Privacy policy

Last updated 15 October 2026.

AuralRoom is run by Northpine Labs LLC (“we”). Children use this service, so we follow the UK Age Appropriate Design Code: high privacy by default, the least data possible, and no profiling. A plain-language version for young people is on our children's privacy page.

What happens to your voice

• Singing and clapping are analysed on your device, in the browser. The sound never leaves the device and is discarded as soon as the result is shown.
• Spoken answers are turned into text on your device when your browser can do that locally. If it can't, and an adult agrees, the recording of that one answer is sent to our speech-to-text provider (Replicate, running the Whisper model), turned into text and deleted. We never store it or log it. Only the text is used to mark the answer.
• Answer text is marked and then discarded; we store the mark, not what was said. When an AI examiner helps with marking, it receives the answer text and the question only (Anthropic, Claude API) — no audio, no name, no identifiers.

What we store

• A random device identifier (a cookie) so free practice and progress work without an account.
• Practice results: which exercise, score, date — no audio and no answer text.
• If an adult creates an account: e-mail address, chosen board and grade. We never ask for a child's name.
• Exam date and reminder preferences if you set them; e-mail address for the checklist or reminders if you confirm it.
• Purchases: Stripe processes payments; we keep the plan, the date and the e-mail Stripe returns.
• Teacher links: a random code and anonymous scores per device token; no pupil names.

Cookies and analytics

• Essential cookies: the device identifier, your board/grade choice, sign-in session.
• Analytics (PostHog): page views and product events such as “practice item finished” with grade and score — no recordings, no answer text, no session replays, no tracking of what you type. You can turn analytics off at the bottom of any page.
• Advertising (Google Ads): one cookie to measure whether our ads lead to purchases, only if an adult accepts it, and never on practice pages.

Who processes data for us

OVHcloud (servers, USA) and Cloudflare (network), PostHog (analytics, USA), Stripe (payments), Resend (e-mail), Anthropic (AI marking of answer text), Replicate (speech-to-text when used). Transfers rely on standard contractual clauses / UK IDTA addenda where required.

How long we keep it

Practice results: while you use the service and 24 months after last use. Accounts: until you delete them. E-mail lists: until you unsubscribe. Payment records: as required by tax law (up to 7 years).

Your rights

You can ask for a copy of your data, a correction, or deletion at [email protected]. If you are in the UK you can also complain to the Information Commissioner's Office (ico.org.uk). Parents and guardians can exercise these rights for their children.

Children in the United States

For children under 13 we rely on the COPPA audio-file exception: a spoken answer is collected only as a replacement for typed text, used only to produce the text, held briefly and deleted immediately. No other personal information is collected from children; accounts are for adults.