Updated 6 November 2026. This is a small free learning pilot, not a claim of legal certification. A parent or authorised guardian aged18orolder must create and supervise a child account.
The parent chooses a username and password. Passwords are hashed. We save a dated consent record, a child nickname (optional), grade, lesson/check counts and recent activity in Cloudflare storage. We do not need the child’s surname, contact details, school or location. The parent sees only their linked child’s activity, not private questions. No automatic email is sent. The app does not verify identity or guardianship beyond the parent’s declaration.
Parent-linked sessions send maths-only questions and cropped worksheet images only to Cloudflare Workers AI. No Groq or OpenRouter fallback is used for those sessions. Cloudflare says it does not train AI models on customer content and retains standard inference content only while needed to process the request, subject to limited legal and security exceptions. Operational network/usage metadata is still processed. This is not a promise of total anonymity. Do not upload names, faces, school or contact details. AI may be wrong; check the working with a teacher. Simulated classmates are AI, never real children.
Our application database does not save conversation text, photo pixels or AI answers. They remain in the page until cleared or closed. Photos are converted to fresh JPEG pixels on the device, removing original file metadata. Silent whiteboard videos are generated on the device. No microphone, paid AI voice, public child-to-child chat or payment is enabled.
Separate adult synthetic test sessions may use Groq, OpenRouter/free model providers or Cloudflare. Provider retention terms differ, so adult testers must use public maths-only examples without personal details.
Sign in as the parent, open Settings, then Delete my child and parent data. Confirm your password to delete both account records and saved progress, invalidating their sessions. Account records otherwise remain until deleted; we have no automatic inactivity deletion yet. Daily quota counters and expired session records may remain in storage until cleanup. Expired sessions cannot sign in. Deletion also clears YFC browser-local data on the device used to delete. Browser-local display name, goal and progress can be cleared in browser site-data settings. Hosting/network logs are governed by Cloudflare’s policy and are not deleted by the app account control.
Child mode cannot return to parent controls without signing in again. Keep the parent password private and sign out of the parent dashboard before handing over the device.
Cloudflare AI data policy. Privacy contact: Thabiso Naha, ai-solutions@nahalabs.co.za.