Finding your bright path…
Finding your bright path…
For grown-ups
Who is responsible for your family’s information, what English Fun stores, why we are allowed to use it, who can see your child’s work, how long things are kept, and the rights you have over all of it. Last checked 24 September 2026.
Mehta and Groups Ltd is responsible for English Fun, and is the controller of the personal information described on this page.
You can email us at contact@englishfun.co.uk, or write to us at Suite 412 Gilmoora House, 57-61 Mortimer Street, London, England, W1W 8HS.
Nothing in English Fun asks for a child’s name, school, class, address or photograph, and signing up today creates no field for any of them.
There is one exception, and it is an old one. An earlier version of English Fun asked for a parent name and a child name. An account made then may still hold what was given, because nothing has gone back to remove it. Nothing in English Fun reads it, shows it or sends it anywhere, and it goes with the account if you delete it.
Nearly all of this comes from the grown-up or the child using the family account. English Fun also makes records of its own as the service runs: whether an address has been confirmed, those short-lived counters, the times things happened, the feedback written for an answer, and — once you report an activity from inside English Fun — the state of that report and the record of every authorised read of it.
We use personal information only for the purposes below.
Other English Fun families cannot see it. There are no public profiles, no sharing between accounts and no leaderboards.
Two companies handle your child’s saved work on our behalf. OpenAI produces the written feedback — what we send it is in the next section. Render hosts English Fun and stores the account and the work.
Two more are involved in other parts of the service. Postmark delivers the emails English Fun sends you, and it is also the route we use to tell our own mailbox that a report has come in. An alert of that kind holds references, a category and a time, and none of your child’s work. Our support mailbox is on Google Workspace, so whatever you put in an email to us is held there — which is why the contact page asks you to leave your child’s answers out of one.
All four may handle personal information outside the UK. Where that happens we rely on the protection that applies to that provider and that account — the UK Extension to the EU–US Data Privacy Framework where it applies, or approved standard contractual clauses with the UK Addendum. They are not one arrangement covering everybody, so if you want to know which one covers a particular provider, and how to get a copy of it, ask us at contact@englishfun.co.uk.
A fifth company, Plausible, counts visits to our pages. It never handles your child’s work or your account details — the section on how we count visits, below, says what a visit shares with it — and it holds what it measures in the European Union: it is an Estonian company, and UK law recognises that protection as adequate, so it does not rely on the arrangements above.
Nobody at English Fun reads your child’s answers as part of running the service. English Fun is run by one person, who also runs the systems the work is stored on, so access is possible. The rule is that it happens only when you ask us to look at something, or a security problem has to be investigated, and only for the piece of work in question.
A finished activity’s feedback page now has a way to send us that one activity, and every time somebody opens what you sent, that is written down on your report: who, when, and whether the work itself was still there to show them.
What gets written down is who read it, why, when, and what they were shown. To read it at all, a copy of that one activity is taken onto the computer of the person answering you, in a file the computer marks as readable by that person’s account and no other — though whoever administers that computer could still open it. That copy sits outside everything else on this page: deleting your account does not reach it, and neither of the periods below does either. The rule we hold ourselves to is that the folder is on that computer alone and is not synced or backed up anywhere, the copy is kept only while your question is being answered, and it is deleted once the outcome is written down. Nothing in English Fun can make that happen — a person does it, or it does not happen.
Most activities are marked with help from OpenAI’s models. When your child hands one in, we send OpenAI the activity and its marking guidance, your child’s age, and the answers being marked.
We do not attach your email address, your account identifier, or any name the account holds. What we do send is the answer exactly as your child typed it, so if they write their name into an answer, it goes with it. That is why this page and the activity itself both ask them to keep those details out: before handing in written answers, a child is told those answers may be sent to a computer helper, and asked to leave out names, addresses, their school, phone numbers and email addresses.
The interactive grammar activities are different: a child answers them by tapping words rather than typing, English Fun marks them itself, and nothing about them is sent to OpenAI.
English Fun has turned off the optional sharing of what we send and receive for model improvement, so your child’s work is not used to train OpenAI’s models. OpenAI may still keep it for up to 30 days to check for misuse of its service. These requests are processed on OpenAI’s own systems, which are not limited to the UK or Europe.
Feedback made this way can be wrong. It can mark a good answer as not-yet, or miss something a teacher would notice. It is practice and encouragement rather than an assessment, and the help page says what to do when a piece of feedback looks wrong or upsets your child.
Because it is practice and encouragement, it decides nothing about your child. It does not change how many tries they get at an activity that day, rank them against anyone, go to a school, decide access to education, or make any other legal or similarly important decision about them.
