Caregiver account
- Display name and email address.
- A hashed password and the sign-in records needed to keep the account secure.
- The household the account belongs to and its role in it.
Privacy notice
What we keep, and what we refuse to keep.
WonderSteps is used by a grown-up to notice how their own child approaches problems. That only works if the family stays in control of everything it produces.
Who we are
WonderSteps is a product of Quorin Tech, which is the data controller for everything described here. The caregiver who creates the account is our user; the child never has an account, never signs in, and is never contacted by us.
WonderSteps is an educational product. It is not a medical device, a clinical screening tool, or an assessment service, and nothing it produces is a diagnosis.
What we collect
Only what the loop needs. Each group below is everything in that group — not examples.
Child profile
- A nickname chosen by the caregiver — it does not have to be the child's real name.
- Age in whole years, within the 4–8 experimentation range.
- An illustrated character chosen from the built-in library. Not a photograph.
Learning records
- Which activity version was presented, in which context, and when.
- The short structured choices a caregiver picks after an activity, such as what happened next.
- Optional free-text notes a caregiver writes, and the factual Wonder Moments saved from them.
- Derived evidence and progress records, each linked back to the response and rule version it came from.
Operating the service
- Server and error logs needed to keep the service running and secure.
- Role-gated audit records for administrative actions and privacy requests.
- A small allow-list of product events carrying an activity id, version and context only. The event checker rejects child identifiers, nicknames, free text, responses, tokens and email addresses.
Cookies and on-device storage are listed separately, one entry at a time, on the cookies and storage page.
What we never collect
- A child's legal name, photograph, voice recording or date of birth.
- School, class, teacher or precise location.
- Advertising, cross-site tracking or device fingerprinting identifiers.
- Anything at all about a child used for advertising, sold, or used to train an AI model.
These are design constraints, not preferences. There is no field to type a school into and no way to upload a photograph, so there is nothing of that kind for us to lose, be asked for, or change our mind about later.
Why we process it, and on what legal basis
| Purpose | Legal basis | What that covers |
|---|---|---|
| Creating an account and providing the service | Contract — Article 6(1)(b) | Signing in, keeping a child profile, running activities, saving observations and showing them back to the caregiver. |
| Keeping the service secure and working | Legitimate interests — Article 6(1)(f) | Preventing unauthorised access to a household's records, diagnosing faults, and keeping audit records of administrative and privacy actions. Balanced against the interests of the family, which is why logs exclude child data and notes. |
| Answering a privacy request | Legal obligation — Article 6(1)(c) | Recording, processing and evidencing export and deletion requests under Articles 15 to 22. |
| Optional features that are not required to run the service | Consent — Article 6(1)(a) | None are active today. Any such feature will be off until it is switched on, and can be switched off again at any time without losing the service. |
Children's data
The account holder must be an adult with parental responsibility for the child, or acting with the consent of someone who has it. The child is not our user: there is no child login, no messaging, no social feature, no public profile and no way for one family to see another.
A child profile is deliberately thin — a nickname the caregiver chooses, an age in whole years, and an illustrated character. Learning records describe what happened during an activity, entered by the caregiver, and are only ever visible inside that household.
Child-facing screens never show interpretations, evidence, scores or anything written for the grown-up. Under GDPR Article 8 and its national variations, where consent is ever the basis for anything, it is given and withdrawn by the caregiver.
How long we keep it
Awaiting approval. These are the proposed periods; privacy review must approve them for each launch region before families are onboarded.
| Record | Period |
|---|---|
| Household learning records | Kept while the caregiver account is active. |
| Abandoned, incomplete activity sessions | 90 days. |
| Sign-in and security audit records | 12 months. |
| Privacy-request audit records | 24 months after the request is completed. |
| Backups | A rolling window of at most 30 days. |
A deletion request removes derived evidence and interpretations alongside the raw records, and ages out of backups on the same schedule. Deletion is tracked as a request with a recorded result, so it can be shown to have completed.
Who else sees it
Nobody buys it, and nobody advertises with it. We do not sell family data, share it with advertisers or data brokers, or use anything about a child to train an AI model.
Awaiting approval. No production processor has been approved yet. Before launch we publish each one — hosting, database, email delivery, error monitoring and any optional AI provider — with its region, purpose, data categories, retention, data-processing agreement and deletion behaviour. Transfers outside the EEA, if any, will name the safeguard used under Chapter V.
If any AI feature is ever introduced, it stays optional, reviewable, and never the source of truth for anything said about a child. Child behavioural data is excluded from model training under every agreement we sign.
Automated decisions, profiling and interpretation
- Which activity to suggest next is decided by deterministic, versioned rules that are inspectable and tested, not by a model that scores your child.
- Every suggestion stores the human-readable reason it was chosen, and that reason is shown to you.
- There is no profiling that produces legal or similarly significant effects, so Article 22 does not apply. There is no score, ranking, ability estimate or diagnosis, and there never will be.
- Caregiver-facing pattern interpretations stay switched off until the exact deterministic rule version has passed independent educational and safety review.
- An AI model is never the source of truth for anything WonderSteps concludes about a child.
Your rights, and how to use them
Two of these are buttons inside the app rather than a request you have to write. That is deliberate.
Access and portability Articles 15 and 20
Settings → Download a copy. The export is machine-readable JSON scoped to your household: profiles, sessions, structured responses, evidence, Wonder Moments and interpretations.
Rectification Article 16
A child's nickname, age and character can be edited from the profile at any time. For account details, use the contact route below.
Erasure Article 17
Settings → Delete family data, or delete a single child profile from that profile. Deletion is a tracked request covering derived evidence as well as raw records, not an ad-hoc row delete, and is confirmed when it completes.
Restriction and objection Articles 18 and 21
Ask us to pause processing while a question is resolved, or object to processing based on legitimate interests, using the contact route below.
Withdrawing consent Article 7(3)
Any optional feature that needs consent can be switched off at the same place it was switched on. The service keeps working without it.
Complaining to a regulator Article 77
You can complain to the data protection authority in the country where you live or work. We would rather hear from you first, but that right does not depend on us.
Exercising any of these is free, and using one never degrades the service or costs you access to anything.
Security
Every read and write of a child's records is scoped to the signed-in caregiver's household, and cross-household access is tested explicitly rather than assumed. Passwords are stored hashed. Session cookies are HTTP-only and, on HTTPS deployments, marked secure. Administrative capability is role-gated and audited.
Application logs and product analytics exclude child identifiers, nicknames, free text, responses and tokens — the analytics checker rejects such a payload rather than trusting the caller.
Changes and contact
This notice is versioned. A change that affects what we do with family data is published here with a new date, and the storage notice asks again rather than carrying over an answer given to different wording.
A monitored address for privacy questions and data requests is being set up and will be published here. In the meantime the two requests people need most do not go through us at all: downloading and deleting your family's data are both buttons in Settings.
You can also complain to the data protection authority where you live or work. We would rather you told us first, but that right does not depend on us.