Child privacy notice

Archie and BBPlayland are made and run by Buzzing Bees Playland, LLC, a New York company that trades as BBPlayland, at 203 West 111th Street #5B, New York, NY 10026. We are the operator of the website at bbplayland.com and of the Archie app, and this notice is ours. Write to hello@bbplayland.com about anything in it; a person reads every message.

Archie is built to the Children’s Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506 and 16 CFR Part 312), the Family Educational Rights and Privacy Act (FERPA, 34 CFR Part 99), New York Education Law §2-d and 8 NYCRR Part 121, and to the children’s privacy requirements of the Apple App Store (Guideline 5.1) and Google Play’s Families policy. Those are build constraints: the properties below are kept by tests that run before every release, not by a policy someone remembers to follow.

This notice applies to children under 13 and to every child who uses Archie through a school or a family. The privacy policy covers the adults around them, and the schools page covers what New York Education Law §2-d adds when Archie comes through a school.

A random number that stands for them, a short code like OWL-1234 that the adults around them use to find their record, their grade, and the class or family home they belong to.

Then a record of their play, each part of it with the time it happened: for every question, which answer they chose, any they set aside, whether it was right and how long it took; when Archie stepped in, which paragraph they went back to, and a short note on what kind of mistake the answer seems to show; the skills they are working on in reading, math and science and how settled each one is; their Archie form, points and streak; how many minutes they played each day; the colour they chose for their card; a key that lets a device they have used open Archie again without the card; and, if they used the report button on one of Archie’s replies, which reply it was and which of four reasons they tapped. A report has no place for typing.

The words Archie says to a child are not kept against that child. The note on the kind of mistake is, because it is what lets Archie and their teacher see a pattern.

If your child’s teacher builds a Success Passport for them — a short plan of three moves your child can make, drafted inside our system and then read and certified by the teacher — we also hold that plan, and the planning profile the teacher built it from: a label the teacher chooses in place of a name, the grade, a reading-level band, the language spoken at home, whether the child has an IEP, a 504 plan or is learning English, and the teacher’s note, with names and other personal details scrubbed out of it. Once the teacher has certified the plan, a parent with the family code sees it in the family view.

The database table that represents a child has no column for a name, an email address, a date of birth, a home address or an external student identifier. Not left empty, not encrypted: those columns do not exist. A member of our team who wanted to store a child’s name there would have to change the database itself to do it, and a test that runs before every release fails if they do.

Only the grown-up who gave your child their card holds the link between that card and your child: a parent, in a family home, or the school, in its own records. We never do. One thing is close to it, and it is worth saying so: a teacher can keep her own class list on her screen, so she sees names where we see codes. It is encrypted in her browser with a passphrase only she holds, and we store only the scrambled result, which we cannot read.

With an explorer card, given to them by a teacher or set up by a parent. They do not supply an email address, they do not choose a password, and there is no account tied to who they are.

A card cannot be used until consent has been recorded against the class or family home it belongs to: a parent’s consent for a family home, and the school’s consent on behalf of families for a class, under the school’s agreement with us. Withdrawing that consent signs the child out, and stops the card and any device that remembers them from opening Archie again. Nothing is deleted by withdrawing — give consent again and the same card opens the same tree; deletion is a separate request (clause 7).

If a card is lost or shared, tell us. A replacement stops the old card working, and we can also sign your child out of every device that has already opened with it.

Inside the app, anything that leads out — a web page, an email address, the grown-ups’ screen — sits behind a gate a child cannot pass by tapping. Archie himself never links anywhere.

Your child never chats with Archie — they tap their answers. Archie’s hints come from a closed system we built and run ourselves. Some of Archie’s hints are written by an AI model made by Anthropic, at the moment or ahead of time, and every hint is checked automatically before your child sees it; the rest are lines our own program puts together. Nothing a child does is used to train any model, ours or anyone else’s.

When a hint is written at the moment, what is sent is the passage, the question, its answer choices and which one is right, the choice your child made and any they set aside, your child’s grade, how much help Archie has already given on that question, which of Archie’s forms they have reached, whether they have any shields left, and our instructions to Archie. A hint written ahead of time is used again for the same wrong answer, and nothing is sent when it is.

A second kind of request goes only if a teacher builds a Success Passport for your child (clause 2). It carries the planning profile’s categories — grade, reading-level band, home language, and whether the child has an IEP, a 504 plan or is learning English — and your child’s progress in Archie as numbers: each skill and how settled it is, the quests they have finished, and how often they came back from a wrong answer. With it go the teacher’s own words: the label, the note, and what the teacher wants the plan to work on.

Neither request carries your child’s name or the number that stands for them.

The part that describes what your child did in a quest, and the teacher’s words in a plan, pass through a privacy filter running on our own machines first. Names, student identifiers, email addresses, phone numbers, postal addresses and dates of birth are replaced with placeholders, and the reply is put back together on the way out. The rest goes as it is: the passage, the question and our instructions are our own material, and the profile’s categories and the progress numbers are categories and numbers rather than words a name could hide in.

That filter does not work by asking another service what the personal information is, because doing so would already have sent the personal information to that service. It runs on our hardware or it does not run. If it errors or runs out of time, nothing is sent: there is no path around it, and no setting that turns it off. When it is unsure whether something is personal, it removes it.

The map from a placeholder back to the real word is held in memory for five minutes and then discarded. It is never written to a database, never written to a log, and never sent anywhere.

