Sign in

Privacy

How Fathomtrail uses personal data

This notice is for parents, carers and the adults a family invites. It explains what Fathomtrail keeps about the adults and children in a family, who can see it, which outside companies receive any of it, how long it is kept and how to delete it. Concierge Vet Ltd runs Fathomtrail and is responsible for this data. To ask about it, or to use your rights, email office@conciergevet.co.uk.

There is a shorter notice written for children: Fathomtrail and your privacy. Please read it with your child. Children can also find it on their own “Me” page in the app.

Adults: signing in and families

Adults sign in with a Google account. From Google we keep only the account’s email address and the ID Google gives it (see “Services we use”). The person who signs a family up becomes its owner. When they agree to the Terms we record the version they agreed to, when, and which account agreed; they also confirm that they are a parent or carer aged 18 or over. Every other adult agrees to the Terms too: when they accept an invitation, and otherwise the next time they sign in if they have not yet agreed to the current version; we record the version and when with their place in each family, and it is deleted with it. Children are never asked. To stop misuse, sign-ups are limited using a scrambled form of the internet (IP) address, which is not stored.

One adult can belong to several families, for example a tutor who works with more than one family, and has a role in each: owner, parent or tutor. Each family sees only its own members. The owner and parents can see the family’s member list (each member’s email address, role and status); tutors cannot. Tutors join only when a family invites them, and they do not pay. Invitations are kept, with the invited email address, until the family (or the child the invitation was for) is deleted.

Children’s profiles and sign-in

The child’s profile

A parent or the owner creates each child’s profile. It holds a nickname, a colour, the school year, the exam year and whether the child is taking GCSEs or International GCSEs, plus the courses the family chooses for them. We do not ask for a child’s full name, date of birth, email address or Google account; a nickname is enough. A family can have up to four children who are not archived. If a family chooses to, it can also let a child sign in with their own Google account by inviting it from Family settings; that keeps the account’s email address and Google ID in the same way as an adult’s.

Family code and PIN

Children usually sign in with the family code and their own 6-digit PIN, which a parent or the owner sets. Anyone who types the family code sees the nicknames and colours of the family’s children, so that each child can pick their own, unless the family chooses in Family settings that children type their nickname instead; either way, keep the code within the family. A parent can make a new code at any time. We never store a PIN itself. We keep only a one-way scrambled form of it (a hash made with a secret key that is kept apart from the database), so nobody, including us, can read a child’s PIN. PINs that are easy to guess, or the same as a brother’s or sister’s, are refused.

Devices and sessions

When a child signs in on a device, we keep a short label for it, such as “Chrome on Android” (never the browser’s full details), with when it was first and last used, and a random code stored in a cookie on that device (the cookie lasts up to 400 days). The family’s owner and parents can see these devices and sign any of them out. A child stays signed in on their own device for up to 30 days from the last time they used it. We also keep a scrambled form of the internet (IP) address the child signed in from, made with a secret key so the address itself is never stored. We do not use it to work out where anyone is.

Wrong PINs and locks

To stop anyone guessing a PIN, five wrong PINs on one device lock it for 5 minutes, and ten lock it for an hour. Twenty wrong PINs in 24 hours, across all devices, lock that child’s sign-in until the owner or a parent unlocks it from Family settings, and, once service email is switched on, the owner and each parent are emailed to say so (see “Email”). Records of wrong PINs hold the child, the device, the time and a scrambled form of the IP address.

Handing a device over

A parent or the owner can hand their own device to a child. Their Google sign-in on that device ends, the child carries on as themselves, and the parent signs in with Google again to come back. We record which adult started the hand-over. It is kept with that sign-in session; for German assessments it is also kept with the assessment, so that an adult who may have sat it cannot moderate it, but it is never included in the family’s data export.

How long sign-in records are kept

  • Sessions (including the scrambled IP address): deleted 30 days after they end or are signed out.
  • Devices: deleted, with their sessions, once they have not been used for 90 days. A device that has been signed out is kept until then, so parents can still see it.
  • Records of wrong PINs: deleted 7 days after the last wrong attempt.
  • The scrambled PIN: kept until it is changed, or until the child or the family is deleted.

