Privacy Policy

NobbyPlus (“NobbyPlus”, “we”, “us”) is developed and operated by Topettop Ltd, a software development company registered in England and Wales under company number 11359078. NobbyPlus provides an online 11+ exam preparation platform for children, used by parents and guardians (“Parents”) to support their children's (“Children”, “Students”) learning. Topettop Ltd is the data controller for the personal information described in this policy.

Contact us about privacy matters at hello@nobbyplus.com.

NobbyPlus is designed so that only a parent or guardian registers an account. We do not collect an email address, password, or any direct contact details from a child. Once a parent creates a child profile, the child accesses it using a 4-digit PIN chosen by the parent — never an email/password login of their own.

This means a parent is always the account holder and is responsible for the information entered about their child, and can view, change, or delete that information at any time from the parent dashboard.

From the parent, at registration

• Name and email address
• Password (or, if you sign in with Google, basic profile information from your Google account — name and email — and never your Google password)
• Billing information when you subscribe — your card details are entered directly into Stripe, our payment processor, and never touch our own servers

About each child, entered by the parent

• A display name (we recommend a first name only, not a full name)
• Year group (e.g. Year 5) and, where relevant, the target exam board(s) and school
• A 4-digit PIN, which we store in a securely hashed (irreversibly scrambled) form — we cannot see or recover it ourselves

Learning activity, generated automatically as the child uses NobbyPlus

• Practice and mock exam answers, scores, time taken, and which topics/skills were attempted
• Progress over time (streaks, mastery of specific skills, mission completion)
• Conversations with the AI Tutor feature (see Section 5 below)
• If your child uses Multiplayer or the Leaderboard, their chosen display name and score are visible to other students using those features at the same time — never any other personal details

Technical information

• Standard web server logs (IP address, browser type, pages visited) for security and to keep the service running reliably
• A small number of strictly necessary cookies — see Section 7

• To create and run parent and child accounts, and let a child switch between profiles via their PIN
• To deliver practice questions, mock exams, and track progress against the right exam board and year group
• To power the AI Tutor and generate parent progress summaries (“coaching messages”)
• To send account, billing, and progress-related emails
• To process subscription payments and manage billing
• To detect and prevent fraud, abuse, or security issues
• To improve the product — we do not use children's data for advertising, and we do not sell personal information to anyone, ever

When a child uses the AI Tutor, their questions and the tutor's replies are sent to Anthropic (the maker of the Claude AI model we use) in order to generate a response, and are stored in our database so progress and conversation history can be shown to the parent. Anthropic processes this content under its own data processing terms and does not use API conversations to train its models. We do not knowingly allow children to share personal information beyond their first name in these conversations, and the tutor is designed to guide a child toward an answer rather than ask for personal details.

We keep account and learning data for as long as the account is active, so progress history remains useful to the parent. If a parent deletes their account, we delete or anonymise personal information within a reasonable period afterward, except where we are required to keep certain records for longer (for example, financial records for tax purposes).

NobbyPlus uses a small number of strictly necessary cookies — we do not use advertising or tracking cookies.

• nobbyplus-onboarded — remembers that you've completed initial setup
• Authentication cookies set by Supabase, to keep you securely signed in
• A cookie identifying which child profile is currently active, when a parent has more than one child

Under UK GDPR, parents (on behalf of their child, and for their own data) have the right to:

• Access the personal information we hold about you or your child
• Correct inaccurate information
• Request deletion of your account and associated data
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, email hello@nobbyplus.com. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, if you believe we have not handled your information properly.

We use industry-standard measures to protect personal information, including encrypted connections (HTTPS), hashed PINs and passwords, and access controls limiting who can view personal data. No system is completely secure, but we take reasonable steps to protect your information against unauthorised access, loss, or misuse.

We may update this policy from time to time. If we make material changes, we will notify parents by email or via a notice on the website before the changes take effect.

Questions about this policy or how we handle your data: hello@nobbyplus.com.