Who is responsible
Remelia is a trading name of Misheli Ltd (company number 13292776, registered in England and Wales), which is the data controller for everything on this page. Misheli Ltd is registered with the Information Commissioner’s Office, reference ZC250015.
The website, both apps, the question service, the accounts and the sign-in service all run on one server that Misheli Ltd runs itself, not on a cloud service. Our server and its backups are in the United Kingdom. The terms of use say what the service does and does not promise.
This website
No cookies, no analytics, no adverts and no third-party requests. The fonts are served from this site. The server keeps a standard access log, for security and to count visits in totals, and nothing else: what it records and for how long.
A grown-up’s account
An account holds your email address and your password, and nothing else about you: no name, no phone number. The password is kept only as a one-way hash by Remelia’s own sign-in service, so nobody can read it. The only emails the account sends are one to check the address is yours and, if you ask, one to reset a forgotten password; they go through 20i, our email host in the UK.
Everything the account holds:
- What you typed in Remelia Parents: their first name and their year group, your changes to their settings, the totals of any practice test you marked here, and which reading texts a paper printed or opened here gave them.
- What their linked devices send: their answers, the grown-ups’ settings and each device’s name, as their device lists them under Devices and data.
- Their devices: each one’s name and when it was last in touch.
- Travel packs you ask for: each one’s start date, when it was asked for, when its plan arrived and when it was first downloaded, and which device downloaded it. It also holds a random number that remakes the pack and, until the day after it ends, the plan of its days.
- What they got wrong, only if you turn it on: the questions they got wrong or left in their last five sessions, with what they answered, the right answer and the explanation, and no name. It is kept 30 days after their device last sent it, and deleted at once when you turn it off or delete them.
- Your email address: for signing in, with a password kept only as a one-way hash by Remelia’s own sign-in service; it is emailed only to check it and to reset a forgotten password.
Beside these it keeps the dates that make it work: when the account and each child were added, when each device was linked or unlinked, when each answer arrived, and when a deletion was asked for. The link codes you ask for are kept only as a one-way hash, and go once used or out of date. If your child flags a question as wrong, we may add a note of what we did about it; that note goes when the flag does.
Signing in
Signing in is Remelia’s own sign-in service at auth.remelia.co.uk. While you are signed in it keeps a session: the internet address you signed in from, and when the session started and was last used. A session ends when you sign out, after 30 days unused, or after 90 days at most, “Remember me” or not.
You can also sign in on your child’s device, with the “Sign in” button on its first screen and in its top bar. Its page is the sign-in service’s own, so your email address and password go to the sign-in service and never to the app. The app asks the account for your list of children so you can choose who uses the device. If you choose to add the child from the device, it sends the child’s first name and year group. It links the device under a name it makes from the child’s first name and the kind of device, such as “Ava’s iPad”, with a random id, and you can see the device, and unlink it, in Remelia Parents. The app stores none of your sign-in: only the child’s key, as for a code. The app ends the sign-in on the device as soon as it gets your sign-in back, before it asks who uses the device, so reloading, going back or closing the page while you choose leaves nothing open. That holds for each of the last five times you pressed Sign in on that device, and the app tells you if it cannot end one. For the few minutes you take to choose, the app holds your access token in its memory only, and lets it go when the device is linked, when you turn back or when it runs out.
To stop someone guessing a password, after ten wrong passwords signing in to that account is paused, for one minute at first and for up to 15 minutes. The count of wrong passwords, with the internet address of the latest, is forgotten after a sign-in that works or 12 hours without another wrong one. It keeps a short record of what happens to accounts for 90 days, so that we can see the emails arrive and spot someone trying to break in: an account being made, its address being checked, a checking or password-reset email being sent or failing to send, a sign-in that fails, and an account being deleted. Each entry holds the time, the account, the email address involved and the internet address it came from. Signing in successfully is not recorded. A sign-in that fails is also written to its running log, with the email address tried and the internet address it came from.
