Privacy Policy — BrainLab Kids
Effective date: 12 June 2026
Operator: New World Education, Dubai, United Arab Emirates
Contact for all privacy matters: khurram@newworld.education
Drafted to the strictest of COPPA (US), GDPR (EU), and UAE PDPL. Pending review by a privacy lawyer before we scale — published in good faith now because you deserve to read it now.
1. The short version, for parents
We built this site to need almost nothing from you. Kids can use every lab with no account, no name, no email. Camera and motion labs run entirely on your device — we never see or keep anything from them. Progress is saved on your device only. If a parent creates an optional account, we keep just your email and your child's nickname and map progress, and you can delete it all anytime.
Our claims posture, which is also a promise: we teach kids about their brain — we make no medical, therapeutic, or cognitive-improvement claims.
2. What we collect from children
Nothing. No names, no emails, no photos, no voice recordings, no persistent identifiers used to track children. The labs run free, with no signup, in the browser.
3. Your camera and microphone
Some labs use your device's camera or microphone — to track your hand, read an expression, or hear a sound you make. All of this happens on your device, inside your browser. We do not receive, record, store, or share what your camera sees or your microphone hears. When the lab ends, nothing is kept — there is no audio file and no video file, on your device or anywhere else. The camera/mic is only on while the lab is running and your browser shows you when it's in use.
Where a lab uses AI (hand tracking, body pose, face mesh, object recognition), the AI model is downloaded to your phone and runs in the browser. The intelligence comes down to the device; your child's camera never goes up to a server. Each sensor lab carries a trust strip saying exactly what that lab does, and our For Parents page lists every lab's behaviour.
4. Progress and the Brain Map
Lab progress is stored locally on your device (browser storage) — no account needed, and we never see it. A "Reset my map" control wipes it completely, anytime. It belongs to the device owner, not to us.
5. Cookies and identifiers
None for children. A session cookie exists only for parent login. There are no analytics scripts on this site. If we ever add measurement, it will be a cookieless, aggregate-only counter with no child-level identification, named here first.
6. Parent accounts (optional)
The only account that can exist is a parent account. We store: your email, your password (as a salted hash, via our authentication provider), your child's nickname (with guidance to avoid real names), and lab progress. The parent is the data subject and consents at signup. Child profiles hold no real-world identifiers.
7. Third parties
Hosting: Vercel. Database and authentication: Supabase. Email (parent emails only): Resend. Each receives only what its function requires, and none receives children's personal information — because none exists. We keep a written list of every third-party service and require written assurance of safeguards.
8. Retention
- Children's personal information: none collected, therefore none retained.
- Camera/microphone data: processed transiently in the browser; retention is zero seconds beyond processing.
- On-device progress: yours; clearable anytime via "Reset my map".
- Parent accounts: kept while active; deleted within 30 days of a deletion request, or after 24 months of inactivity (with an email warning first).
- Backups: expire on a fixed 90-day schedule. No data is retained indefinitely.
9. Parental rights
You may review what we hold, delete it, or refuse further collection at any time — email khurram@newworld.education and we will honor the request within 30 days.
10. Our claims posture
We make no medical, diagnostic, therapeutic, or cognitive-improvement claims. Every lab is built on an established, published scientific phenomenon, presented as what happens — not what it fixes. We teach kids about their brain.
11. Jurisdictions
COPPA applies to US visitors, GDPR to EU visitors, and the UAE Personal Data Protection Law to our home operations. Where they differ, the strictest standard governs.
12. Private sections
Parts of this site are private, invitation-only sections governed by separate written agreements with the families concerned. They collect nothing beyond what those agreements state.
13. Changes
If this policy ever stops being true, we will tell you before we change anything — not after. Material changes are announced on this page with a new effective date.
This document is written in plain English deliberately. If any part is unclear, that is our failure and we would like to hear about it.