Privacy notice

Privacy by default for children

Homework Magic is designed so that a child can use the learning service without making their profile public or sharing extra personal information. We use high-privacy defaults for child-facing features.

• Child profiles use a nickname and school year rather than a full name or exact date of birth.
• Child-facing learning pages do not request precise location. Browser geolocation permission is disabled for the app.
• Study Buddy features use a shareable code and parent-managed approval rather than an open public child directory.
• Optional features should not be switched on by nudging a child to share more information.
• Where we rely on consent for optional online processing offered directly to a child under 13, a parent or guardian must provide or authorise that consent and we make reasonable efforts to verify it.

Who is responsible for the information?

Homework Magic is the data controller for Homework Magic.

Privacy email: support@homeworkmagic.co.uk
Business and postal contact: Homework Magic, London, UK

Information we may use

The information depends on which features a family uses. It may include:

• a parent or guardian email address and account security information, including an email a teacher enters to deliver a secure parent invitation;
• a learner nickname, year group, a coarse age band derived from the year group, and selected learning preferences;
• homework questions, answers, feedback, scores and progress records;
• reward XP, Gift Points, unlocked certificates, branded gift requests and parent decisions;
• an adult recipient's UK postal address when a parent approves a physical gift;
• support messages sent through the Contact us page;
• optional summer-camp interest responses completed by an adult, such as the adult contact email, broad programme age bands, optional school sector, broad starting region, approximate budget band, preferred camp size and group format, day/residential format, broad international-travel arrangement, general meal style, learning/exploring balance, broad language confidence, daily pace, age mix, adult-update preference, up to three design priorities, preferred dates, places, activities and accommodation ideas. The early-interest form does not need a child’s name, exact date of birth, school name, home address, health or disability information, allergies or dietary needs, passport or visa details, religion, sex, gender identity or sexual orientation;
• subscription status and Stripe customer or subscription identifiers; and
• limited technical logs needed for security, reliability and fault-finding.

Payment-card details are entered on Stripe's hosted payment pages. Homework Magic does not need to store complete card details.

Why we use information

• To create and secure parent or guardian accounts.
• To provide homework, marking, explanations and progress features.
• To run effort-based quests, certificates and parent-approved branded gifts.
• To prepare, post and support an approved physical gift order.
• To remember the selected learner and appropriate year group.
• To manage subscriptions and check access to paid features.
• To answer support, billing and privacy questions.
• With an adult’s consent, to record and analyse an adult summer-camp planning response. A separate optional choice is used if the adult wants promotional email updates about that camp.
• To prevent misuse and keep the service working safely.

We do not use a child's homework or progress information to show targeted advertising.

Our legal reasons for using information

• Contract: to create the parent or guardian account, supply requested learning features and manage a purchase or subscription.
• Legitimate interests: to secure, maintain and improve the service, prevent misuse, respond to support requests and understand reliability, while taking extra care with children's information.
• Legal obligations: for matters such as tax, accounting, fraud prevention, safeguarding or responding to a lawful request.
• Consent: where we clearly ask for an optional use and it can be withdrawn, including an adult summer-camp interest survey. Consent to submit the planning survey is kept separate from the optional choice to receive camp marketing or promotional update emails.

A parent or guardian manages the family account. Homework Magic is not intended for a child to create an account or purchase independently.

Who may process information

We may use carefully selected service providers to run the website, store data, provide AI features, send service emails, monitor faults and process payments. Providers should receive only the information needed for their task.

Depending on the feature and production configuration, these providers may include Google Cloud for hosting, databases and AI services; DeepSeek for selected AI review features; Brevo for service email; Stripe for payment processing; and a postal or courier provider for an approved branded gift. We remain responsible for choosing and configuring processors appropriately.

Child profiles, homework, answers and progress should not be placed in Stripe payment metadata.

International transfers

Some providers may process information outside the UK or European Economic Area. Where required, we use an appropriate transfer mechanism and related safeguards, such as an adequacy decision or approved contractual clauses.

Mainland China camp-interest responses are disabled by default and must be enabled by an administrator only after the relevant Mainland China privacy and cross-border processing setup has been reviewed. If enabled, a respondent who identifies the starting region as Mainland China is asked separately before the adult email and survey choices are transferred to and processed in the United Kingdom for camp planning. The form explains the purpose and data categories. Questions, withdrawal requests and other privacy rights can be sent using the contact details on this page. Do not use the early-interest form to provide passport, visa, health or other sensitive child information.

Keeping and protecting information

We use access controls, encrypted connections, restricted administrator access and other technical safeguards intended to protect account and learning information. Parents and guardians should use a strong, unique password and should not share login details.

An adult delivery address for a branded gift is encrypted before database storage, hidden from the learner-facing reward page, and available only through the protected fulfilment view. It is not sent to an AI provider or used for advertising.