These checks run every 15 minutes. If we ever restore the service from a backup, every child’s PIN is cleared, every device is signed out and every family gets a new family code, so a parent sets new PINs.

Learning records

To teach each child, the service keeps their learning record: the courses, what the child does in each lesson, practice paper and timed mock (their answers, how sure they were, how they rated a topic and what they say they already know, and in a mock which questions they opened and when, and the time allowed), their conversations with the AI tutor and its feedback, marks and comments that adults give, and which topics count as known, not known yet or not checked yet. Spoken answers and daily study summaries are described in their own sections below. For each request the service makes to OpenAI or Microsoft Azure, it also keeps a usage record (which child it was for, which service and model, whether it worked, its size and when), never what was sent; usage records are deleted after 90 days, by the checks that run every 15 minutes. Learning records are kept for as long as the child’s record exists, until the child or the family is deleted. Answers can contain anything a child types, so please ask your child not to put personal details in them.

Who sees what

  • The owner and parents see every child in the family: profiles, courses, answers, marks, progress and conversations with the AI tutor. They manage the children’s PINs, devices and courses, and they can download the family’s data. The owner and parents can see the family’s billing status; only the owner can choose or cancel a plan, or delete a child or the family.
  • Tutors and teachers a family invites see the same learning records for every child in that family, including the conversations with the AI tutor, so that they can review lessons and mark work. They cannot see the member list, billing or the children’s sign-in settings, and they cannot download the family’s data.
  • A child sees only their own work and progress. They cannot see a brother’s or sister’s records. On the sign-in screen, the nicknames and colours of the family’s children are shown, unless the family has chosen that children type their nickname. The children’s notice tells a child that the adults in their family, including any tutor they invite, can see their work and their conversations with the tutor.
  • Nobody in any other family can see anything in yours. The people who run the service (Concierge Vet Ltd) can reach the database to keep the service working and to fix problems, and Cloudflare stores it for us.

Billing

A family gets a 14-day free trial with no card. To carry on after it, the owner chooses a plan and pays through Stripe, a payments company. When they do, our server sends Stripe the owner’s sign-in email address, the country (the UK), the language and a reference for the family, so that Stripe can link the payment to the family. The owner then enters their name, billing address and card details on Stripe’s own payment page. Card details go to Stripe only; Fathomtrail never receives or stores them. We never send Stripe anything about a child.

From Stripe we keep the family’s plan, the subscription’s status and dates, and Stripe’s reference numbers for the customer and subscription. We keep a short record of each message Stripe sends us about the subscription (its type, its time and the family, never its contents) for 90 days. Stripe keeps its own payment records under its own terms. When a family is deleted, we cancel its subscription and ask Stripe to delete the customer.

Email

Once service email is switched on, the service sends a small number of emails about the family’s account. Today these are:

  • Invitations, to the address a parent or the owner invites. They name the family and, when an invitation is for a particular child, that child’s nickname, and carry a link that works once.
  • A locked sign-in, to each owner and parent in the family, when a child’s sign-in is locked after 20 wrong PINs. It names the child by nickname. Tutors do not get it.
  • A weekly summary, only if you turn it on. Each owner and parent can choose it for themselves in Settings, Notifications; it is off until they do, and tutors cannot get it. On Monday morning it gives, for each child in the family, their nickname, the days they studied the week before, about how many minutes, and how many topics became known and how many new gaps were found. It never includes answers, marks or anything the AI tutor wrote, and it does not compare children.
  • Answers waiting, for tutors. On Monday morning, to a tutor who has answers waiting to be marked in the families they tutor: how many answers, and in how many of those families. It names no family, child, subject or answer. It starts once the tutor has opened their tutor page, and the tutor can turn it off there or with the link in the email.
  • A termly report is ready, only if you turn it on. Chosen in the same way, in the first week after each term ends. It names the child by nickname and the term, and links to their report in the app, which only the family’s adults can open.

