Privacy Policy
Last updated:
This policy explains what personal data Ninebrook collects through our website (ninebrook.com) and our apps, starting with Digitlark, and what we do with it. The short version: we collect as little as we can and we never sell it. For a child we ask only for a nickname and a school grade, and both stay on your device. To show progress and fix faulty puzzles, we store practice records (which puzzle, the answer chosen, right or wrong, time taken, hints used, score and level) linked to a random device ID, never to a name.
If you’re a child using one of our apps: your grown-up set it up and said yes. We don’t ask for your real name. We keep the puzzles you tried and your answers, so the app can pick the right puzzles for you and we can fix puzzles that are wrong. We never use them for ads. If you have a question, ask your grown-up to email us.
Who is responsible
Ninebrook, a small app studio run by one person based in Singapore, is responsible for your data (the “controller”). For anything about privacy, including reaching our data protection contact, email support@ninebrook.com.
This website
ninebrook.com uses no analytics and no advertising trackers, and sets no cookies. Like any website, our host Cloudflare processes basic technical data, such as your IP address and browser type, to deliver the pages and protect the site from abuse. We don’t keep request logs for this website.
Children’s privacy (COPPA)
Digitlark is made for children aged 7 to 12, used with a parent. This section is our notice to parents under the US Children’s Online Privacy Protection Act (COPPA) and similar laws.
- Who runs it: Ninebrook. Contact support@ninebrook.com.
- How a child uses it: a parent sets up the app on the parent’s own device and gives consent before the child starts. There are no child accounts and no ads.
- What we collect: we ask only for a nickname and a school grade, and both stay on your device. To show progress and fix faulty puzzles, the app sends us practice records: which puzzle was shown, the answer chosen, whether it was right, the time taken, hints opened, any problem reported with a puzzle, and the score, level and grade band (such as “Grades 3–4”). They are linked to a random device ID, never to a name. We never ask a child for a real name, email, photo, location or contact details.
- How we use it: only to run the practice (choosing puzzles, showing progress and the parent report) and to find and fix faulty puzzles. Never for advertising: nothing about a child is sent to Meta or any other advertising company. We don’t sell or share it; Cloudflare stores it for us.
- How long we keep it: practice records are deleted 12 months after the device was last used. You can have them deleted sooner at any time.
- Your rights as a parent: you can review your child’s data, have it deleted, and refuse any further collection at any time. Use the “Delete my data” page in the app (it also clears the device), stop using the app, or email us.
Parents and other buyers
When you use one of our apps, we may collect:
- Your email address: if you join a waitlist, buy a plan, sign in or contact us.
- Purchase details from Polar: such as the plan, price, date and country. We never see your full card number.
- Technical data: such as a random device ID kept in a cookie, your IP address, browser, country and the pages you visit.
- How you found us: such as the ad you clicked (campaign tags and Meta’s click ID).
Why we use it, and on what legal basis
- To provide the apps and what you paid for (sign-in, access, the parent report and support): to perform our contract with you.
- To run the practice for your child: your consent as the parent, given in setup.
- To prevent fraud and abuse, keep the service secure and fix faulty puzzles: our legitimate interest in a safe and accurate service.
- To measure our ads with Meta: your consent where the law requires it (in the EEA, the UK and Switzerland); elsewhere, our legitimate interest in knowing which of our ads work.
- To email you when checkout opens, if you join a waitlist: your consent.
- To keep purchase records: our legal obligations for tax and accounting.
Cookies and storage in our apps
- dj_sid (our app): keeps you signed in and links your device to your plan. Strictly necessary. Lasts up to 13 months.
- _fbp and _fbc (Meta, set on our app’s website): ad measurement, on parent-facing pages only. They last 90 days. If you’re in the EEA, the UK or Switzerland, they are set only if you agree.
- Browser storage (on your device): the child’s nickname, grade and scores, so the app works without sending them to us. “Delete my data” or clearing your browser’s storage removes them.
To refuse or withdraw consent for Meta’s cookies, say no when asked, or clear the cookies for digitlark.com in your browser settings at any time. The app works the same either way.
Advertising measurement (Meta)
Our apps use the Meta Pixel and the Meta Conversions API on parent-facing pages only: the home page, setup, the results page, plans and checkout. They tell Meta about events like a page view, viewing results, starting checkout or a purchase, along with browser identifiers and hashed identifiers, such as a hashed copy of your email, which Meta uses to match the event to a Meta account. Hashing doesn’t make this data anonymous. They never run on the screens where a child answers puzzles, and where consent is required they run only after you agree. We don’t show ads inside our apps, and we don’t sell personal data.
Payments
Polar Software, Inc. (“Polar”) is the merchant of record for all purchases. Polar collects your payment details directly and handles them under its own privacy policy: polar.sh/legal/privacy-policy. Polar shares with us what we need to give you access and support, such as your email, the plan and whether the payment went through.
Who we share it with, and where
We share personal data only with the services that help us run Ninebrook: Cloudflare (hosting and storage), Polar (payments), Meta (ad measurement, parent-facing pages only) and Resend (the email service we use to send messages you asked for, such as sign-in links). We may also share data when the law requires it.
These providers are based mainly in the United States, so your data may be processed there. Where the GDPR or the UK GDPR applies, these transfers rely on the EU–US Data Privacy Framework (and its UK Extension) where the provider is certified, or otherwise on the European Commission’s Standard Contractual Clauses (with the UK Addendum) in the provider’s data processing terms.
How long we keep it
- Practice records (linked to a device ID): deleted 12 months after the device was last used.
- Waitlist email addresses: we send one email when checkout opens. If you haven’t bought, we delete your address 6 months after that email, or when we close the app if it never launches.
- Your account and support emails: deleted 24 months after your last plan ends, your last sign-in or your last message to us, whichever is latest.
- Purchase records: kept by us and by Polar for as long as tax and accounting law requires.
You can ask us to delete your data sooner at any time, except purchase records we must keep.
Your choices and rights
- See, correct or delete your data or your child’s, and get a copy in a portable format.
- Object to how we use your data, or ask us to restrict it.
- Withdraw consent at any time: for your child, stop using the app and use “Delete my data” or ask us; for Meta’s cookies, see above. Withdrawing doesn’t affect what was done before.
- Every marketing email has an unsubscribe link. If you join a waitlist, we send one email when checkout opens.
Email support@ninebrook.com. We reply within 2 business days. If you’re unhappy with our answer, you can complain to the data protection authority where you live.
Age
You must be 18 or older to buy from us. Our apps are not designed for children to use on their own.
Changes
If we change this policy in a way that matters, we’ll update the date above and, where it makes sense, tell you by email or in the app.