By default, the service stores scores and progress facts rather than the full text of a child's homework, answers or AI feedback. Raw learner or AI content should remain disabled unless a documented need and a suitable privacy assessment justify it.

The 11+ mock-exam feature marks submitted choices within the request and does not create a stored mock-attempt history. The browser also does not save those choices after the page is closed.

Default retention periods

• learning and progress records: up to 365 days;
• printed weekly homework packs: 15 months after the week ends, unless an administrator chooses another period from 0 to 24 months. 0 means delete once that week's workflow is finished;
• uploaded worksheet files and raw OCR data: 30 days by default, and no longer than 90 days;
• detailed weekly results and saved AI explanations: 15 months by default, and no longer than 24 months;
• minimal reward balances, XP history, certificates and gift-order decisions: while the learner profile remains active, so earned progress is not lost;
• encrypted adult delivery addresses: while needed to fulfil the gift, deleted immediately after cancellation and normally within 30 days after dispatch;
• optional learning memory: controlled by a parent or guardian, normally 365 days and no more than 730 days;
• teacher-entered parent invitation email addresses and invite tokens: normally up to 30 days, unless the invitation is used or replaced sooner;
• support messages: normally 180 days;
• summer-camp interest responses: normally until about six months after the configured camp end date, so the same response can support planning and follow-up for that camp season;
• anonymous continuity identifiers: normally no more than 30 days;
• child login sessions: normally no more than 24 hours; if a child and grown-up actively tick “Remember me on this family device”, an HttpOnly device credential and the server-side remembered-child link may remain for up to 30 days so the device can offer that child’s nickname at sign-in; and
• password-reset links: short-lived and single-use, with expired records removed.

Some account, security, billing or accounting records may be kept for a different period where this is necessary for fraud prevention, disputes or a legal obligation.

Cookies and similar storage

Essential cookies are limited to what the site needs to work. Parent and teacher sessions may remain active for up to 30 days on that device. The session cookie keeps a signed-in parent or teacher logged in. The kid_session cookie keeps a child’s own login. Homework Magic uses essential browser cookies or local storage to keep a parent signed in, protect sessions, remember necessary settings and make account features work. Child authentication uses server-set HttpOnly cookies; the service does not intentionally keep a reusable Child login code in JavaScript-readable local storage. When “Remember me on this family device” is actively selected, the device receives an opaque HttpOnly credential and the server keeps a time-limited link to that child profile so the child’s nickname can be offered next time. The login code itself is not stored for this purpose. The page warns not to use this option on school, library or shared devices. We do not use behavioural advertising cookies.

When the first-party aggregate measurement setting is enabled, Homework Magic counts a small allow-list of events, such as visits to a parent landing page, parent account creation and subscription starts or cancellations. These daily counters do not contain learner or account identifiers, names, emails, IP addresses, cookies, homework, answers, scores, school details or free text, and they are not sent to advertising platforms. Voice-feature use is counted in the same aggregate-only way by event type, year group and broad subject; it is not stored in the learning RAG system and does not use an embedding or AI call.

If non-essential analytics or advertising technology is introduced in future, families will be given the information and choices required by law before it is used.

Learning summary emails can be stopped in the parent dashboard or from the unsubscribe link in each email. Other emails sent by Homework Magic include an unsubscribe link. For the summer-camp interest survey, promotional camp updates are an optional, separate, unticked email choice and are not required to submit planning interest. We keep a timestamp when that optional choice is given so we can evidence the consent. Stopping those emails does not close the account, remove the planning response or remove messages already in the message box. Emails needed to run an account, such as security and billing, may still be sent.

Answer by voice asks before the browser’s speech recognition starts. It is optional. School Finder maps load only after a grown-up chooses to show the map, because that map may set Google cookies.

AI-assisted homework help

AI may help generate or explain learning activities. It can make mistakes, so important decisions about a child should not be made only by AI. Parents, guardians and teachers should check important educational or safeguarding matters.

Clear identifiers are removed from model prompts where possible. Homework text is treated as untrusted data so that instructions hidden inside an uploaded document do not override the tutor's safety rules.

Homework Magic does not use AI output to make legal or similarly significant decisions about a child.

Parent and guardian choices

A parent or guardian may contact us to ask about:

• accessing or correcting account and learner information;
• deleting a learner profile or closing an account;
• objecting to or restricting certain uses of information;
• receiving a copy of relevant information, including Download my family's data from the account page; or
• making a privacy complaint.

Some billing records may need to be retained where required for accounting, fraud prevention or other legal obligations. An active subscription may need to be cancelled before an account can be fully closed.

If a privacy concern is not resolved, a parent or guardian may complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Contact us

Email support@homeworkmagic.co.uk, or use the secure message page for privacy questions or requests. Please do not include unnecessary information about a child.

Last updated: 1 October 2026.