What we are launching with
Your data. What we keep, for how long, and how to delete it.
You can get a copy of everything we hold, including everything we hold about your child. You can turn off data sharing. You can withdraw the permission you gave the companies that help run GuardNIL. You can delete the whole account. All four are buttons in settings, not emails you have to send us.
What this part does
It gives you the three controls the law says you should have, and it puts them where you can find them. You do not have to ask us. You do not have to wait for us to reply.
Every one of these controls is available to anyone with an account, in any state, not only where a law requires it.
This page is for the person whose data it is. It answers what you can do about it: press this button, here is what happens, here is what survives.
The privacy page is for someone checking us. It answers whether we are allowed to do any of it: the law, how we ask permission, and every outside company that touches data. Same subject, two different questions, so we kept them apart rather than making one page that answers neither well.
Getting a copy of your data
Press Request my data in privacy settings.
You can do this twice a day. The limit is there so nobody can flood the system, not to slow you down.A background job gathers everything.
It pulls your own record from thirteen different places: your profile, every wallet line, your goals, your progress, your agreement, your payments, your bank link record, your notes both sent and received, and the permanent record of things you did. It then does the same for each child linked to you: their profile, goals, wallet, school records, stats, the encouragement they were sent, Study Hall messages, and learning progress.The file is put somewhere private.
Not a public web address. A private store that nobody can browse.We email you a link that expires.
The link works for seven days and then stops working. If it expires, ask again. See the honest note below, because seven days is longer than that link should live.
The twice-a-day limit is deliberately built to let you through if the part that counts your requests is broken. Getting a copy of your own data is a right, and a right should not be blocked because a server somewhere is having a bad day.
Withdrawing permission
When you set up an under-13 account you gave permission for a short list of named companies to handle your child's information. You can take that permission back, from Settings and Privacy, without asking us and without explaining why.
Withdrawing switches off the AI features for your athlete straight away: Study Hall, Scout, the encouragement drafts and trip planning all stop. Their account, their wallet and their records are untouched, and you can give permission again whenever you like.
The record that you originally gave permission stays. Children's privacy law requires us to be able to show that we asked properly, and deleting that record would destroy the proof rather than withdraw the permission. Withdrawing is a separate mark against it.
This was the last of your rights that you could not exercise on your own. Until 2026-08-11 the only ways to withdraw were to dispute the fifty-cent charge on your card or to email us and wait. The rule was honoured everywhere in our code; there was simply no button. We would rather say that plainly than let the fix look like it was always there.
Deleting your account
Open settings and find the danger zone.
It is kept on the main settings page, away from the everyday privacy controls, because it cannot be undone.Type your own email address exactly.
Not a checkbox. You have to type it. This stops an accidental click and stops someone using your unlocked laptop.Your account is switched off immediately.
You are signed out. Nothing of yours is visible in the app any more.Thirty days later, it is erased for real.
A background job goes through thirty-four tables and deletes your family's rows one table at a time. The thirty days exist so a deletion made in anger can be undone by contacting us, and so we are not erasing a record in the middle of a payment dispute.
Deleting a child's record
A parent can delete just one child from that child's page. You type the child's first name to confirm. Only the primary parent can do it. A look-only second parent cannot, which we fixed after we found that they once could.
If a parent deletes themselves
Your child is described inside your account rather than holding one of their own, so deleting yours removes the family record with it. There is no leftover child profile sitting on its own afterwards.
What we keep even after you delete
Three things survive, and we will say exactly why for each one. This is not a loophole. It is the ordinary rule that a business cannot erase its own financial and legal records on request.
- What we keep
- Permission records
- What we strip
- Your address on the internet and which browser you used are erased, once your last child leaves. While another of your children is still with us, the record stays intact, because it is also the proof of permission for them.
- Why
- Proof that we asked for permission properly, which children's privacy law requires us to be able to show.
- What we keep
- Money records
- What we strip
- The description on each line is replaced with the word redacted.
- Why
- Tax records. A business has to keep them.
- What we keep
- The permanent activity record
- What we strip
- Nothing. It is left untouched.
- Why
- It is the forensic record. If we could edit it after the fact it would not be evidence of anything.
Everything else goes: your profile, your agreement, your notes, your progress, your goals, your bank link record, your notification settings, and your sessions.
Three honest notes
Every question the export asked was scoped to the person asking. For a parent that meant it returned your own profile and nothing at all about your child. Because an under-13 child has no login here by design, you are the only person who could ever ask — so the right to see what we hold about your child was not merely awkward to use, it could not be used.
It works now, and the list above says exactly what arrives. We are recording the gap rather than quietly fixing it, because a page that only ever describes the current state teaches a reader nothing about how carefully to read it.
The file we build is a full copy of your family's data. We put it somewhere private and email you a long, unguessable web address for it. That address works for seven days.
Anyone holding the address can open the file within that window, and an emailed link travels through more places than the file itself does. Seven days is longer than we would now choose. We would rather state the number than describe it as a short-lived link, which is what our own wording used to do.
Our documents say we keep permission records for three years and money records for seven. Those are the right numbers and they are what we intend.
But no job runs today that deletes them when the clock runs out. What the code actually does is keep them and strip the personal parts out. That is stricter than a timed deletion in one sense, since the personal information is gone immediately. It is weaker in another, since the rows stay. A reviewer should know which of those is real code and which is a policy sentence.
The erase job works through thirty-four tables one at a time. Until 2026-08-09, a failure in twenty-five of them was written to our logs while the job carried on and reported success. A table could fail to clear, the job would still say it worked, and the only evidence was one line in a log nobody was watching.
The reason given for that design was that a table might not exist. We checked all thirty-four against the live database and every one of them does, so the caution was protecting against nothing. A failure in any step now stops the job, which retries, and the deletion is either complete or visibly incomplete. We found this while writing this page, and it is the kind of thing we would rather publish than have discovered.
If something goes wrong
You delete by accident
Contact us inside thirty days. Nothing is erased until then. After thirty days it is gone and we cannot bring it back, because there is nothing left to bring back.
Your export email never arrives
Ask again. The limit allows a second request in the same day for exactly this reason.
Someone else tries to delete your account
They would need to be signed in as you and type your email address exactly. And the whole thing is written to the permanent record with who did it.
You want something specific removed, not everything
Email us. We handle those by hand and we have a written process for it, including how we confirm the person asking is really the parent.