The emails are sent through an email company (see “Services we use”). We keep each email until it is sent; once it is sent, or cannot be sent, we delete its contents and keep only the address, the kind of email and when, for 30 days. An email that has not gone out within 3 days is never sent. While service email is switched off, no email is recorded at all. If a child is deleted before a locked sign-in, report or weekly summary email naming them has gone, it is never sent and its contents are deleted (so that week’s summary is not sent for the family). We keep each adult’s own choice of these emails until the family is deleted, and a tutor’s choice about the answers-waiting email until they are no longer a tutor in any family. Invitation, weekly summary, report and answers-waiting emails have a one-click unsubscribe link; account emails, such as the locked sign-in email, do not. If you unsubscribe, or an address cannot receive email, we keep a scrambled form of the address so that we do not email it again. That record is kept even after the family is deleted, so that the choice keeps working.

Spoken German, Spanish and French answers

In the German, Spanish and French speaking lessons a pupil can record a spoken answer and send it to be marked. This section explains what happens to that recording, which is the child’s voice and so is personal data.

What is recorded

Only what the pupil records after pressing Record for a speaking task, up to the time limit shown for that task (at most two minutes). Nothing is recorded in the background. The pupil can listen back and record again before sending; only the recording they send is kept. With it we keep the task, the date, the length of the recording, how many times it was recorded before sending, whether help was used in the lesson, whether the pupil had met the task before and, once it is marked, the mark, whether a parent or a teacher marked it, and the marker’s comment.

Who hears it

In the app, the pupil and the parents and teachers in the pupil’s own family workspace, who listen to it in order to mark it. Nobody in any other family can play it. The people who run the service (Concierge Vet Ltd) can reach the database to keep the service working and to fix problems, and Cloudflare stores it for us. No computer or AI service listens to a recording sent for marking, transcribes it or marks it, and it is not used to train any model. That applies only to these recordings. Two other German features do send the child’s voice to an outside service: pronunciation practice, and “Transcribe my answer” in practice papers. Those recordings go from our server to Microsoft Azure for speech recognition, and the app does not keep them (see “Services we use” below). A parent can switch this off for each child in Settings; it starts off for children in Year 8 or below.

Where it is stored and for how long

In the service’s database (Cloudflare D1). The sound is deleted from the live database 30 days after it is first marked, or 90 days after it was sent if nobody marks it; a check runs every day, whether or not the family uses the app. Cloudflare’s database recovery (Time Travel) can restore deleted data for up to 30 days after it is deleted, so for that time a copy can still exist; it is used only to recover from a fault. Private disaster-recovery backups in Cloudflare R2 may also contain the sound. These backups are scheduled to expire after 35 days; storage cleanup normally follows within a day. They are used only for recovery, and restored recordings are removed before the service reopens. The mark, the marker’s comment and the details of the task are kept as part of the pupil’s learning record. The family’s data export includes the marks and those details but not the sound.

Deleting the sound sooner

The pupil or a parent can delete the sound of a recording at any time, from the pupil’s German, Spanish or French plan (“Spoken answers”) or, for a parent, from the marking screen. Deleting removes the sound; the mark and the details of the task stay. A recording whose sound is deleted before it is marked can no longer be marked, so that lesson can no longer count in the pupil’s favour; if another answer in the same lesson is marked as not yet good enough, that still shows as something to work on. You can also ask us to delete recordings by emailing office@conciergevet.co.uk.

German sound practice recordings

In German sound practice a pupil can also record themselves reading aloud and send it to a parent or teacher to review. These recordings are handled in the same way as spoken answers: they are stored only in the service’s database, only the pupil and the adults in the family can play them, and no computer or AI service listens to them. The sound is deleted 30 days after it is reviewed, or 90 days after it was sent if nobody reviews it, and the pupil or a parent can delete it sooner. The review is kept; the sound is not in the family’s data export, and it is removed if a backup is ever restored.

Daily study summaries

To show a family how each child is getting on, the service keeps a short daily summary of each child’s study. It holds counts only.

