Privacy notice

Version 2026-12-16

Mochi is maths practice, jobs and rewards for families. It is run by Ryan Tomlinson, who decides how your family’s data is used (the data controller) and is also our safeguarding lead. You can reach him at hello@playwithmochi.com.

In short

Children never have an email address, a password or a login of their own.
We keep what Mochi needs to work, and nothing is sold, advertised to or tracked.
Every grown-up in a family can see that family’s children and their progress.
Other families see your children only if you join a school group and choose to show them.
You can download your family’s data, or delete it, at any time.

What we keep about your child

A nickname (1 to 20 characters, never an email address). We ask for a first name or nickname, never a full name.
Their school year, which moves up each September, and, if you choose, their school.
Their buddy, how it looks, the items they have collected and the calm squish setting.
Collectable squishies and glow-ups your child has earned, kept while your family uses Mochi and deleted with your child.
Their practice: each session (when, which kind, how many questions and how many right), each answer (the question, what they gave, whether it was right and how long it took) and how secure each fact is.
Any skill a grown-up asks them to focus on.
Jobs they tick off and whether a grown-up approved them, and rewards they ask for.
Their stars, any pocket money you record as paid, their sparkles, and the games they play with their scores.
If you join a school group: which groups they are shown in, and cheers sent and received.
Your consent for them, with its date and the version of this notice.

We never ask for a child’s surname, date of birth, photo, location or contact details. Children can’t type messages to anyone.

What we keep about you

Your email address. If you set up the family with Google or Apple, we also keep the first name on that account. It is shown beside you in your family’s list of grown-ups, and your family is named after it (“Sam’s family”, or “Our family” without a name). You can rename the family in Grown-ups, under Family.
Your sign-in record: how you sign in (Google, Apple or an email link), when you last signed in, and, for each signed-in browser, its IP address and browser type, which our sign-in service keeps to protect your account. If you sign in with Google or Apple, it also keeps the name they pass on (and, from Google, a link to your profile picture).
Your family name, your Grown-ups PIN (stored scrambled, never as typed) and your settings.
The jobs, rewards and star rate you set, approvals you give and invite links you make.
When someone in your family last opened Mochi (noted at most once a day).
Whether you get the weekly email, and which weekly emails and reminders we sent.
Which invite code your family used to join Mochi.
Requests to join a school group, who in your family made them, and whether they were accepted.
If you are a class parent: your role in that group, and the groups’ activity log.
Reports you make about a family in a school group.
Notes you send the Mochi team, and our replies (see Notes to the Mochi team, below).

On your device

Mochi sets only the cookies it needs: to keep you signed in and return you to the page you were on, to remember which child is playing on a shared device (for up to 30 days of no use), to carry an invite code or link through sign-in, to reset your Grown-ups PIN safely, and to stop the one-off “A week in. How is it going?” card on Grown-ups home asking again once you have answered it (for a year). The device also remembers whether read-aloud is muted, practice waiting to be saved, which new squishies have already been celebrated, and a note to the Mochi team you are still writing. Read-aloud uses the device’s own voice, so nothing is sent anywhere.

The app uses no analytics, advertising or tracking. Our public website (not the app) counts visits with Vercel Web Analytics, which sets no cookies and doesn’t identify you.

Why we use it

Only to run Mochi for your family:

to sign you in and keep your family’s data separate from everyone else’s;
to choose your child’s next questions from their answers, which is the only thing their answers are used for;
to show you how they are getting on, and send you a weekly summary, which you can turn off in Grown-ups or from the email;
to run jobs, rewards, pocket money, games and school groups;
to keep school groups safe, which is why reports and the activity log are kept;
to read and answer notes you send us;
to stop invite codes being guessed;
to warn you before we delete a family nobody uses.

We do this to provide the service you sign up for. Safety records are kept because we have a legitimate interest in keeping children safe, and notes because we have a legitimate interest in hearing how Mochi is going and answering you. You confirm, for each child, that you are their parent or carer and agree to this notice; we record the date and the version.

Who can see what

In your family

Every grown-up in your family sees all its children, their progress, jobs, stars and pocket money, and can add or remove a child. Only the grown-up who set up the family can delete it. Children see their own buddy, stars, jobs and rewards. On the child’s home screen a sign says “Grown-ups can see how you’re doing”, and it opens Mochi and you, a short version of this notice for children.

School groups

A class parent can invite families from the same school and year. Nothing is shared until you join and choose which children to show.

Other families in the group see only:

Your child’s nickname.
Their squishy.
Whether they practised today or this week.
How many days the class has practised this week, all together, towards a class goal.

If your child is shown in a group, children there can send each other one of four fixed cheers, and only once both have practised that day. Only the two families see a cheer, and it is deleted after 30 days.

The group’s class parents also see your family name, so they know who has joined or asked to join. No one else in the group sees it.

Never shared: school years, scores, levels, stars or email addresses. Apart from your family name, which class parents see (and which starts as your first name, as above, until you change it), nothing about you is shared. Children cannot message each other.

You can leave a group at any time from the School page in Grown-ups, and your family disappears from it straight away.

Anyone in a group can report a family. The family is hidden from the group at once, and reports are reviewed within 48 hours by Ryan Tomlinson, our safeguarding lead (hello@playwithmochi.com), who either restores the family or removes it from the group.

