Google, sellers of record for a subscription bought inside a mobile app. We receive subscription status only
We do not sell personal data to any third party.
8. International data transfers
Account and study data is stored in the UK. Some of our providers (including Cloudflare, RevenueCat, Stripe, Apple, Google and Resend) are based in or process limited data outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on appropriate safeguards, such as UK adequacy regulations where they apply, or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so that your data continues to be protected to UK standards. You can request more detail about these safeguards using the contact details in section 1.
9. Data retention
We delete personal data 24 months after an account was last used. Signing in resets that clock, so an account in use is never at risk. About a month before we delete anything, we email the parent or guardian to say so, and signing in is all it takes to keep the account. That notice is sent whatever your marketing preferences are, because it is a notice about your account rather than a marketing email.
In detail, we keep:
- Your child's study record (sessions, answers, scores, streaks, bookmarks and progress) and your account details: 24 months from the last time the account was used
- Contact form submissions and feedback: 24 months from the date of the message, or immediately if you delete your account, whichever comes first
- Subscription and payment records: at least six years from the end of the accounting period, because HMRC requires it. At 24 months we strip out everything that identifies you or your child, so what is left is the transaction and nothing about the person who made it
- A record that you unsubscribed from marketing: kept indefinitely, as a scrambled version of your email address and nothing else. We have to remember that you opted out, or we could not reliably stop emailing you
- Password reset and verification codes: seven days
If you ask us to delete your account, we do it straight away rather than waiting for the 24 months to run out, subject to the payment records above. Deleted data is removed from our live systems immediately and then cycles out of our encrypted backups within twelve months, during which it is not accessed for any purpose.
10. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your account and associated data
- Restrict or object to certain processing
- Opt out of marketing emails at any time, while keeping transactional emails active
- Data portability, meaning receiving your data in a machine-readable format
The personalisation described in section 2 is a form of profiling, but it only decides which practice questions your child sees next. It does not produce legal or similarly significant effects, and we do not carry out any automated decision-making of that kind. To exercise any of these rights, contact us through our contact form or at support@11plusdaily.co.uk. We will respond without undue delay and within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), although we would welcome the chance to resolve any concern first.
11. Security
Passwords are hashed using bcrypt and never stored in plain text. All data is transmitted over HTTPS. We take reasonable technical and organisational measures to protect your data, but no system is completely secure. Please use a strong, unique password. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the ICO and, where required, affected users in line with our legal obligations.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or in the app before they take effect. Continued use of the service after the changes take effect means you accept the revised policy.
13. Contact
For any questions about this Privacy Policy or your data, contact us through our contact form or at support@11plusdaily.co.uk.