What is recorded

For each child and each course, at most one row a day: how many study sessions were open that day (none means they did not study that day), roughly how many minutes they spent, how many topics are known, not known yet, not checked yet and due for a recheck, how far the number of known topics and the number of gaps have risen since the course’s previous summary, and how many answers are waiting for an adult to mark. The minutes are an estimate from when each session started and when it was last saved, counting at most 45 minutes for any one session on any one day. A day is the calendar day in the family’s time zone, which is UK time unless the family changes it in Family settings. A summary is written when someone in the family opens a page that shows a course’s progress (the course itself, the daily plan or the progress page), unless the family’s account is read-only, and a nightly check also writes one for courses that have gone a week without one. Every number comes from learning records the service already keeps. The summaries hold no answers, no marks, no grades and no predictions, and nothing in them is used to decide what a child is taught or what counts as known.

Why, and who sees them

They are for the family overview: the family’s adults (the owner, parents and any invited teachers or tutors) see it for every child in the family, and a child sees only their own. Nobody in any other family can see them. As with every record, the people who run the service (Concierge Vet Ltd) can reach the database to keep the service working, and Cloudflare stores it for us; the summaries are not sent to any other company.

How long they are kept

For as long as the course’s other learning records. Removing a course stops new summaries for it and takes it off the overview, but its summaries stay with its other records. They are deleted with the child’s records when a child is deleted, and with everything else when the family is deleted. The family’s data export includes them. Every number in them comes from the learning records, so recovery does nothing special for them: they are in the recovery copies described above like the other learning records, and if a copy is restored, the summaries of any child or family deleted since are removed again before the service reopens.

For children: each day, we may count roughly how many minutes you studied and how many of your topics you know, still need to learn or have not checked yet, but never your answers. Only you and the adults in your family, including any teacher or tutor they invite, can see it.

Timetable and calendar links

The timetable shares a child’s study time out between their courses and shows the exam dates the exam boards publish for those courses. For each child the service keeps how many minutes they have for study on each day of the week and the days off an adult has entered, such as holidays, with who last changed them and when. Until an adult sets them, every day has 20 minutes. Days off that have passed are dropped the next time the times are saved. Only the owner and parents can change them; everyone in the family can see them, and a child sees only their own. They are not used to decide what counts as known.

The timetable can be downloaded as a calendar file. The owner or a parent can also make a calendar link, which a calendar app (for example on a phone) can subscribe to so the timetable stays up to date. Up to three links can exist for each child. The link works without signing in, so anyone who has it can see what it shows: the subjects, the exam papers with their dates and times, and roughly how many minutes of study are planned on each of the next four weeks’ days. It never shows the child’s name or the family’s name. The service keeps only a scrambled form of each link, so it cannot show a link again after it is made; it records who made each link, when it was made, when a calendar last read it and when it was turned off. While the family has full access, a parent can turn a link off at any time and it stops working at once. Links also stop working while the family is read-only (for example after a trial ends) and while their child is archived. Calendar apps keep their own copy of what they have read; turning a link off stops new updates but does not remove that copy from the app.

The study times and the record of each link are deleted with the child’s records when a child is deleted, and with everything else when the family is deleted. The family’s data export includes the study times and days off, and when each link was made and turned off, but never the link itself. If a backup is ever restored, every calendar link is turned off, and a parent makes a new one.

For children: your parent can set how much time you have to study each day, and the app uses it to plan your week. A calendar link shows your subjects and exam dates, never your name.

Downloads, deletion and backups

Downloading the family’s data

The owner or a parent can download the whole family’s record as one file from Settings: the children’s profiles and courses, their answers, conversations with the AI tutor, feedback and marks, daily study summaries, each child’s study times and days off, when calendar links were made and turned off, records of the family’s use of the AI and speech services, the family’s settings and the Terms version it agreed to, the family’s billing status, the devices children have signed in on, and which kinds of email were sent and when. It lists every member by role, status and the date they joined, with an email address only for the person downloading. It leaves out the sound of recorded answers, PINs, the family code, calendar links and Stripe’s reference numbers. The download covers the whole family; there is no separate download for one child.

Archiving or deleting a child

The owner or a parent can archive a child. That keeps all of the child’s records and frees their place in the family. Only the owner can delete a child, by typing the child’s nickname to confirm. Deleting removes the child’s profile, courses and every learning record, including recordings, the scrambled PIN, devices, sessions and, if the child had one, their Google sign-in for the family. It happens in the background. We keep a minimal record of the request (its dates, a random reference and scrambled identifiers for the child and the owner who asked) so that restoring an older backup cannot bring the child’s records back.