Where the questions come from
The questions are made on our server. Before a session, a practice test or a printed paper, the device asks the server for them. Your child’s app also keeps the next session’s questions ready on the device, so that a session can start without a connection. This is so with or without an account.
A request holds only this:
- Topics: which ones to ask about, and how many questions on each.
- Progress by topic: where each topic stands (new, unfinished, due back, hard or not yet due), its stage number, and which topics have been begun.
- What was shown lately: which question cards, interview practice cards, passages and writing prompts, and in a practice test the questions already asked, so none comes round too soon.
- The year group: the one set on the device, so the questions fit it.
- The shape of the session: how long it is, how many questions are multiple choice, how its answer lines are laid out, and how many could not be made.
- A printed paper or practice test: the paper’s code and its exam, or the test’s sections and the rules of its exam.
It holds no name, none of the child’s answers, nothing the child typed and nothing about their world. The server checks every request field by field and refuses one that holds anything else.
Each request carries an anonymous device number: a random string made on the device the first time it asks and kept in the browser’s storage. It is linked to no account and sent nowhere else.
The server uses that number, and the internet address a request comes from, only to count what one device and one address have asked for in a day, so that the service is shared fairly. It holds each as a scrambled code in its memory for the rest of that day. It writes no request down, a restart clears the codes, and these requests are left out of the access log described under Server logs.
Looking up a school
Most of the register of schools, their exams and what their websites say they teach is held on our server, not in the app. So when a grown-up searches for a school, the app asks the server. When they choose one, it asks for that school’s record, unless it already holds one. This is so with or without an account.
A look-up holds only this:
- The words typed: a school’s name or town, as typed in the search box.
- For the list of schools with a plan: the region and exam provider narrowed to, the year group set on the device, the school year it was set in and the device’s time.
- A school chosen: which school it is, by its number in the government’s register or in the list of schools with a plan, and the device’s time.
Apart from the words typed in the search box, it holds no name, none of the child’s answers and nothing about their world. The server refuses a request that holds anything else.
Each look-up carries the same anonymous device number as a request for questions. The server treats it the same way. It counts what one device and one address ask for in a day, and writes none of it down. These requests are left out of the access log described under Server logs.
The app keeps the record of each school chosen in the browser’s storage, so that it can plan with no connection. It asks again when it opens online and a record is more than a week old. A school typed by hand and kept as typed is not looked up. Keeping the name as typed asks our server for nothing more, and it stays on the device. The words typed to search for it did go to our server, as a search.
Counting launches and installs
The apps count launches and installs as daily totals, with nothing about the family. At most once a day, each app tells our account service that it was opened. It says which app it was (your child’s or Remelia Parents), whether it was opened in a browser tab, installed to the home screen or as a store app, and on what kind of device: Android, iPhone or iPad, a computer or something else. When the browser says the app was installed, the app sends that once more. Nothing else goes with it: no device number, no account, no name, no child and no time of day. The service adds one to the total for that day. The try page sends nothing.
The internet address the message comes from is used only to limit how often one address can send, and is held in the service’s memory for a short time. It is never written to the totals or to a log, and these requests are left out of the access log described under Server logs.
What is sent when a grown-up links an account
- Their answers: for each one the topic, whether it was right, how long it took, whether a hint was used and when, and, when a wrong answer matched a common mistake, which kind (such as adding the denominators), and, for a story asked one way today and the other way another day, the number that makes the story again (never what they typed); the skills check and the six-weekly re-checks; the teaching notes they read, the worked examples they studied on meeting a topic, the strategy cards they played, the times a grown-up noted they explained a puzzle or a passage, and the topics they said school has started; each week’s different day (which kind, how many questions it asked and they answered, and whether they made up a question, never the question itself); on a times tables check, how many they got right and which facts they missed, never what they typed; each writing piece they finished (which prompt, never what they wrote, which stays on paper) and the boxes a grown-up ticked for it; which reading passages they have been shown, and whether they read one with a grown-up or on the reading day, so that none is shown twice; for each practice test, on this device or marked in Remelia Parents, which test it followed, whether it was on paper or on screen and the printed papers’ codes, and for each section the marks, the questions left blank, whether any answers looked shifted by one line, the minutes used and the pauses (never an answer they gave); for each whole SATs-style paper a grown-up marked and recorded, on this device or in Remelia Parents, the paper’s code and its raw mark (never an answer); and, once, their progress from before the answer log; and any question flagged as wrong, with its words, the answer expected, the answer given and why: the one place an answer they typed goes, and never with their world’s names in it.
