Privacy Policy

Who we are

Ottered (ottered.co.uk) is run by James and Ryan, from Hertfordshire. We're responsible for the personal information described here, as the "controller" under UK data protection law.

When a school uses Ottered with its classes, we handle the information about those classes for the school, following its instructions. The school's own privacy notice also applies.

You can contact us about anything in this policy at help@ottered.co.uk.

What we collect

• Your account: your username, date of birth, email address and password. Your password is stored scrambled (hashed), so nobody, including us, can read it.
• A parent or carer's email, if you're under 13, so they can give permission for your account.
• Your revision: your answers, scores, games played, XP, shells, ranks and progress through each topic.
• Things you make: mind maps, flashcards, blurts and, for teachers, question sets and homework.
• Classes: which classes you're in, and for teachers, your school and the classes you run.
• Progress reports: the email address of any parent or teacher who gets your reports, and how often.
• Your choices: your otter, its items, your default subject and other settings.
• Reports: if you report a username, we keep your report and the reason you gave.
• Technical information: the companies that host Ottered keep short-lived logs, such as IP addresses, to keep the site secure and running.

If you join a game without an account, we only keep the nickname you picked and your answers for that game.

Why we use it

UK data protection law says we need a reason (a "lawful basis") for using personal information. Ours are:

• To provide Ottered to you (contract): running your account, games, study tools, classes and the reports you ask for.
• Permission (consent): from a parent or carer for children under 13, and from anyone who signs up to get progress reports. Permission can be taken back at any time.
• Our legitimate interests: keeping Ottered safe and secure, stopping cheating, handling reports and fixing problems. We only do this where it doesn't override your rights.
• The law (legal obligation): for example, sharing information to protect a child, as described on our safeguarding page.

We use your date of birth only to check whether you need a parent's permission and that teachers are adults. We don't use your information to make automated decisions that affect you in a significant way.

Who can see your information

• Other players see your username, otter, level, rank and scores, on leaderboards and in games. On your avatar page they can also see the skins, hats and other items you've unlocked, unless you make your collection private in your settings. It's private to start with if you're under 13. Never your email or date of birth.
• Your teachers see your progress and homework results in the classes you've joined.
• Report recipients, such as a parent, see the progress reports you've set up for them.
• James and Ryan can see account information when we need to, for example to answer a help email or deal with a report.

Companies that help us run Ottered

We use a few trusted companies to run Ottered. They only use your information to provide their service to us, and must keep it safe:

• Supabase stores the database and handles logging in. Our database is in London.
• Cloudflare hosts the website.
• Resend sends our emails, such as sign-up links and progress reports, from Ireland.
• Google Fonts and jsDelivr supply the fonts and some code the pages use, so your browser connects to them.
• Free Dictionary API: when you look up a word in the glossary, we send it the word, not who you are.

Some of these companies may handle information outside the UK. When that happens, it's protected by the safeguards UK law requires.

We never sell your information, and we never share it with advertisers.

Cookies and browser storage

We don't use advertising or analytics cookies, and we don't track you around the web.

Ottered stores a few things in your browser so it works properly: that you're logged in, your theme, and drafts you haven't saved yet, such as a mind map. You can clear these in your browser settings at any time.

How long we keep it

• We keep your account information until you delete your account. When you do, your account and everything in it is deleted straight away.
• Progress reports stop as soon as the person getting them unsubscribes, or you remove them.
• If a teacher deletes their account, question sets they shared with their school stay with the school, without their name.
• Records of safeguarding concerns are kept for as long as we need them to protect children.
• Our hosting companies' technical logs are deleted automatically after a short time.

Your rights

You have the right to:

• see the information we hold about you
• have anything that's wrong corrected
• have your information deleted. You can delete your account yourself on the delete account page
• object to, or ask us to limit, how we use your information
• get a copy of your information to take somewhere else
• take back your permission, where we rely on it

To use any of these rights, email help@ottered.co.uk. Parents and carers can ask on behalf of their child. We'll reply within one month.

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Children's privacy

Most people who use Ottered are under 18, so we've designed it with the ICO's Children's Code in mind. Your email and date of birth are never shown, under-13s' collections are private unless they choose to show them, other players can't contact you, and we collect as little as we can.

If you're a parent or carer and think your child has given us information without your permission, email us and we'll sort it out.

Changes to this policy

If we change this policy, we'll update the date at the top. If the changes are important, we'll tell you on the site or by email before they happen.