Family deletion and recovery records

A family owner can request deletion of the family workspace from Settings. This immediately closes access while the service removes the learning records. Recovery copies expire separately as described below. We retain a minimal record of the request, containing its date, a random request reference and hashed family and owner identifiers, so restoring an older backup cannot bring a deleted family back. These records, and the matching records for deleted children, are restricted operational data; they do not contain names, email addresses, learning answers or recordings. They are kept only while a recovery copy could still hold the deleted family or child, plus a week: we delete them 42 days after the deletion is finished (or, if a backup is ever restored, 42 days after the deletion is applied again), and the copies kept with the backups are scheduled to expire 42 days after they are made, with storage cleanup normally following within a day. Copies of these records inside the recovery copies expire with them, as described below. Deleting the family also cancels its subscription and asks Stripe to delete the family’s customer record, and deletes the family’s email records, apart from the scrambled addresses kept so that an unsubscribe keeps working.

When a trial or plan ends

If the trial ends without a plan, or a plan is cancelled and its paid period ends, the family becomes read-only. Nothing is deleted: the adults can still see the records, download them, and delete a child or the family. Records are deleted only when the owner deletes them.

Backups

Cloudflare’s database recovery (Time Travel) can restore deleted data for up to 30 days after it is deleted. Each day we also make a private disaster-recovery backup of the database in Cloudflare R2; these backups are scheduled to expire after 35 days, with storage cleanup normally following within a day. Backups are used only to recover from a fault. If one is ever restored, the families and children deleted since are deleted again, and recorded sounds, invitation requests and unsent emails are cancelled, before the service reopens; PINs are cleared and family codes replaced, as described above.

Services we use

Fathomtrail relies on these outside companies. This is what each one receives, as the app works today.

  • Google: sign-in. Adults sign in with a Google account, and so does a child whose family has linked their own Google account. Signing in, and staying signed in, is handled by Google’s sign-in code in your browser, which talks to Google directly. From Google the app takes only the account’s email address and the ID Google gives the account, and keeps them so it knows who is signing in. It does not use the name or photo on the Google account. Children who sign in with the family code and a PIN do not use Google at all.
  • Cloudflare: hosting and storage. The website and app run on Cloudflare. Everything the service keeps, including learning records and recorded answers, is stored in Cloudflare’s database (D1), with the recovery copies and backups described above. Private disaster-recovery backups are kept in Cloudflare’s storage (R2) and are scheduled to expire after 35 days.
  • OpenAI: explanations, practice questions and help with marking. Our server sends OpenAI text only: the lesson and question (including the model answer and marking points when it is helping with marking, and any changes a parent or teacher made to the lesson when approving it), and what the pupil does in that lesson: their typed answers, their messages to the tutor with the recent conversation, what they write about what they already know, how they rated the topic, and the questions they got wrong and whether they were sure. If the pupil uses “Transcribe my answer”, the text Azure makes from their speech is sent too. We do not send names, email addresses or account IDs, and we never send recordings or photos. Anything a pupil types or says in an answer is sent as written, so please ask children not to include personal details. Each request carries an instruction asking OpenAI not to store it (OpenAI’s “store: false” setting). That is an instruction on the request, not a contract; what OpenAI does with requests is set by OpenAI’s own terms. The conversation and feedback are kept in the pupil’s learning record in our database until it is deleted. AI feedback never sets a mark or decides what counts as known.
  • Microsoft Azure: speech.
    • Speech recognition of the child’s voice. In German pronunciation practice a pupil can record themselves reading one of a few set phrases (up to 25 seconds), and in German practice papers they can use “Transcribe my answer” to record a spoken answer (up to a minute) and have it turned into text. A parent controls this for each child in Settings, under Children, with the switch “Speech recognition (Microsoft Azure)”. It starts off for a child added in school year 8 or below and on for a child added in Year 9 or above; children who were already in the family when the switch was added have it on until a parent changes it. When it is off, nothing the child records is sent to Azure: they can still record and replay on their device and type their answers. When it is on, each time, only after the person recording ticks a box to agree for that recording, our server sends that recording to Microsoft Azure, which scores the pronunciation or turns the speech into text. No name, email address or account ID goes with it, but the recording is still the child’s voice. The app does not keep the recording; it keeps the recognised text, the pronunciation scores and word-by-word feedback in the pupil’s learning record. Microsoft handles the recording under its own terms, which are linked next to the pronunciation-practice recorder.
    • Reading the app’s own words aloud. For dictation, listening and sound questions, our server sends the lesson’s own sentence to Azure and plays back the audio it returns. The sentence comes from the course’s lessons (which a parent or teacher in the family may have edited when approving them); it is never anything the pupil types or says, the app adds no information about the pupil, and the audio is not kept.
  • Stripe: payments. When the owner chooses a plan, Stripe receives the owner’s sign-in email address, the country, the language and a reference for the family from our server, and the owner’s name, billing address and card details directly on Stripe’s payment page. Stripe receives nothing about the children. It keeps its payment records under its own terms.
  • Email: Postmark or Cloudflare. Service email is sent through one email service, chosen when email is switched on: Postmark, an email company, or Cloudflare’s own Email Service. It receives each email’s address and contents, which can include a child’s nickname (see “Email”).

