Privacy

Cluich is built for children, so the adult holds the account. Kids never get email, a password, or a username. They type a play code and a PIN.

This page describes this hub as it runs on your machine today — not a public hosted service.

What we keep

Adults (parent, teacher, or admin): name, email, a hashed password, and an optional school name for teachers.

Each child or pupil profile: first name, age band, avatar, a play code, a PIN, word progress (which Gaelic words they have seen and which quiz answers were right), and any words a parent or teacher has marked to hear more often.

The PIN is stored two ways: a check-hash so Kids play can confirm it, and an encrypted copy so the adult can read it and tell the child. We do not store photos, home addresses, or child email.

Home and school

A teacher sends home the class join code and that child’s PIN. When a parent links them, it becomes one child: first name, age band, avatar, the shared PIN, and word progress can merge. The family’s play code stays on the home profile.

Join codes and play codes can be rotated. Undo match splits the profiles again; words stay on the home profile.

Play

Games load words from this hub and send back what was heard and how the quiz went. They do not talk to other companies.

Hear again uses an audio clip on this hub if one was added, otherwise this device’s spoken voice.

Guest play is allowed when the site switch is on. Guests do not save words. A short play lock on the tablet expires after a few hours.

Cookies and logs

Adult login and Kids play use httpOnly cookies (session and play lock). Adult passwords are scrypt hashes. Login sessions may also keep an IP address and browser string until they expire. Adult actions such as linking or deleting a profile are written to a local audit log.

What we do not do

No advertising. No third-party analytics. No selling of data.

Delete

A parent can delete a child profile they created — that child’s words go with it. A teacher can remove a pupil from a class. Admin can disable adult accounts.

This copy

This local hub is for you to try. Before a public launch, a hosted privacy policy must name the operator, the country, and how to ask for a copy or a deletion.

Last updated 14 August 2026.