- The grown-ups’ settings: the school plan and its dates, the school they attend (when it is chosen from the list), your answer about whether their class has two year groups, the choices in Settings: pace, session length, puzzles, the pinned topic, breaks, the warm-up clock, the schools they are preparing for, the school year and month chosen for a test at a school not on the list, the subjects they are studying, whether they pick the subject each time, how mixed subjects share the days, the weekly different day, the reading day, the Year 7 head start, competition practice (which maths competitions it is on for), the academic scholarship option on each chosen school, the pronouns the app uses for the child, whether the questions they got wrong are sent to the account, and which reading texts a paper printed or opened in Remelia Parents gave them, never their answers.
- Deadline reminders, only if a grown-up switches them on in Remelia Parents: the names of the chosen schools, the kind of each date to act on (such as registration closing), the date, its words and the school’s link, so the account can email that grown-up before it; sent from Remelia Parents, never from the child’s device, and never with the child’s name.
- Travel pack plans, only if a grown-up asks for a pack: the plan for each of the pack’s days, made on their device from their own record. It holds the topics; where each stands; what was shown lately; the year group; the shape of each set; the topics begun so far. It never holds their name, an answer they gave or their world.
- The questions they got wrong, only if a grown-up turns that on: the questions they got wrong or left in their last five sessions, skills checks and practice tests of the last 30 days. Each comes with what they answered, the right answer and the explanation. A grown-up reads them in Remelia Parents. No name goes with them, and the names of their world are replaced. They are sent again whole after a change. They are deleted from the account when the grown-up turns the switch off, and when the child or the account is deleted. They are kept 30 days at most, and used for that page and nothing else.
- Signing in on the device, only when a grown-up does: the grown-up’s email address and password go to the sign-in service from its own page and never to the app, which keeps neither; the app ends the sign-in on this device as soon as it gets the grown-up’s sign-in back and keeps only the child’s link; the account’s list of children is read so the grown-up can choose who uses the device; the child’s first name and year group go to the account only if the grown-up chooses to add the child from the device; the device is linked under a name the app makes from the child’s first name and the kind of device (such as “Ava’s iPad”) and a random id.
- The device’s name: the name typed when linking with a code, with the code typed to link it, a random id for the device and the time of each change; nothing else about the device.
What is never sent
None of this goes to an account, linked or not. A request for questions holds only what is listed under Where the questions come from. That includes the year group set on the device and, for interview practice, which cards were shown lately. A look-up of a school holds only what is listed under Looking up a school. Nothing else below is in either.
- Their world: their name as typed on their device (except when a grown-up signs in on it and chooses to add them to the account, as the list of what is sent says), and their friends, pet, team, places and hobbies.
- How sessions felt: their taps at the end of each session.
- Their sessions, warm-ups and streak as their device counts them: the warm-up times among them, and which of the occasional tricks and jokes at the end of a session they have been shown.
- What they got wrong, unless a grown-up turns on sending it: the questions they got wrong or left in their last five sessions, skills checks and practice tests. Each comes with what they answered, the right answer and the explanation. They are kept on their device for a grown-up who opens them behind the grown-ups’ gate. They are left out of a saved copy or an export unless that grown-up ticks to include them. A copy goes to the account only while a grown-up has turned that on, as the list of what is sent says.
- A school typed by hand: when their school, or a school they might apply for, is not on the list and its name is typed instead. The words typed to search the list go to our server as a search. Keeping the name as typed asks our server for nothing more.
- The errors their device has caught: listed under Devices and data on the device itself, and put only into a copy saved there.
