SULOX
Privacy policy
Last updated: 31 October 2026
For children (the short version)
- The camera pictures stay on your phone or iPad. We never see them.
- We only keep your first name, your school year and how you are getting on with maths.
- There is no chat, and nobody can message you.
- A grown-up looks after your account and can delete it whenever they like.
Who we are
SULOX is made by TEKGALAXYS SOLUTIONS PRIVATE LIMITED ("we"). We are the controller of the personal data described here. Contact us at support@sulox.co.uk.
The short answer
- The app works without an account. If you don't sign in, progress stays on the device only.
- Camera images never leave the device. They are processed in memory for the AR lessons and never stored or uploaded.
- No advertising, no tracking, no selling of data, and no third-party analytics that profile children.
- No chat and no content written by one child for another.
- A parent or carer is the account holder; children have profiles under the parent, first name only.
What we collect, why, and for how long
Only when a parent signs in (Sign in with Apple):
| Data | Why (UK GDPR lawful basis) | Kept for |
|---|---|---|
| Apple user ID, and the email Apple shares (it may be a private relay address) | Your account (contract) | Until you delete the account |
| Each child's first name, school year, GCSE tier (Year 10), avatar choices and interests | Providing the lessons (contract) | Until deleted |
| Learning progress: answers, skills, lessons finished, weekly tests, Su-Buns earned and items owned | Teaching, progress on all your devices, and the weekly report for parents (contract) | Until deleted |
| Device identifier for this app (identifierForVendor) and model | Keeping your devices in sync (contract) | Until deleted |
| Purchase records (App Store transaction IDs) | Unlocking what you bought (contract) and accounting law (legal obligation) | As required for accounting (up to 6 years) |
We never collect: camera images or video, audio recordings, location, contacts, your photo library, advertising identifiers, biometric data, date of birth, school name or address.
Face colours for the avatar: if a child uses the optional "look like me" feature, the photo is analysed on the device to pick colours and then discarded. Only the chosen colours are saved.
How we teach with the data
The app decides what a child practises next from their own answers (for example, which skills need another look). This is done by fixed rules written by us, not by advertising or by selling profiles. A parent can see it all in the weekly report.
Where your data is stored, and who helps us
- Supabase (database), London, UK.
- Vercel (our server), running in London, UK.
- Apple for Sign in with Apple and App Store purchases, under Apple's own terms.
These providers act on our instructions under data processing agreements. If any data is ever processed outside the UK, we use the UK's approved safeguards (the UK–US data bridge or the International Data Transfer Addendum). If we add an optional AI helper, its questions and answers (text only) will be kept for 30 days and never used to train AI models; we will update this policy before it is switched on.
Your rights and controls
- Download all your family's data at any time: Grown-ups → Account → Download our data.
- Delete your account and every child's data at once: Grown-ups → Account → Delete account. This is immediate on our server.
- Correct a child's name or year in the app, or ask us to.
- Under UK GDPR you can also ask for access, correction, erasure, restriction, portability, or object to processing. Contact support@sulox.co.uk. We reply within one month.
- You can complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.
Children
SULOX is designed for children aged 5–15 with a parent or carer as the account holder. We follow the ICO's Age Appropriate Design Code (the Children's Code): high privacy by default, no nudges to share data, no geolocation, and no features that let strangers contact a child.
Security
All connections use HTTPS. Sign-in tokens are stored in the device's secure Keychain and expire quickly. Our database is locked so only our server can read it, and each family can only ever reach its own data.
Changes
If we change this policy we will update the date above and, for important changes, tell parents in the app before they take effect.
© 2026 TEKGALAXYS SOLUTIONS PRIVATE LIMITED · Privacy · Support