Us

Ryan, as the person who runs Mochi, can see reports with the names of the family reported and the family that reported it, who has asked for an invite, who the class parents are, and the notes families send with each family’s name (but not which grown-up wrote them). He doesn’t look at your family’s data except to fix a problem you raise or to keep a school group safe.

Where it is kept, and who helps us

Supabase holds the database and runs sign-in, in London.
Vercel runs the app on servers in London, and briefly logs each request to run and secure the app. Pages and images are sent from its worldwide network, nearest to you. The quick check before each page, which keeps you signed in and remembers which child is playing, may also run there rather than in London. Vercel is a US company, so any data that leaves the UK is protected by the UK’s safeguards for international transfers.
Resend sends our emails (sign-in links, the weekly summary, invites, reminders and our replies to your notes) from Ireland.
Google and Apple, if you choose them to sign in.
GitHub, a US company, runs our automated tasks: starting the weekly and reminder emails, and updating the database.

We share your data with no one else.

How long we keep it

How long each kind of record is kept
What	How long
Your family, your children and everything they do in Mochi	While your family uses Mochi, until you delete it, or until it has been unused for 12 months (see below).
Answer-by-answer practice detail (what was typed and how long it took)	12 months. Sessions, progress and stars stay.
Cheers between classmates	30 days.
A sign-in that never set up or joined a family, or is left with none	Deleted once it is 30 days old.
Invite links for a second grown-up or a school group	30 days after they expire.
Records of which weekly emails we sent	1 year.
Your email, if you ask for an invite	Until we reply, and never more than 180 days.
Invite-code checks (a scrambled form of your internet address, or of your account when you set up a family, never the address or account itself)	1 day.
Reports about a family in a school group	Until resolved, then 2 years after they are resolved.
The school group activity log	2 years.
Notes you send the Mochi team, and our replies	12 months after you send them.

Families nobody uses

If nobody in your family has used Mochi for 11 months, every grown-up gets one email asking them to open Mochi within 30 days. If nobody does, the family is deleted once it has been unused for 12 months and at least 30 days after that email. Using Mochi means a grown-up signing in or opening Mochi, or a child finishing a practice session, ticking off a job or playing a game, so a child playing on a shared device keeps the family. Any use after the email cancels it.

Deleting your data

In Grown-ups, under Family:

Any grown-up can remove a child, which deletes the child and all their progress straight away.
The grown-up who set up the family can delete it. That deletes the family, every child and all their data straight away, and the sign-in account of every grown-up who isn’t in another family.
A second grown-up who leaves, and isn’t in another family, has their sign-in account deleted too.

When a grown-up’s account is deleted, their email settings and class parent roles go with it. A few records stay, without their name: a consent they gave for children still in Mochi keeps its date and version, notes they sent stay with the family, and reports and the school group activity log are kept for safety for the times in the table. A report about a deleted family stays, without the family’s name, until it has been resolved and kept for 2 years.

Our sign-in service, Supabase, keeps its own security log of sign-ins, which can include your email address, and we can’t delete it ourselves. Supabase deletes it under its own rules.

Downloading your data

Any grown-up in a family can download the family’s data as one file, from Download our data in Grown-ups, under Family. It holds your family, its grown-ups, every child and everything they have done in Mochi, and the notes your family has sent us with our replies. Other children appear only by nickname, on cheers. If a grown-up in your family asked us for an invite, the date they asked is in the file for everyone in the family to see.

Each grown-up sees their own sign-in details only: for the others, when they last signed in and how they sign in are left out. The file also leaves out:

our internal security and running records: which invite code your family used, school group invite links, invite-code checks, the school group activity log, and safeguarding reports made by or about your family;
what the sign-in service keeps: each signed-in browser’s IP address and type, the name and picture link Google or Apple pass on, and its own security log;
your Grown-ups PIN, which is stored scrambled, and its record of wrong tries (the file says only whether a PIN is set);
for each note, which grown-up wrote it and whether they asked for an email reply.

To see any of these that is about you, email hello@playwithmochi.com.

Notes to the Mochi team

You can send us a note from Grown-ups, or from the links at the end of the weekly email. We keep what you write (up to 1,000 characters), how Mochi is going if you pick one (going well, fine or not working), the name of the screen you sent it from unless you leave it out, your family and which grown-up sent it, and our reply. Only the Mochi team and the grown-ups in your family can read your notes and our replies. Other families never see them. Please don’t put your children’s names, or anything private about them, in a note.

Notes and our replies are deleted 12 months after you send them, and straight away if your family is deleted. They are in your family’s download. If you leave “Email me when the team replies” ticked, we email your sign-in address once for each reply, and each email has a link to stop emails about that note. Untick it and you see our replies in Grown-ups only.

The emails we send about a note, and anything you send back to hello@playwithmochi.com, are also held by our email services under their own retention periods. Email us and we will delete what we hold.

If you ask for an invite

We keep only the email address you give us, to send you an invite code. We delete it once we have replied, and never keep it for more than 180 days. Email hello@playwithmochi.com to have it removed sooner.

Your rights

You can see your data (download it as above), correct it (change nicknames, school years, your family name and settings in Grown-ups), delete it, or ask us to stop using it. For anything else, or anything you can’t do in Grown-ups, write to hello@playwithmochi.com. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes to this notice

When this notice changes, the version below changes too, and Grown-ups shows a card asking a grown-up to read it and confirm for your children. Children can keep playing in the meantime.

Version 2026-12-16