Privacy: what is stored, where and for how long

Where it is kept

Everything the server keeps is in one Cloudflare D1 database that belongs to this site. Cloudflare chooses where the database lives; the region is not pinned, so it may be outside your country. The pages themselves are static files served by Cloudflare Pages.

What is stored about a reader

• A seat number from 1 to 40 and a nickname of up to 16 characters. A nickname is one word, or a word and one initial: a first name, a nickname or initials, never a surname. The server refuses two words, two capitalised names run together and more than 2 Chinese or Korean characters, but it cannot catch every form of a full name: a hyphenated name passes (Mary-Jane is a first name, so Maya-Rossi passes too), and so does a full name run together in lower case. The teacher chooses.
• For each night ticked: the date, whether it was read, the minutes and the book title if the family gave them, whether the family or the teacher ticked it last, when the family first ticked it, how many times it was changed, and a random key for the last tap so a repeated tap is not counted twice.
• A scrambled form (SHA-256) of the reader's family code and a number that changes when a new slip is made. The code itself is printed on the slip and not kept.
• Whether the reader is in the class or has left.

There is no field for a child's name, birth date, address, school, photo, or any family's name, email address or phone number. Book titles refuse email addresses, web addresses and phone numbers. Class and term labels refuse words that ask for a child's name, surname, birth date, address, postcode or school, also when they are spaced out or written with look-alike letters.

What is stored about a class

• Its label, time zone, streak rule, whether the Monday email is on, and when it was made and changed.
• Each term's label, dates, no-reading days and the date its ticks will be deleted.
• A scrambled form (SHA-256) of the class code printed on every slip, plus a sealed copy that only this server can open with its own secret key, so the teacher can print slips again.

What is stored for a teacher

• A random account id, the account name chosen for the passkey manager (or Readingtick owner), and when the account was made.
• For each passkey: its public key, its id, a signature counter, the name given to it and when it was added and last used. Never a fingerprint, a face or any biometric data: those stay on the device.
• A scrambled form (SHA-256) of the recovery code. The code itself is shown once and not kept.
• For each signed in device: a scrambled form of its session id, and when it was made, last used and when it expires (90 days after the last use).
• An email address, only if the teacher adds one, used only for the teacher's own confirmation link and Monday summaries, never to sign in. It is the one place an email address is ever stored. Until it is confirmed, only a scrambled form of the confirmation link is kept with it.
• Monday summaries (the week's line and the nicknames with no night ticked) with whether each was emailed, and a record of each email sent.

What is stored for a family

Nothing on the server. On the family's own phone: one cookie that keeps that child's page open for the visit (which reader, the slip's number and when it runs out, signed by the server so it cannot be changed). By default it is gone when the browser closes, and stops working after 30 minutes with no tap. With “Keep me signed in on this phone” ticked (it is off unless the family ticks it) it lasts 120 days from the last use, and a new slip from the teacher still ends it. Also taps waiting to send, kept in the browser's local storage under keys beginning with readinglog until the server confirms them. The codes leave the address bar as soon as the page opens.

Limits on how fast requests come

To stop codes being guessed and requests flooding the site, the server counts some requests per network address, per class and per teacher in hourly buckets. An address is stored only as a keyed scramble that cannot be turned back into the address, and each bucket is deleted after 2 hours. Addresses are never written to logs.

How long it is kept

• Ticks: 400 days after the term ends. Before they go, a notice on the classes page (and by email when there is a confirmed address) says so, and they are deleted 7 days after it. A term changed in the last 60 days is never deleted, whatever date was typed. A night left outside every term by a change of dates stays stored and uncounted until the dates cover it again; it goes only with its class or account.
• A reader who left: their nickname is deleted 7 days after they left once their ticks are gone.
• A class whose terms have all been deleted is deleted too, with 7 days to restore it.
• A deleted class, or a deleted account and everything in it: 7 days, while it can be restored, then deleted for good.
• Sessions: until 90 days after the last visit on that device, or until sign out. Passkey sign in requests: 5 minutes. Rate limit buckets: 2 hours. Email records: 30 days. Monday summaries: 90 days.

How to download and delete it

On the account page, Download everything gives one file with every class, term, reader and tick, with no codes in it. Delete my account removes everything after the 7 days above; single classes can be deleted on their page, and a reader can be marked as left. Requests by email go to [email protected].

Cookies

Two kinds, both kept from page scripts and never sent to another site: the teacher's session cookie, and the family's cookie for their child's page described above.

Page counts

Visits may be counted by Cloudflare's own page counter, which sets no cookie and records that a page was opened, never what was typed. There is no other analytics.

Payments

No paid plan is offered at present; if one is added, this page will describe it.

Email

Only the teacher can receive email, only at an address they added and confirmed. Families are never emailed; there is no address for them. Emails carry no tracking images.

Pupil data and the school

A teacher uses Readingtick for their own class and follows their school's rules on pupil data. This page describes what the site does; it is not legal advice.

Typeface

Headings are set in Literata, by the Literata Project Authors, under the SIL Open Font License 1.1, served from this site. The licence is at /fonts/OFL.txt.

Changes and contact

If this policy changes in a way that affects what is stored, the change will appear on this page. Questions go to [email protected].