Privacy policy

Grow Up Quest is operated by Beegma LLC, a limited liability company registered in Wyoming, USA, at 30 N Gould St, Ste R, Sheridan, WY 82801, USA. For anything on this page, write to hello@growupquest.com. We are the data controller for the information described below.

Two things:

• A first name. It can be a nickname or a single initial, and we say so on the form because less is better. It appears only in your own report.
• An age, between 9 and 13. It decides which age group we compare against. It never adds or removes a single point from the result.

There is no other column. No gender — that field does not exist anywhere in our database and will not be added. No email, no photograph, no voice, no location, and no free-text box about your child, including anything you might write on their behalf. Your child has no account, never signs in, and never sees this product.

We also store the answers you give: which behaviours you marked and how often, which option your child picked for each of the fifteen questions, and how each activity went. These are structured choices — a button you pressed — never prose. From those we compute the reading and keep a copy of each version, so we can always tell you why the report said what it said.

Your email address and a password, which is hashed by our authentication provider and never visible to us. The date, method and IP address at which you gave consent for your child’s information — we are required to keep that evidence. And a record of what you bought, which mirrors what our payment provider holds so the app can let you in without asking them every time.

We never see or store your card details. Your card goes straight to Stripe, Inc., who process the payment for us. What comes back to us is that a payment succeeded and for what — never a card number.

Two lawful bases under the GDPR. Performance of a contract covers your account and the answers you enter — we cannot produce the report without them. Your consent, given as the parent or guardian at account creation, covers your child’s first name and age. You can withdraw that consent at any time by deleting the profile, and doing so deletes the observations with it.

Under COPPA, the parent creates the account and provides the child’s information, and the paid card transaction serves as verifiable parental consent. Under the UK Age Appropriate Design Code, the high-privacy setting is the only setting: there is nothing to turn off because nothing optional is collected.

• Sell, rent, or share your data with anyone for their own purposes.
• Use anything about your child to target advertising, here or anywhere else.
• Use your child’s data to train a machine-learning model.
• Email your child. We have no way to — we do not have their address.
• Show your child’s name to any other user, or compare your children to each other.
• Run third-party analytics, advertising pixels, or session recorders on this site.

Two, and neither of them follows you anywhere.

• The one that keeps you signed in. Strictly necessary — there is no way to use an account without it.
• A referral cookie, set only if you arrived through a link somebody shared with a code in it. It holds that code and nothing else — no identifier for you, no record of what you looked at. It is read exactly once, when you create an account, so we know who to pay. It lasts 60 days and then it is gone.

We run no analytics, no advertising pixels, and no third-party scripts of any kind. Nothing we set can recognise you on another website, because nothing we set leaves this one.

Only the suppliers we need to run the product. Each holds data on our instructions and for no purpose of their own:

The list got shorter. The database and your sign-in used to be handled by another company; they are not any more. Both now run on a server we operate ourselves, so nobody but us holds what you enter.

• Stripe, Inc. — card processing. They receive your card and billing details directly and we never see them. We are the seller, so the receipt comes from us.
• Resend — the transactional emails we send you, such as confirming your address or resetting your password.
• Cloudflare — our domain and the mailbox that receives what you send us.

Our server is in Morocco and the suppliers above are in the United States and the European Union. We sell to the United States only (see the terms), so nothing here should involve a transfer out of the EU or the UK — and if you reach us from either, any transfer is made under the standard contractual clauses.

For as long as you have an account, because you are meant to come back a year later and run it again — that is part of what you bought. When you delete a child profile it is hidden immediately and permanently erased, along with every answer and every version of the report, within 30 days. Deleting your account deletes every profile under it on the same schedule.

The one thing that survives is the record of a purchase, in a minimal form, because tax law requires us to be able to show that a sale happened. It carries no information about your child.

You can ask for a copy of everything we hold, ask us to correct it, ask us to delete it, or object to how we use it. Write to hello@growupquest.com and we will answer within 30 days. You do not need to give a reason and it will not affect anything you have already paid for.

Deleting is also a button: your account page removes a profile and everything attached to it without asking us. If you think we have handled your data badly, you can complain to your national data protection authority — in the UK that is the Information Commissioner’s Office.

We will change the effective date at the top and, if the change actually affects you, email you before it takes effect. We will not quietly widen what we collect about a child; collecting less is a design decision, not a setting.