- Interview practice ticks: what a grown-up ticked after each practice card, which cards were shown lately, and whether the cards are switched off, kept only on the phone that ticked them; nothing they say is recorded.
- Saved copies and exports: the files stay wherever they are saved.
- Anything else their device keeps.
More than one device
Each device keeps its own record until a grown-up links it. Once it is linked, what is listed above goes to the grown-up’s account, and each linked device takes the others’ answers from it, so every one of them shows the same progress. A device that is unlinked stops sending, and what is already on it stays there.
Travel packs
A grown-up can ask in Remelia Parents for a travel pack for a child whose device is linked. It is 14 days of questions that the device keeps for a time with no internet connection. A device that is not linked cannot ask for one. There can be 3 packs for each child in a school year, counted when a pack is first downloaded. A pack that is asked for and not downloaded within 7 days lapses and does not count.
What goes to the account, and is kept there:
- The start date: the first of the 14 days, chosen by the grown-up.
- The plan: made on the child’s device from its own record, one for each of the 14 days.
- What is in it: the topics, where each stands, what was shown lately, the year group and the shape of each set, and the topics begun so far.
- The dates: when the pack was asked for, when its plan arrived and when it was first downloaded, and which device downloaded it.
- A random number: chosen by our server when the plan arrives, so that the same pack can be made again. It says nothing about the child.
The plan holds no name, none of the child’s answers, nothing typed and nothing about their world. The plan is deleted the day after the pack ends, or 7 days after it was asked for if it was never downloaded. The rest stays until the child or the account is deleted, because the packs in a school year are counted from it.
When the child’s device downloads the pack, the account passes the plan and the number to the question service on the server’s own network. The service makes the questions and keeps nothing. The device keeps the questions in the browser’s storage and uses them only when it cannot get questions from the server. It deletes them the first time the app is opened or shown again after the pack’s last day, and when the child is unlinked.
Sharing your school’s plan (off unless you turn it on)
When you confirm which topics your child’s class is doing this half-term, you can choose to offer that plan to other parents at the same school. Only four things are shared: the school, the year group, the half-term and the list of topics. Nothing else is shared: not your name or your child’s, not their progress or answers, and not their device. Other parents see “A parent at Oakfield confirmed this plan in January”, never who you are or how many families shared. We keep a shared plan for this school year and the one before, then delete it. Turn the switch off at any time and everything your family shared is deleted at once. The plan comes from a parent, not from the school, and we never send it to the school or anyone else. Why we hold it: your consent, which you can withdraw at any time.
What your child got wrong (off unless you turn it on)
In Settings, you can turn on “Send what they got wrong to my account” for a child. It is off until you do, and it is for one child at a time.
When it is on, your child’s device sends the questions they got wrong or left. These come from their last five sessions, skills checks and practice tests of the last 30 days. Each comes with what they answered, the right answer and the explanation. You read them in Remelia Parents.
No name goes with them, and the names of your child’s world are replaced. The device sends the whole list again after a change, so the account holds the latest copy and not a history.
The account keeps a copy for 30 days after it was last sent. It deletes it at once when you turn the switch off, on the device or on your phone. It also deletes it at once when you delete the child or the account. The service’s own backups are overwritten within 35 days after that.
We use it for that page and nothing else. It is in no total, report or email, and our look-up of an account never shows it.
If you do not turn it on, none of this leaves the device. The questions stay on it, for a grown-up who opens them behind the grown-ups’ gate.
Cookies and storage on the device
- This website: sets no cookies and stores nothing on your device.
- The sign-in pages: set only the cookies signing in needs (such as KEYCLOAK_SESSION, AUTH_SESSION_ID and KC_RESTART): they keep you signed in and keep the form safe, and go when you sign out or the session ends. If you tick “Remember me”, one more (KEYCLOAK_REMEMBER_ME) keeps your email address in that browser for a year, to fill in the form next time.
