Privacy & Terms
Last updated 23 September 2026
WordStar is a small phonics app I built for my son — it's currently a free, invite-only beta shared with a handful of families we know, not a public product. This page explains, in plain language, what we store and why.
What we collect
- A parent's email address — used only to send a one-time sign-in link, plus a password if you choose to set one. A password is never stored the way you typed it — only a salted, deliberately slow one-way hash, which cannot be turned back into your password. You can also just use the emailed link and never set a password at all.
- A child's first name, age and chosen character — the name and character are shown to friends you've connected with. The age is only used to pitch the reading pace and is never shared with anyone.
- If you choose to use a photo as your child's character, it never leaves the device you picked it on. It is not uploaded to our servers, not included in backups, and never shown to friends — they always see the cartoon character. You can remove it at any time, and clearing your browser data removes it too.
- Technical error reports — if something in the app breaks, we record what went wrong, which screen it happened on and the browser type, so it can be fixed. No words, answers or learning data are included, and these are deleted after 30 days.
- Learning progress — which words have been practised, stars earned, and streaks. This is what makes the app work across devices.
- Anonymous usage counts — we record that certain steps happened, so we can see where the app is confusing and fix it: that the welcome page was opened, that an account was created, that a child finished setting up, that a first word was read, and that someone came back on a later day. We record the step and the date, never what was learned — no words, no answers, no scores. To avoid counting one person ten times when they refresh the page, the browser generates a random tag for itself and stores it on the device. That tag is not linked to a name, an email or anything else about you, it is not shared with anyone, and clearing your browser data erases it. These counts are deleted after 180 days.
We don't collect a child's last name, school, address, or any other personal detail. We don't use advertising cookies, we don't use any third-party analytics service, and nothing about you or your child is sold, shared or sent to anyone else. The usage counts described above stay on our own server and exist only so the app can be improved.
Who can see what
Progress is private by default. If you add a friend using an invite code, that friend can see your child's display name, avatar, and star counts (total and this week's) on the Friends/leaderboard screen — nothing else. Friend connections only happen when a parent enters a code on purpose; there's no public directory or search.
Where it's stored
Data is stored on Cloudflare's infrastructure (D1 database). Sign-in emails are sent through Resend, a transactional email provider, solely to deliver the sign-in link — they don't receive learning data.
We don't sell data, share it with advertisers, or send marketing email. The only email you'll get is a sign-in link when you ask for one.
Your control
You can ask us to delete your family's account and all associated data at any time — just email [email protected] and we'll remove it.
Changes
Since this is an early, evolving beta, this page may change as the app does. We'll keep it honest and simple.