Privacy Policy

Last updated: October 18, 2026

Effective Date: October 18, 2026.

Owlbert is a learning app for kids, run by Bare Metal Labs. We built it with privacy first, because it is used by children. This page explains what we collect, why, and the choices you have.

Parents are in charge

• The parent or guardian is the account holder. Children do not create accounts or give us their email.
• By signing up, you give consent on behalf of the children you add, and you confirm you are their parent or legal guardian.
• Kids sign in on a device you have already signed in, by picking a profile. Everything about a child is visible to, and controlled by, you.

What Owlbert Collects

About you (the parent):

• Your name, email address and a password (stored only as a salted hash). We ask you to confirm your email address, and you can turn on two-step login (2FA) with an authenticator app.
• Your parent PIN (stored only as a hash).
• When you agreed to our Terms and this policy.
• Feedback you send us (the message, an optional screenshot, and the page you were on, our app version and a short browser summary). It contains no child names or lesson content unless you type them. You can see what you sent in Send feedback, and ask us to delete it any time.

About each child you add:

• Name or nickname, avatar and grade level, so we can pick the right lessons. We do not ask for a birth date or birth year.
• Answers and progress: what they answered, how long it took, which skills they are strong or weak on, points and badges.
• Scans: homework photos or PDFs that you (or your child, if you allow it) upload. We use homework scans to tailor practice to how your child is taught.

We use this only to run Owlbert: choose practice, mark answers, show you progress, and keep the service working.

AI Processing and Service Providers

• Some features use AI: marking written answers, reading homework scans, and writing hints. For those, the relevant text or image is sent for processing. We add no names, emails or family identifiers; anything written on the homework itself (such as a name on the page) is visible to the model.
• Anthropic (Claude), United States. Requests go to Anthropic, using your own API key if you add one. Under Anthropic's API terms, that data is not used to train their models. Anthropic keeps API data for a limited period under its own retention terms.
• Fly.io, United States. Hosts the app and its database.
• Cloudflare. Receives homework you email to your family address and passes it to us.
• Resend. Sends our emails (verification links, confirmations, reports).
• We send only what is needed for the task. We do not send your password.

What We Do NOT Do

• No ads, ever.
• We do not sell or rent your or your child's data.
• No third-party trackers or analytics scripts. We use only the cookies needed to keep you signed in and remember which profile is selected.
• We do not build advertising profiles of children.

Helping Improve Owlbert (optional)

A parent can choose, separately from signing up, to share pseudonymised learning data with Bare Metal Labs (Account → Help improve Owlbert). The parent picks what is shared (homework scan readings, written answers, practice history and learning signals, reports; photos of homework only if separately turned on, because they can show names, school and teacher) and for what period. Names are replaced and emails, phone numbers and web addresses are removed on your device before anything leaves it, and the data is locked so that only Bare Metal Labs can open it. It is pseudonymised, not anonymous: handwriting, context and timing can still point to a child. We use it only to improve Owlbert's teaching and reading, including testing and possibly training the AI models we use, and we never sell it. You can stop with one click and delete what was shared at any time; deleting removes it from our storage but cannot recall a copy already opened for analysis, which we delete within 90 days. Each choice is recorded as a separate consent.

Data Retention

We keep your family's data while your account is open. You can delete a scan, a child or your whole account at any time. Deleting your account permanently deletes your family's data, including children's progress and scans. Our backups are encrypted and roll off within 14 days, so deleted data can remain in an encrypted backup for up to 14 days. Learning data we derive from a scan (which skills were practised, whether answers were right, and practice questions modelled on the homework) is kept with the child's progress until you delete the child or the account.

Your Rights

Export

In the parent portal, go to Account, then Export data, to download everything we hold about your family.

Delete

In the parent portal, go to Account, then Delete account. This is permanent. You can also delete a single child from the Children page.

Anything else

To see, correct or remove data, to make a privacy or deletion request, or to ask a question about a child's information (including requests from a parent or guardian), email bml.admin0@gmail.com. We will respond within a reasonable time.

Security

The full picture, including what we cannot protect against, is on our Security page.

• Everything is sent over HTTPS.
• After reading a scan, we lock it so only your family's devices can open it (rolling out; until your family sets up its key, we can read your scans).
• Optional two-step login (2FA) and email confirmation protect your account.
• Database backups are encrypted.
• Anthropic API keys you add are encrypted at rest and never shown again in full.
• Passwords and PINs are stored as hashes, never in plain text.
• Each family can only ever see its own data.

No system is perfectly secure, but we take care to protect your family's information.

Children's Privacy

Owlbert is meant to be used by children under a parent's account. We do not knowingly collect information from a child without a parent's consent. If you believe a child's data was added without a parent's consent, contact us and we will remove it.

Changes to This Policy

If we change this policy in a meaningful way, we will update the date above and tell you by email or in the app.

Contact Us

Bare Metal Labs, bml.admin0@gmail.com