What we store, and what we don’t

In The Scoop app, these are stored locally on the phone or tablet and are never sent to our servers:

• The child’s first name, if one was entered — it’s optional
• Their chosen avatar
• Which stories they’ve read and how far they got
• Which stories they saved
• Badges earned and days read
• Text size and read-aloud preferences

Two things on that list leave the device in specific, limited circumstances, and we’d rather spell them out than let the sentence above overstate itself:

• Saved stories, only when a parent shares the list. Creating a share link needs the server to know which stories are on it, so at that moment the list of story IDs is sent and attached to the parent’s account. Nothing else about the child goes with it. If no one ever shares a list, the saves never leave the device.
• Poll answers are counted on the server. Tapping an answer sends which option was chosen so it can be added to a running total. No identifier is sent or stored with it — we keep a count per answer, not a record of who picked what. Which answer a particular child chose is remembered only on their own device.

A parent can see this list and erase all of it from Parent Zone → Your kid’s data → Erase kid data. Deleting the app also removes it. Because it never leaves the device, we cannot retrieve it, restore it, or hand it to anyone.

When the app or site asks for a story, that request reaches our servers like any web request — which means it includes an IP address and basic technical details. We use this to deliver the content and to keep the service working and secure. We do not use it to build a profile, target anything, or identify a reader, and we don’t combine it with anything else.

We use no third-party analytics, session recording, advertising code or tracking pixels — not in the app, not on the site, not in the parent-only areas. The mobile app loads no third-party code at all.

One piece of honesty about the website: it is built and hosted on the Emergent platform, and the hosted page includes a script from that platform (assets.emergent.sh). It is part of the hosting environment rather than anything we added to measure readers, but it is code we do not write, so we will not claim the page is free of third-party code. We are documenting exactly what it does and will update this notice with the answer; if it turns out to observe readers, we will remove it.

Our moderation log records decisions about articles — which story was published or blocked and why. It contains nothing about who read them.

A parent may sign in with Google to turn on the daily digest email or to share a reading list. In that case we store the name and email address their Google account gives us, and a session token so they stay signed in. That’s it. We never sell or share email addresses, and every digest has a one-click unsubscribe.

A child’s name is never included in a shared list — lists are titled “Our Reading List” and contain only the stories themselves. The link can be opened by anyone who has it, so we keep the child out of it entirely.

The list does record the parent who created it, and their name is shown to anyone opening the link, alongside the stories. Share links do not currently expire and cannot yet be revoked — we are adding both. Until then, treat a share link as permanent and only send it to people you trust.

Story reports sent through the “Something not right? Tell us” link are anonymous. We record the story, the reason chosen and any note written — not who sent it.

• On-device kid data: kept until a parent erases it or the app is deleted. We never hold a copy.
• Parent account details: currently kept until you ask us to delete them. We are adding a self-service delete; today it is a manual request to the address below, which we action within 30 days.
• Shared reading lists: currently kept indefinitely. Expiry and revocation are being added.
• Moderation records: kept for 180 days, then removed automatically. They are how we show the safety system works and contain no reader information.
• Story reports: kept while we run the service, so we can show a problem was acted on. They carry no identifier for whoever sent them.
• Server request logs: handled by our hosting provider. We are confirming the exact retention period and will state it here rather than leave it vague.

Where this section says “currently”, it means the practice is real but weaker than we want it to be. We would rather publish that than a policy we do not yet meet.

A child’s data can be erased immediately from the Parent Zone — no request needed, because we don’t hold it.

For a parent account, write to us and we’ll delete the account, the email address and any shared lists created from it. Parents also have the right to review what we hold about their family and to refuse any further collection — though in practice, for children, there is nothing to review because there is nothing collected.