Automatic deletion is not switched on yet. The periods in this table are the maximums our policy allows, and the rules that apply them are written and tested — but the daily job that runs them has not been started, so an account or a piece of work older than its period may still be stored today. Deleting the account yourself works now, and removes everything on it.
| What | Longest we keep it |
|---|---|
| An account whose email address was never confirmed | 30 days after sign-up |
| A saved, unfinished activity | 30 days after it was last changed |
| A finished activity — its answers, any improved answer and its feedback | 13 calendar months after it was finished |
| A report you send us about one activity, and the record of who read it | 12 calendar months after we close the case |
| A confirmed account nobody has used | A warning at 23 calendar months, and removal at 24 if nobody comes back |
These are not waiting on the daily job. A sign-in ends by itself after 30 days, the emailed links and the security counters expire on their own, our hosting provider applies its own window to its records, the company that delivers our email applies its own to what we sent you, and email you send us is cleared out of our support mailbox and its bin by hand once a question has been closed for a year. An email we send by hand asking how it went, with any reply, is cleared the same way six months after we stop sending these emails, whether or not anyone replied. The last row is the one with no timer of any kind: if somebody took a copy of one activity to answer a report, a person deletes it.
| What | Longest we keep it |
|---|---|
| Staying signed in on a device | 30 days |
| A confirm-your-email link | 24 hours |
| A password-reset link | 45 minutes |
| Counters that limit sign-in and email attempts | Between 15 minutes and an hour |
A grown-up can delete the family account from the account page. It asks for the password again and a separate confirmation, because it cannot be undone.
The account closes straight away: the sign-in stops working, any email links still outstanding stop working, and the address is released. Saved answers, finished activities and feedback are removed, and anything not removed inside that request is removed automatically afterwards.
The company that hosts English Fun may still hold recovery copies inside the encrypted storage it runs for us, and we don’t use those to bring back an account that has been deleted.
Those copies are the journals and snapshots our hosting provider keeps in order to run its storage. It does not publish how long superseded ones are kept, so we do not promise a period for them.
Deleting the account does not recall email we have already sent you. Our email-delivery provider keeps its record of those messages for 45 days, and takes up to 7 days more to remove it. The one email asking how it went is different: it never reaches that provider, so that period does not apply to it. It stays in our support mailbox and its bin, with any reply, until six months after we stop sending these emails, and deleting the account does not shorten that.
A report works the same way, with one thing worth knowing. Deleting the account removes the report itself, along with the record of who read it. If an alert about it had already been sent to our mailbox, deleting the account cannot recall that: it follows the periods set out above — 45 days at the company that delivered it, and twelve months from the day you filed the report in our own mailbox and its bin — and it holds references, a category and a time, and none of your child’s work. If no alert had reached us, there is nothing of it to follow — and we would not always be able to tell you which of those happened, because a message can be accepted without us learning that it was.
We use Plausible, a privacy-focused measurement service, to count visits to English Fun’s pages. What we get from it is aggregate numbers — how many visits each page had, how many registrations were accepted, from which countries, on which kinds of device and browser, and which site a visit arrived from — never a record about a named visitor, an account or a child.
The counting uses no cookies and nothing else stored in the browser, and it cannot follow a visitor from one day to the next: each visitor’s identifier is scrambled with an ingredient that is deleted every 24 hours, so yesterday’s visits and today’s cannot be joined up, here or across other websites. Every request a browser makes carries a network address and a browser description; Plausible uses those, in the moment, to derive that day’s identifier, and does not retain them. What it keeps are the visit records themselves — page, country, device and browser category, time, and that daily identifier — for the three years our current plan stores them, which is the row in the table above.
It records each page’s address only up to the question mark: query text, like the token a one-time link from our emails carries, is discarded rather than recorded. The only values it reads past one are standard campaign labels — utm and referral tags, which exist to say where a visit came from — and those are counted as a source, not shown in an address. And nothing your family types into English Fun — answers, feedback, email addresses — is any part of what it counts.
One thing it counts is not a page visit. When a registration has been accepted and the page after it opens — the one asking you to confirm your email address, or the sign-in page — the browser sends Plausible a bare event named “Registration accepted”. It carries nothing about the account or the address — no email, no age, and no identifier beyond the same daily one every visit has — and it exists so that we can tell which of our own campaigns brought families here. It counts registrations that were accepted, not whether an account was created: a sign-up with an address already in use is answered the same way, on purpose, so that nobody can use the sign-up form to test whether an address has an account. It is kept with the visit records, for the same three years.
English Fun uses only the browser cookies it needs to provide the service, keep it secure, or return you to where you were:
We use no analytics or advertising cookies — the visit counting described above works without cookies or any other browser storage — so there is no cookie banner to click through. If we ever want browser storage that is not on this list, we will say so here first.
