Privacy Policy

Little Bereans is operated by ZO Tech LLC, a Virginia limited liability company. We are the data controller for the information described here.

For any question about this policy or your family’s data, write to our contact form.

From the parent

• Account identity. Your email address and the name and profile picture your sign-in provider gives us when you sign in with Google.
• Family setup. An optional family name, and the child profiles you create.
• Voice recordings. If you record a memory verse in your own voice for your child to practise with, we store that audio file.

About each child, entered by the parent

• First name, and an optional display name the child may pick.
• Age (profiles are for ages 3 to 18).
• Boy or girl, used for profile context.
• Reading level.
• The avatar chosen from our built-in collection.
• Any private notes the parent chooses to add.

From the child’s learning

• Which lessons and practice items have been opened and completed, and progress through an assignment.
• Answers a child prepares and monologue scripts they write inside a practice activity.

Technical information

• Session cookies that keep a parent signed in and keep a child inside their own learning space.
• Ordinary server logs kept by our hosting provider, which include IP addresses, for security and troubleshooting.

Some of the most important facts about this product are the things it does not do:

• No advertising and no ad networks. We do not serve ads, and no advertising or ad-measurement code runs in the app or on this website.
• No third-party analytics or tracking. There is no analytics SDK, no tracking pixel and no cross-site tracking anywhere in the product.
• No selling or sharing of personal information. We do not sell personal information, and we do not share it for cross-context behavioural advertising, under any law that uses those terms.
• No child contact details. A child has no email address, no username and no password in Little Bereans, and we never ask a child for one.
• No social features. Children cannot message each other, see other families, post publicly, or upload photos or video.
• No precise location, contacts or camera access.

• To run the service — signing a parent in, keeping a child in the right learning space, saving progress, and showing the right lesson next.
• To keep it working — diagnosing errors, preventing abuse, and protecting accounts.
• To answer you — replying when you contact support or make a privacy request.
• To meet legal obligations— including our duties under children’s privacy law.

Where UK or EU data protection law applies, we rely on these bases:

• Contract — to provide the service a parent has asked for.
• Consent— for a child’s information, given and withdrawable by the parent who holds the account.
• Legitimate interests — keeping the service secure and working, balanced against your rights.
• Legal obligation — where we must keep or disclose information by law.

We use a small number of providers, each under contract and each acting only on our instructions. They are listed in full, with what each one does, on our Third-Party Services page.

We also disclose information if the law requires it, or to protect the safety of a child or another person.

• While the account is open.Profiles and learning progress are kept so a child’s work is still there tomorrow.
• A removed child profile is deactivated immediately and stops appearing anywhere in the product. A parent can ask us to erase it outright.
• A deleted account and everything in it is removed from our live systems, and ages out of routine encrypted backups within 30 days.

As the parent, you may ask us to give you a copy of the information we hold about you and your children, correct it, delete it, or stop a particular use of it. You may also withdraw consent for a child’s information at any time, which means deleting that child’s profile.

Much of this is immediate and in your own hands — see Data & Account Deletion. For anything else, write to our contact form and we will respond within 30 days.

Depending on where you live, you may also have the right to complain to a data protection regulator. We would rather you came to us first.

• Traffic is encrypted in transit, and data is encrypted at rest.
• Database access is restricted row by row, so one family’s records cannot be read by another family’s session.
• Parent voice recordings are held in a private storage bucket that is not publicly readable.
• A child’s session is a signed, scoped token that grants access to that child’s learning space only.
• Administrative access is limited to named staff who need it.

Our systems are hosted in the United States. The database, authentication, file storage, website hosting and error monitoring listed on our third-party services page all run there. If you use Little Bereans from another country, your information will be transferred to and processed in the United States under appropriate safeguards, including standard contractual clauses where required.

If we change this policy in a way that materially affects your family — a new category of data, a new provider, a new purpose — we will email the parent on the account before it takes effect. The date at the top of this page always shows the current version.