- The apps: set no cookies. They keep what they need in the browser’s own storage on the device (local storage and IndexedDB): your child’s app keeps their record there, and, once linked, the key that lets it send; Remelia Parents keeps your sign-in there. Both also keep an anonymous device number for the question service and the day an app last counted a launch. Your child’s app also keeps the questions of its next session, and of a travel pack until the day after it ends. Both keep the record of each school chosen. Both keep their own files so they open without a connection. Clearing the site’s data in the browser removes it all.
All of this is strictly necessary for what you asked for, and none of it is used to track anyone, so none of it needs your consent.
Server logs
Like any web server, ours writes a line for each request to the website, the two apps, the sign-in service and the account service: the internet address it came from, the time, the address asked for, the result, and the headers the browser sends, such as its make and version, the page it came from and its language. Passwords, sign-in tokens, cookies and the one-time key in the links in our emails (which carries your email address) are blanked out before a line is written. Requests for questions or for a school, and launch or install counts, are left out of this log. No internet address is kept for them. If the service behind the server is down, the server cannot pass one on and writes a line about the fault. That line gives the time, the address asked for and the headers the browser sends, and never the internet address or the device number.
These logs are kept for security, to put faults right and to count visits in totals, for three months. A new file is started each day, and each day’s file is deleted 90 days after it ends. The running logs of the sign-in service, the account service and the database, including a sign-in that fails, are kept for three months too, and then deleted.
The account service’s own log records what was asked for, the result and how long it took, never what was sent, a token or an internet address. Visits are counted from these logs each night into totals per day, such as how many people opened a page and which site sent them; the totals keep no internet address and no browser’s details. It also notes, by a random number and never a name, when an account is created and when an account or child is deleted or restored, so that a deletion can be made again if a backup is ever restored.
Who else handles it
- 20i: our email host in the UK, which sends the account’s two emails from our mailbox there, so it sees your email address.
- Let’s Encrypt: issues the certificates that make the connection secure. It is told only the names of our sites, nothing about you.
- Healthchecks.io: in Latvia, which our server pings after each of its regular checks, so that we hear if they stop running. A ping is only a ping: it carries no personal data, nothing about you or your child.
Our server and its backups are in the United Kingdom. No service based in the United States processes your data or your child’s, and nothing is sold or shared for marketing.
Why we hold it
- Your account and what linked devices send: to give you the account and the service you asked for: a contract with you. Your child’s record is held for you, the grown-up who linked their device.
- The sign-in protection, logs and backups: our legitimate interest in keeping the service and your account secure and able to recover from a fault.
- Counting how the service is used: our legitimate interest in running the service well and making it better. We count how it is used, such as how many children practised this week and how often the apps are opened, in totals that never name or single out a child. The visit totals come from logs we already keep; the launch and install counts are sent by the apps. No total changes what a child sees.
Who at Remelia can see it
Only the two people who run Remelia can see these totals. To answer your email, one of us can look up your account by your address; each look is recorded. A look-up shows your account’s dates and plan, each child as a year group with no name, and your devices; it never shows a child’s name or answers. The record of each look is kept for two years, so that we can tell you who looked if you ask, and is then deleted.
Deleting
Everything the account holds is kept while the account is open. An account that is not used is not closed or deleted for that reason: it is kept until you delete it. A deleted child or account is kept for 30 days in case of a change of mind, then deleted for good; the service’s own backups are overwritten within 35 days after that. The list of questions a child got wrong, if switched on, goes at once with the child or the account. It is kept 30 days at most from the last time it was sent.
Your rights and complaints
Under UK data protection law you have the right to ask what is held about you or your child and for a copy of it, to have it corrected or deleted, to restrict or object to how we use it, and to take it elsewhere (data portability). To use any of them, or with any question about privacy, email info@remelia.co.uk, our mailbox at 20i. You can also download a copy of everything the account holds, for one child or all of them, from Remelia Parents, and delete a child or the whole account there. If you are not happy with the answer, you can complain to the Information Commissioner’s Office.
For children
Your answers stay on your device. If a grown-up links it to their account, your answers go to that account so they can see how you are doing. What you type about your world (your friends, pet, team and hobbies) never leaves your device.