Spoken answers sent to a parent or teacher for marking (the recordings described above) are not sent to any of these companies except Cloudflare, which stores them. We do not use advertising, analytics or tracking services, and we do not sell anyone’s data.

Children’s privacy

Fathomtrail is used by children, so we follow the principles of the ICO’s Age Appropriate Design Code (the Children’s Code):

  • Little data by default. A child needs no email address, Google account or full name. PINs and IP addresses are kept only in scrambled form. Recording starts only when the child presses Record.
  • No adverts and no profiling for marketing. We show no adverts, sell no data and use nothing about a child for advertising or marketing. The only picture we build of a child is which topics they know, do not know yet or have not checked yet, and it is used only to decide what to teach next.
  • No location. The app does not ask for or work out anyone’s location, and it tells the browser to block its location feature.
  • No pressure. There are no streaks, leaderboards or reminders, and no grade predictions.
  • Openness with the child. The children’s notice tells children, in plain words, what is kept and that the adults in their family can see their work, including their conversations with the tutor.

Why we use it

We use the data described here to provide the service the account holder signs up to: to teach each child, show the family how they are getting on, run the family’s account and take payment. We use sign-in records, scrambled IP addresses and lock records to keep accounts secure, and we keep deletion records so that a backup cannot undo a deletion; both are in the legitimate interests of the family and of the service. Invitation requests rely on consent, as described below.

Your rights

You can ask to see, correct, download or delete personal data we hold about you or your child by emailing office@conciergevet.co.uk. The owner and parents can also download the family’s data, and the owner can delete a child or the family, from Settings. If you’re unhappy with how we handle data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Beta invitation requests

This notice explains what happens to the details you give when you ask to join the Fathomtrail beta. Concierge Vet Ltd is responsible for them.

What we collect

Your email address, whether you are a parent or carer or a teacher or tutor, and the school years, subjects and note you choose to add. We don’t ask for children’s names or contact details, and please don’t include them in the note.

Why

To invite you to the beta when a place opens, and to decide which courses to build next. We rely on your consent, which you can withdraw at any time.

Where it is kept and for how long

In the service’s database, hosted by Cloudflare. We keep it until the beta ends or until you ask us to delete it, whichever comes first. Private disaster-recovery copies are scheduled to expire after 35 days, with storage cleanup normally following within a day. Restored invitation requests are removed before the service reopens. We don’t sell it or use it for advertising.

Your rights

You can ask to see, correct or delete your details by emailing office@conciergevet.co.uk. If you’re unhappy with how we handle them, you can complain to the Information Commissioner’s Office at ico.org.uk.

Joining the beta

Families invited to the beta receive a separate notice about children’s learning records before anyone starts using the service.

Concierge Vet Ltd is registered in England and Wales, company number 14501259. Registered office: Bretton Wycombe Road, Studley Green, High Wycombe, England, HP14 3XA.

Terms · Notice for children · Back to the home page