How we look after your data.

Last updated: 2 June 2026

Data controller

Captain's Words (Captain Sword) is the data controller for personal data processed through this website and the Captain's Words service.

Contact: hello@captainswords.app

What we collect

We may collect parent or staff account details (name, email), child profile display names, school and class information, login codes, game session results, word attempts, progress summaries and technical information needed to keep the service secure.

Lawful basis (UK GDPR)

We process personal data on the following bases:

• Contract — to provide the service you signed up for (parent accounts, school licences, billing where enabled).
• Legitimate interests — to keep the service secure, improve literacy features, and respond to support enquiries, balanced against your rights.
• Legal obligation — where we must retain or disclose information to comply with law.
• Consent — only where we ask explicitly (for example optional marketing, if we offer it in future).

How we use it

We use this data to authenticate users, connect children to the right learner profile, adapt literacy practice, show progress to authorised parents or school staff, respond to support requests and protect the service from misuse.

Children's data

Children do not need email accounts to play. Child and student access uses profile-based logins, codes and PINs so we can avoid asking children for unnecessary personal information. Parents and authorised school staff control access.

Schools

School data is separated by school account. Authorised school staff can manage classes, students and progress for their own school.

Where a school purchases a licence, the school is typically the data controller for student data processed in the school context, and Captain's Words acts as a processor providing the software. Family accounts remain under the parent's control as controller for home use.

Retention

• Account data — kept while your account is active and for a reasonable period after closure to handle support or legal requests.
• Learning session data — kept while the learner profile exists so progress can be shown to authorised adults.
• School enquiry emails — kept only as long as needed to respond and manage the relationship.
• Security logs — kept for a limited period for fraud prevention and service reliability.

You may request deletion where we are able to honour it without conflicting legal or contractual obligations.

International transfers

Our infrastructure providers (including Supabase and Vercel) may process data in the UK, EEA, or United States depending on project configuration. Where data leaves the UK, we rely on appropriate safeguards such as standard contractual clauses offered by our providers.

Read aloud and speech recognition

When a child uses read aloudin the game, the device microphone is used through the browser's built-in speech recognition (Web Speech API). On browsers such as Chrome and Edge, audio is typically sent to the browser vendor's speech service (for example Google) to produce a text transcript. Captain's Words does not store voice recordings.

We may store the text transcript and a confidence score with the learning attempt so parents and authorised school staff can see progress. Skipped read-aloud rounds are recorded without a transcript. See our cookies page for how this relates to browser storage.

You can manage microphone access in your browser or device settings. If read-aloud is not used, no speech audio is sent for that feature.

Third-party services

Captain's Words uses trusted providers such as Supabase for authentication and database storage, Vercel for hosting, Resend for email delivery and Stripe for payments when billing is enabled.

Where read aloud is used on Chrome or Edge, speech processing may also involve the browser vendor's speech provider (such as Google) as described above. That processing is controlled by the browser, not by Captain's Words directly.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure in certain circumstances
• Restrict or object to processing in certain circumstances
• Data portability where applicable
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

For school accounts, some requests may need to go through the school as data controller.

This policy should be reviewed by qualified legal counsel before wider commercial launch. It reflects our current MVP practices.