Privacy Policy

Who we are

This learning platform at learn.ctcl.sg is run by CRACK THE CODE LEARNING PTE. LTD. (UEN 202532877R), Singapore ("CTCL", "we"). This policy explains how we collect, use, share and protect personal data, in line with Singapore's Personal Data Protection Act (PDPA).

Our Data Protection Officer is responsible for how we handle personal data. For any privacy question or request, contact our Data Protection Officer at info@ctcl.sg.

Children and parental consent

Our learners are primary school children. Only a parent or guardian can create an account and add children to it. When signing up, the parent confirms they are the child's parent or guardian and consents, for themselves and their child, to the collection and use of personal data as described here.

We deliberately collect very little about children: a first name or nickname, a username and the year they will sit the PSLE. We never ask for a child's full name, birth date, school, photo or contact details.

What we collect

• Parent account: your email address and password.
• Each child: first name or nickname, username, password and PSLE year.
• Learning progress: the notes pages and videos your child opens, their Practice, weekly check and mock test answers and marks, stars, badges and colour scheme choices.
• Ask Codey: the questions your child types to Codey, and Codey's answers.
• Purchases: the package bought, the amount, any promo code, how it was paid and the receipt. Payments are processed securely by Stripe. CTCL does not collect or store full payment card numbers or banking login details; we receive the transaction information needed to manage purchases, receipts and refunds.
• How you found us: if you arrived from one of our advertising links, which link it was.
• Technical information: like most websites, our hosting and security systems process technical information such as IP addresses, browser type and the time of each visit, to deliver the site, keep it secure and fix problems.

Parent and child passwords are securely hashed by our sign-in provider. Nobody at CTCL can read them.

How we use it

• To run your account and your child's lessons, Practice, weekly check, mock tests and rewards.
• To personalise learning, for example recommending the right level from the PSLE year and bringing back ideas your child found hard.
• To show you your child's progress.
• To process payments and send receipts, and to send account emails such as confirming your email, resetting a password and reminders before a trial or package ends.
• To check and improve our questions, marking and Ask Codey answers, and to understand which advertising works. CTCL staff can see learning records for these purposes.

We do not sell personal data, and we do not use it for advertising by other companies.

Ask Codey and AI

Ask Codey is a learning helper inside the Concept Notes. To answer a typed question, or to help when a child taps "Help me understand", we send the AI service Anthropic the question, the words of that notes page and the child's level. Anthropic processes these requests outside Singapore.

We use safeguards designed to detect and block personal contact details, such as email addresses, phone numbers and IC numbers, before questions are sent to Anthropic, and we remind children not to enter their full name, school or contact details. We do not deliberately include account names, usernames or parent email addresses in AI requests.

Anthropic states that it deletes these requests and answers within 30 days, apart from limited exceptions (for example where needed for safety or legal reasons), and that it does not use them to train its AI models by default.

Ask Codey is never used in Practice or mock tests, and marking is done by our own system, not by AI.

Who we share it with

We share personal data only with the service providers we need to run the platform, and only for that purpose:

• Supabase: our database, sign-in and file storage. Our data is stored in Supabase's Singapore region.
• Vercel: hosts the website.
• Stripe: processes payments.
• Resend: sends our emails.
• Anthropic: the AI behind Ask Codey, as described above.

Some of these providers are based in, or process data in, countries outside Singapore. Where personal data is transferred outside Singapore, we rely on these providers' contractual data protection commitments (such as their data processing terms) to protect it to a standard comparable to the PDPA.

We may also disclose personal data where the law requires it.

How long we keep it

We keep your account and your child's progress throughout their access. When a package or trial ends, saved progress is kept so your child can carry on where they stopped if you return.

If an account has had no access and nobody has signed in to it for 3 years, we email the parent at least 30 days before, then delete the family's data. Signing in before then keeps the account.

If you ask us to delete your family's data, we delete the parent and child accounts, learning progress, answers, rewards, mock tests and Ask Codey questions.

We keep payment and receipt records for as long as the law requires for accounting and tax purposes (generally at least five years), and we remove names and contact details from them where we can. Stripe keeps its own records of payments under its own privacy policy.

Your choices and requests

You can ask us to give you access to, correct, or delete your or your child's personal data, or withdraw your consent, by emailing info@ctcl.sg. We will respond as soon as reasonably possible, and usually within 30 days. Some things you can change yourself on your account page, such as your child's username, password and PSLE year (until a package is bought).

If you withdraw consent, we may no longer be able to provide the learning service, and we will explain what this means before acting on it.

Cookies

We use essential cookies to keep you and your child signed in, and an attribution cookie that remembers for 30 days which CTCL advertising link brought you to our platform. We do not use third-party behavioural advertising cookies.

How we protect it

Data is sent over encrypted connections, access is limited to what each account needs, and staff pages are protected by two-step sign-in. Each family can see only its own information. If a data breach occurs, we will act on it and notify the authorities and affected families where the law requires.

Changes to this policy

We may update this policy. The date at the top shows the latest version. If we make important changes, we will let parents know by email.