Anthropic receives only what this clause describes, as a service provider to us, and may use it only to return the hint. Its published policy for business customers is to delete what we send and what it returns within 30 days, and to keep anything its safety systems flag for up to two years. We have not confirmed a zero-retention agreement with it, so we do not claim one; what we do claim is that nothing it receives names your child.

When Archie reads aloud, the words being read — a paragraph of the passage, or one of Archie’s own lines — go to Amazon Polly, part of Amazon Web Services, to be turned into speech. Nothing about your child goes with them.

Every time a hint is requested, a row is written before the answer reaches the child. It records which part of the product asked, whether the answer passed its checks, how many items were replaced by the privacy filter and of what kind, and how much text was involved.

It does not record what the child chose, what was written back, or any of the replaced words. Counts and categories, the time, and the random number that stands for the child — never a name. That is what allows these records to be kept as evidence that the rules on this page were followed, without holding anything that says who a child is.

They are kept for three years and then deleted. A copy of each also goes to a separate archive in our own Amazon Web Services account, where it is locked against change or deletion for its first year. The archive copies are also kept for three years and then deleted.

No advertising, no analytics service, no advertising pixel, no session-replay tool, no chat widget, no embedded video player that reports back, and no fonts loaded from another company’s servers. The app reads no advertising identifier (Apple’s IDFA or Google’s advertising ID) and no hardware serial number, and contains no software from an advertising or analytics company. A font request is a request to somebody else’s server carrying your child’s IP address, so the fonts on this site come from ours. This is checked automatically against the built site before it can be published; it is a property of the site, not a policy someone remembers to follow.

Our own web server does keep a log, as nearly every web server does. Every device that opens Archie or this site leaves a line in it: the device’s network address, the time, the address it asked for, and the description its browser gives of itself — its name, version and the kind of device. The log is kept in our own Amazon Web Services account for 90 days and then deleted. It is used to keep the service running; we do not join it to your child’s record.

Your rights. You can see everything we hold about your child, have it corrected, have it deleted, and refuse any further collection. Deletion removes the rows rather than marking them hidden, and refusing further collection means withdrawing consent (clause 3), after which the card stops working. We will never make a child’s use of Archie depend on giving more information than Archie needs to run, and we will never ask a child for more.

How to ask. Email hello@bbplayland.com, or pilots@bbplayland.com if your family is testing Archie with us. We confirm that the request comes from the parent or guardian who holds the family code, or from the school that holds the class, before we act on it. If Archie came to your child through school, you can ask the school instead, and the school can ask us at any time.

How long we keep it. Your child’s record is kept while their class or family home uses Archie, and deleted when you ask. If your family is testing Archie with us, we delete your child’s test information within 10 days of your request, and within 30 days of the test ending. If Archie came through school, the school can ask us to delete it at any time, and we delete it when the school’s agreement with us ends. Copies of the database made for recovery are kept for 7 days, so a deleted record is gone from them within a week. The web server’s log is kept for 90 days (clause 6), the request records and their archive copies for three years (clause 5), and Anthropic’s copies as clause 4 says.

The request records in clause 5 are the one thing that outlives a deletion, and the reason is worth stating: they hold no name and none of the words, and deleting them would erase the evidence that the rules above were followed. Once a child’s record is gone, the random number in them no longer leads to anyone.

How deletion works. A child is erased from every table that references them in one operation — progress, answers, sessions, the card, the devices that remember them, any plan built for them, the lot — it is checked that nothing is left, and the erasure is logged with a count and no identifier. One thing is unlinked rather than deleted: a teacher’s planning profile (clause 2), because it is the teacher’s own working note. After an erasure it no longer points at your child, but the categories in it remain. If you want it gone as well, say so when you ask; the teacher can delete it in the portal, and we will see that it is.

On Amazon Web Services, in a single United States region, encrypted where it is stored and while it travels. The database has no public address and its network has no route to the internet in either direction. Only the people who run the service can reach it, each with their own credentials, and every change to the system is reviewed and tested before it ships. Our security practices follow the NIST Cybersecurity Framework, as New York’s Part 121 asks of a contractor to schools.

Three companies hold or receive data for us, each as a service provider that may use it only to provide its service to us: Amazon Web Services, which hosts everything described on this page; Anthropic, which receives hint requests in the state clause 4 describes; and Google, which provides our email and documents. We sell nothing, we share nothing for advertising, and no one else receives anything about a child.

If your family is testing Archie with us, two more things are kept, in our Google Workspace: our private list that links your family’s number, and each child’s code and grade, to your name and email address; and our emails with you, including the ones that carry your child’s sign-in card. Google holds them for us as a service provider, for as long as the family test agreement says. Archie’s record of your child is not there.

If your school or district needs the specifics — encryption configuration, the list of service providers and the test evidence behind each statement here — that is the evidence pack, and the schools page is where to ask for it.

If we ever learned that a child’s information had been reached by someone who should not have reached it, we would tell the school or family it belongs to without unreasonable delay and in any case within the time New York law allows, say what happened and what we did about it, and tell the New York State Education Department where its rules apply. The records in clause 5 are what would let us say exactly what was and was not involved.

This notice is effective from 19 October 2026. If we ever wanted to collect more from a child, or use what we hold in a new way, we would change this notice first, tell every family and school by email at least thirty days before the change took effect, and ask for consent again before doing it; a change that only adds protection or clarity we make and date here. The current version is always at bbplayland.com/child-privacy.