Children and age rules
Western Language Academy offers learning resources for teachers and students. Public lessons, worksheets, games, and practice activities are available without creating an account. An account adds saved progress and therefore involves personal information.
Under age 13
Children under 13 may not register for an account. When someone enters a birth month and year at the age screen, that calculation happens in the browser before the account service loads. We do not receive or retain the birth month or year. If the result is under 13, the person is directed to the open, non-account experience.
Ages 13–17
A teen may register only after confirming that a parent or legal guardian has given permission. We record the age band, the permission confirmation, the policy version, and the time of consent. We do not collect the parent’s name, email address, identification, or payment details during registration.
Age 18 and older
An adult may register after reviewing this notice. We store only the “18+” age band, not a birth date.
If we learn that an account belongs to a child under 13, we will disable saved-data features and delete the account information unless a legal obligation requires a limited record to be kept.
What we collect
Account information
- name or display name, email address, email-verification status, and account identifiers;
- a password verifier managed by Firebase Authentication, or the identity-provider connection when Google or Apple sign-in is used;
- an optional profile photo supplied by a social sign-in provider;
- age band, guardian-permission confirmation where applicable, policy version, and consent time; and
- account creation and update times.
Learning and practice information
- grade level, practice focus and theme;
- question identifiers, selected or written answers, scores, and practice-session start/completion times; and
- favorite resource titles, links, learning metadata, and private collection names chosen by the account holder; and
- usage counters used to prevent automated abuse.
Device-local information
Unfinished practice drafts, bounded retry queues, and a small recent-error diagnostic log may be stored in the browser. This information stays on that device unless a completed, eligible result is saved to the signed-in account. Browser storage can be removed using the browser’s site-data controls.
Website traffic measurement
We count how the website is used so we know which materials are worth expanding. When a page is opened, when a unit section inside a grade page is opened, and when a download or view button is pressed, we add one to a daily total. What is recorded is the page or material name and the date — nothing else.
This counting sets no cookie of ours, uses no advertising tracker, and records no identifier of any kind. It cannot tell us who visited, cannot follow anyone between visits, and is never connected to an account, an email address, or practice history. A single per-tab browser marker records that the first page of a visit has been counted; it is deleted when the tab closes and is never transmitted. The totals are stored in our own Firebase database and are visible only to the site administrator. Browsers sending a “Do Not Track” signal are not counted at all.
So that this cannot be abused to inflate the totals or exhaust our database allowance, each count is accompanied by a Firebase App Check token. Obtaining that token runs Google’s reCAPTCHA Enterprise, which sets its own cookie and examines browser and interaction signals to judge whether the request comes from a real browser — the same protection already used on the sign-in and practice pages. Google performs that check; it produces no identifier for us, and none of it is stored with the totals. A visitor whose browser blocks it is simply not counted.
Technical and support information
Our hosting, authentication, database, and abuse-prevention providers may process IP address, browser/device details, request times, security tokens, and diagnostic events needed to deliver and protect the service. If someone contacts us, we receive the email address, message, and any optional name or other information they choose to provide.
A message sent through the contact form is delivered and stored by Netlify, our hosting provider, and we read it there and in email. Because our monthly allowance for these messages is limited, and because a flood of automated ones would stop genuine messages from reaching us, the form asks the sender to complete a Google reCAPTCHA checkbox. Google performs that check and sets its own cookie for it; it tells us only whether the sender appears to be a person, and we do not receive an advertising identifier or a browsing profile from it. Anyone who would rather not use the form, or whose browser blocks reCAPTCHA, can email us directly at westernlanguageacademy@gmail.com instead.
We do not ask for precise location, contacts, voiceprints, biometric data, government identification, payment information, or public posts in the student account experience.
How we use information
- create, secure, verify, and support accounts;
- save practice history, calculate scores, and show progress;
- save favorite learning resources and organize them into private collections;
- remember an unfinished practice session on the user’s device;
- prevent spam, fraud, and automated misuse;
- count page and download totals so we can see which materials are used and decide what to add next;
- diagnose failures and maintain the service; and
- respond to support, access, correction, consent-withdrawal, and deletion requests.
We do not use personal information for targeted advertising, and we do not build advertising profiles from student activity.
Retention and deletion
- Account profile and consent record: kept while the account remains open so the account can operate and we can document the registration choice.
- Practice history: kept while the account remains open so the learner can review progress.
- Favorites and collections: kept while the account remains open or until the account holder removes them.
- Browser-only drafts and diagnostics: remain until replaced, expired by the application, deleted with browser site data, or removed when the account is deleted on that device.
- Support and privacy requests: kept only as long as reasonably needed to resolve and document the request, then removed or minimized.
- Security and provider logs: retained for the provider’s limited security, reliability, and legal purposes under its retention controls.
Using “Delete account” immediately removes the Firebase login, profile, saved practice sessions, favorites, collections, and usage counter from the active account systems. Our providers may keep short-lived backups or security records for limited recovery, fraud-prevention, or legal purposes before they expire.
Access, correction, consent withdrawal, and deletion
Account holder
The account holder can view saved progress, manage favorites and collections, change the display name or password, and permanently delete the account from My Account. Deletion requires a fresh sign-in and confirmation and cannot be undone.
Parent or legal guardian
A parent or legal guardian may ask whether we hold information about their child, request access or correction, withdraw permission, stop further collection, or request deletion. Email westernlanguageacademy@gmail.com with the subject “Child privacy request.”
To protect the child, we will verify the requester’s authority and connection to the account before disclosing or changing information. We begin with the least amount of information necessary, such as confirming control of the account email. If additional proof is genuinely needed, it will be used only for verification and deleted after that step. We aim to respond within 30 days, or sooner when required by applicable law.
If we receive a credible report that an account holder is under 13, we will investigate promptly and remove the account information if the report is confirmed.
Security and user choices
We use email verification, password-strength rules, provider reauthentication for sensitive actions, App Check, per-user database rules, usage limits, and encrypted HTTPS connections. No system can guarantee absolute security, so users should choose a unique password and protect access to their email and devices.
Anyone may use the public learning resources without an account. A signed-in user can practice without saving until their email is verified. Social sign-in is optional; email and password is available instead.
Changes and contact
We may update this notice when the product, providers, or legal requirements change. The effective date and version at the top identify the current notice. If a material change requires a new choice, we will ask before applying that change to account data.
Questions or privacy requests may be sent to westernlanguageacademy@gmail.com or through the contact page.
This notice describes the product’s current privacy practices; it is not a substitute for legal advice about obligations that may apply in a particular country, state, school, or business arrangement.