Privacy Policy

1. Who we are

Awen Software Ltd is an educational technology company based in Wales, UK. We operate the Bucket Filler mobile application (iOS, with Android coming soon) and the website awensoftware.co.uk. We are the data controller for personal data processed under this policy.

Contact: info@awensoftware.co.uk · Wales, UK

2. What data we collect

Parent accounts

When you create a parent account, we collect:

• Your email address (used for authentication via Firebase Auth)
• A password (hashed and managed by Firebase Auth. We never see your plaintext password)

Children's data

Children use anonymous Firebase accounts. No email address, no name, no date of birth, and no personally identifying information is collected or stored on our servers. Child profiles exist only as data within your family's Firestore document (e.g. a display name like "Ellie" that you enter, and their progress data), and are fully isolated to your account.

Avatar photos chosen by children are stored locally on the device only and are never uploaded to our servers.

Usage data

We store the following in your family's Firestore document:

• Points, XP, level, and badge progress per child
• Per-topic question accuracy (counts only, no question text is stored against a user)
• Reward requests, reward history, and quest records
• Streak data and daily session history
• Notification preferences

This data is used to power the app and is not shared with third parties.

This website

The awensoftware.co.uk website does not use cookies beyond those strictly necessary for site operation. We do not use advertising cookies, tracking pixels, or third-party analytics. Firebase Hosting may log standard HTTP request metadata (IP address, user agent, timestamps) for security and operational purposes; these logs are retained for a maximum of 30 days.

3. How we use your data

• To authenticate your parent account and keep it secure
• To sync your family's progress data across devices
• To send push notifications you have opted into (e.g. reward requests, streak warnings)
• To process and manage your subscription via the App Store or Google Play
• To respond to support requests sent to our contact email

We do not use your data for advertising, profiling, or marketing to third parties.

4. Who we share data with

We use the following third-party services to operate the app:

• Google Firebase (Firebase Auth, Cloud Firestore, Cloud Functions, Cloud Messaging). Data processed under Google's Cloud Data Processing Amendment
• Apple App Store / Google Play. Subscription and payment processing; we receive only transaction receipts, not payment card details

We do not sell, rent, or share personal data with any other third party. We do not use any advertising SDKs or third-party analytics services.

5. Your rights (GDPR)

If you are based in the UK or EU, you have the following rights under UK GDPR and the Data Protection Act 2018:

• Access: You can request a copy of the personal data we hold about you.
• Rectification: You can ask us to correct inaccurate data.
• Erasure: You can request deletion of your account and all associated data. You can also do this directly in the app (Settings → Delete Account).
• Portability: You can request your data in a portable format.
• Restriction: You can ask us to restrict processing of your data in certain circumstances.
• Objection: You can object to processing based on legitimate interests.

To exercise any of these rights, email info@awensoftware.co.uk. We will respond within 30 days.

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

6. Data retention

We retain your account data for as long as your account is active. If you delete your account (via the app or by request), all your family data. Including child profiles, progress, rewards, and quests. Is permanently and immediately deleted from Firestore. Backups are purged within 30 days.

Firebase Auth account records are deleted immediately on account deletion request.

7. Security

• All data is encrypted in transit using TLS
• Firestore data is encrypted at rest by default (Firebase/Google)
• Firestore security rules enforce strict family-level isolation. Your data is inaccessible to other users
• Device linking is rate-limited server-side to prevent brute force
• We do not store payment card data. All payments are handled by Apple or Google

8. Children's privacy (COPPA)

Bucket Filler is designed for children aged 7 to 11, and we take their privacy seriously. In line with the Children's Online Privacy Protection Act (COPPA) and UK GDPR:

• Children do not create accounts and do not provide any personal information to us
• Children authenticate as anonymous Firebase users. There is no email address, name, or identifying information associated with a child account on our servers
• All child profiles are created and managed by parents within the parent account
• No third-party advertising, analytics, or tracking SDKs are present in the app
• Children cannot make in-app purchases. All subscription management is in the parent account
• No social features, external links, or user-generated content is accessible to children

9. Changes to this policy

If we make material changes to this policy, we will notify parent account holders by email at least 14 days before the changes take effect. The current version is always available at awensoftware.co.uk/privacy.

10. Data requests

You can request a copy, correction, or deletion of any personal data we hold about you at any time. Two ways to do it:

• In the app: Settings › Account › Export data or Delete account. Deletions are immediate and permanent.
• By email: write to info@awensoftware.co.uk from the email address on your account. We reply within 30 days, usually far sooner.

Please include the type of request (access, rectification, erasure, portability, restriction, or objection) and the email address linked to your family account. We do not charge a fee for standard requests.

11. Contact

For any questions about this policy, data requests, or privacy concerns:

Awen Software Ltd
Wales, UK
info@awensoftware.co.uk