Privacy Policy
The data controller is GOTOES LIMITED, trading as Numbersaurus. Registered in England, company no. 16658520. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. ICO registration: ZC196243. Contact: hello@numbersaurus.com.
Numbersaurus helps children learn maths, so we designed it to know as little as possible about your family. There are no adverts, no third-party analytics and no tracking of children across the web. This page says exactly what we collect, why, and what you can do about it.
For children — the short version
Numbersaurus remembers your first name, your school year, your dino, and the questions you answer, so your dino can pick the right games for you.
It never shows you adverts, never asks where you live, and never shares your answers with anyone except your own grown-up.
Your grown-up can see everything it remembers, and can ask us to rub it all out whenever you like.
1. What we collect
From the grown-up
- Your email address — used to sign you in and to link your family's players to your account. There are no passwords: you either get a sign-in link by email, or sign in with Google, which tells us the email address on your Google account and nothing else (section 4).
About each child (entered by the grown-up)
- First name, school year, and dino choice (colour and pattern). We ask which school year your child is in. What we store is the year they started Reception, and we work out the year they are in now from that, so the maths stays at the right level as they move up. That is the whole child profile: no surname, no photos, no contact details, no location.
- Date of birth, for children set up before 9 August 2026. We used to ask for a date of birth instead of a school year. We still hold the dates recorded before that day and use them for the same one thing: setting the level the questions start at. We ask no new child for a date of birth. You can delete a child and everything we hold about them at any time (section 6).
Created while a child plays
- Play records: which questions were shown, the answer chosen, whether it was right, how long it took, which skills were practised and mastered, and when. These are stored against a random player identifier, not the child's name.
- Random identifiers: each player and each device gets a random ID so play can sync between your devices. The IDs mean nothing outside Numbersaurus.
Created while anyone visits
- How-far-did-you-get measurement: a random visitor ID and which step of trying Numbersaurus a visit reached (saw the page, started playing, subscribed, and so on), plus how the visit arrived — any campaign tags on the link and the referring site's address (the site only, never which page of it). No name or account is attached to this.
- Reading one of our guides: the guides at numbersaurus.com/learn record which guide was opened, whether the reader reached the end of it, and whether they went on to tap the link into Numbersaurus. Each page load also records one of three words for where the reader came from: another site, one of our own pages, or nothing sent. We do not record which site. Nothing is stored on your device by these pages: each page load is given a random number that is gone when you close the tab, so two guides read by the same person are not connected to each other, and none of it is connected to an account.
- Diagnostic logs: if something breaks, the app sends us the error message, the page address, the browser type and the device's random ID so we can fix it. These logs are written so that they never contain a child's name.
When you subscribe
- Payment is handled entirely by Paddle, our merchant of record. Your card details go to Paddle, never to us. We receive confirmation that your subscription is active, tied to your email address.
2. Why we can use it (lawful bases)
| What | Why | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Email address, sign-in links, Google sign-in | Running your account and signing you in | Contract — 6(1)(b) |
| Child profile and play records | Providing the learning service you asked us to provide for your child: finding gaps, choosing what to teach next, showing you progress, syncing between your devices | Contract — 6(1)(b) |
| Subscription status from Paddle | Knowing your family has access | Contract — 6(1)(b) |
| How-far-did-you-get measurement | Understanding whether Numbersaurus explains itself well and which of our own links bring families here | Legitimate interests — 6(1)(f) |
| Reading one of our guides | Knowing whether the guides we write are read, and which of them to write next | Legitimate interests — 6(1)(f) |
| Diagnostic logs | Finding and fixing faults | Legitimate interests — 6(1)(f) |
Where we rely on legitimate interests, the data is deliberately minimal (random IDs, no names, referrer trimmed to the site's address) and is never used to build a profile of a child or to advertise. We do not sell personal data, and we make no automated decisions with legal or similarly significant effects.
3. Children's data — how we follow the Age Appropriate Design Code
- Data minimisation: a child is a first name, a school year and a dino. Play records carry random IDs, not names. On 9 August 2026 we replaced the date of birth with the school year, because the school year is all the level setting ever used and it identifies a child far less exactly.
- High privacy by default: there are no ads, no third-party trackers, no social features, no location, no public profiles — so there is nothing to opt out of.
- The grown-up stays in charge: profiles are created by the grown-up; progress, settings and the delete control live in a grown-up-only area of the app. The "watch from a distance" page lets the account's own grown-up see the child's play live; it is read-only and only ever shows children on that grown-up's own account.
- No nudges: the child's game never asks the child for data, never pushes them towards payment, and winds sessions down gently when a grown-up sets a time limit.
4. Who else touches the data
- Paddle (Paddle.com Market Ltd) — payments, as merchant of record. Paddle is a controller of the payment data it collects; see Paddle's privacy policy.
- Amazon Web Services — our servers and database run in AWS's London region (eu-west-2), sign-in emails are sent through AWS's email service, and Pip's spoken lines are made from written text by AWS's speech service and stored as audio files. The speech service is sent the words Pip says, which are the same for every child; nothing about your child goes to it. When an email could not be delivered or was reported as spam, AWS passes that notice back to our server through its queue service, and we stop sending to that address.
- Google — only if you choose "Continue with Google" to sign in. Tapping it sends your browser to Google's own sign-in page, so Google sees that someone is signing in to Numbersaurus, and handles the sign-in as it would for any site. Google then sends us back a signed message containing your Google account's identifier and the email address on it, confirmed as belonging to you. That is all we ask for and all we get: no name, no profile picture, no contacts, no access to anything else in your Google account. If you sign in by emailed link instead, Google is not involved at all. See Google's privacy policy.
That is the whole list. The app's typefaces are served from Numbersaurus itself, not from a font provider, and the Google button is a plain link that loads no Google code, so opening the app sends nothing to any other company.
Data is stored in the UK. Some of the app's data (the game itself, play records, settings) is also stored on your own device in the browser, so play works offline — that copy stays on your device and is yours to clear.
5. How long we keep it
- Account and child data: kept while your account is active, so a child's progress is there when they come back.
- When you hide a player: nothing is deleted. The player stops showing on the Who's playing? screen and their records are kept, so you can show them again.
- When you delete a player: the child's records, meaning their profile, play history and progress, are physically deleted from our servers. The grown-up view has a "Delete for good" control on every hidden player, which asks you to type that player's name before it runs. Or email us and we will do it.
- Diagnostic logs and visit measurement, which includes the guide readings above: kept only as long as they are useful for fixing faults and understanding the service, then deleted.
- Payment records: Paddle keeps transaction records to meet tax and accounting law.
6. Your rights
You (and your child, through you) can ask us for a copy of the personal data we hold, ask us to correct or erase it, object to or restrict our processing, and take your data elsewhere. Two of these are built into the app: the grown-up view has a Download play data button, and a Delete for good control on every hidden player. For anything else, email hello@numbersaurus.com and we will respond within one month.
If you are unhappy with how we handle personal data you can complain to the Information Commissioner's Office (ico.org.uk) — though we would welcome the chance to put it right first.
7. Changes to this policy
If we change what we collect or why, we will update this page and, for significant changes, tell account holders by email first. The date below shows when it last changed.
8. Contact us
GOTOES LIMITED (trading as Numbersaurus), 71-75 Shelton Street, Covent Garden,
London, WC2H 9JQ.
Email: hello@numbersaurus.com.