You can object to any use of your family’s information that we base on legitimate interests — which is everything described here except answering privacy-rights requests and handling a data breach, where the law obliges us. Email contact@englishfun.co.uk and say what you want us to stop.
We will stop that processing unless we can show compelling legitimate grounds that override your and your child’s interests, rights and freedoms, or the processing is needed for a legal claim.
You can ask us to:
The right to data portability applies only where processing is based on consent or on a contract. English Fun’s necessary service processing is based on legitimate interests instead, so that right does not apply to the processing described here.
Email contact@englishfun.co.uk, saying what you would like and which email address the account uses.
To check the request comes from the account holder, we send a single-use link to the address the account is registered with, or ask you to reset the password, sign in and use the controls on the account page. We do not ask for passports or identity documents as a matter of course, and ask for more only where there is real doubt.
If a child asks us directly, we consider the request on its own terms: what they understand, what they want, and what is best for them.
We aim to reply to ordinary questions within two working days. Any privacy-rights request — including an objection — is answered without undue delay and normally within one calendar month.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.
When we rely on legitimate interests, we consider what is necessary, what a child and family reasonably expect, and the possible effect on the child. Children’s privacy, safety and ability to seek adult help take priority over model improvement, analytics, longer retention and operator convenience. That is why accounts are private, we ask for no child name, we mark locally where that is enough, the optional sharing of what we send OpenAI is switched off, the retention periods are fixed, and a human here opens a child’s work only at your request or to investigate a security problem, only the piece in question, and — for an activity reported from inside English Fun — recorded.
The older reading, writing and grammar practice keeps its results somewhere else, and that store cannot carry a report yet. For those, email is still the only route.
| Our hosting provider’s record of requests to the service |
|---|
| 14 days |
| Visit records at the company that counts visits — pages, countries, device and browser categories, and a daily identifier that cannot link across days | 3 years, the current plan's retention period |
|---|
| Emails we send you, and the alert telling our mailbox a report arrived, in our email-delivery provider’s records | 45 days, then up to 7 more days while the provider removes them |
|---|
| Email you send us, in our support mailbox and its bin | 12 months after the question is closed |
|---|
| An email we send you asking how it went, and your reply if you send one — in our support mailbox and its bin | 6 months after we stop sending these emails |
|---|
| A report alert, in our support mailbox and its bin | 12 months after the report was filed |
|---|
| A copy of one activity, taken to answer a report | Deleted by hand when the case is closed — no timer reaches it |
|---|
A message we send to the registered grown-up address stays in our email-delivery provider’s activity records for 45 days, and the provider may take up to 7 more days after that to remove it from its systems. These are account and security messages — confirming an address, resetting a password, telling you a password has changed — and we do not put your child’s answers or feedback in any of them. The one email asking how it went is written and sent by hand from our support mailbox and does not go through that provider.
When English Fun tells our mailbox about a report, that alert goes by the same route, and it goes to us rather than to you. It carries the account, report and activity references, the category you picked and the time — never what you wrote, never your child’s answers, and never their feedback. Where one has been sent, the same 45 days and the same up-to-7-day removal apply to it at the delivery provider.
Saving your report and telling our mailbox about it are separate steps, and the second one can fail or be left uncertain — a message can be refused, or accepted without us ever learning that it was. So a report may end up with no alert at all, and one that was uncertain is sent again rather than risked, which can leave two. Somebody checks for reports in that state by hand each working day. Nothing below promises that an alert exists; where one has reached the provider or our mailbox, the periods below are what apply to it.
One record there has no period at all, and it is not a copy of a message. If an email to you bounces, is marked as spam or is unsubscribed, the provider keeps your address on a do-not-send list so that it is not emailed again, and nothing expires that entry. You can ask us to have email data the provider holds, including that entry, removed where the law gives you that right.
Clearing our mailbox is not the same as the email being gone from Google, and one action joins the two. At twelve months — after the question is closed, or after the report behind an alert was filed — and at six months for an email asking how it went, we delete that conversation from the mailbox and then remove it from the bin, so that we cannot get it back. That same moment starts Google’s window: section 6.1 of Google’s Cloud Data Processing Addendum gives Google up to 180 days from the point we can no longer recover a conversation to remove it from Google’s own systems, unless the law requires it to be kept. Emptying the bin is the step that makes the period an ending rather than a move, which is why both are the rule.
An alert that has been sent is dated from the moment you filed the report — not from the case being settled, and not from when the alert happened to leave. The reason is worth saying out loud: if you delete your account while a report is still open, the report goes with the account and nothing is left to record that the case ever closed, so a clock waiting on that would never start. The time you filed it is printed on the alert itself, so it keeps its ending either way.