Who runs the site?

Bright Little Labs Limited runs this website and is responsible for the personal information it processes. Company number 09627717. Registered office, Kalculus, 119 Marylebone Road, London, United Kingdom, NW1 5PU. Contact [email protected] about this website or privacy.

Information and purposes

We do not receive mission answers, drawings, puzzle attempts, Hedy choices or game scores. Hedy is a scripted training activity, not a generative chatbot. The website does not request an age, name, account, location, camera or microphone access.

Our hosting and security provider, Cloudflare, processes technical connection information. This can include an IP address, browser or device information, the requested page and the time of the request. This is used to deliver the site and protect it against misuse. We rely on our legitimate interests in providing and protecting this free reader service, taking children’s privacy into account.

If a grown-up emails us, we receive their address, message and anything they choose to include. We use that information to answer the enquiry, on the basis of our legitimate interests in responding to it. Email is handled through our Google Workspace service. Please avoid sending children’s personal information.

Storage and cookies

The site stores one value, csa-puzzle-unlocked, in this tab’s session storage after you unlock the puzzle. It contains only “yes”, identifies no person and is not sent to us. It is used only to remember the unlocked state while navigating. Browser session recovery may restore it; you can clear it by clearing the site’s browser data.

We do not set advertising or analytics cookies. Cloudflare may use essential security cookies when protecting the site. Read its security cookie information.

Providers, retention and overseas processing

Cloudflare provides website delivery and security. Its global network may process technical information outside the UK. Its privacy policy explains its processing and retention; its data processing addendum describes contractual safeguards for international transfers.

We have not enabled visitor tracking or a service that stores agents’ progress. Email enquiries are kept only while needed to handle the matter and any related legal obligations, then deleted. We do not sell visitor information or use it for advertising.

Your rights

You can ask us about your personal information, request access or correction, and ask for deletion, restriction or object to processing where the applicable law gives you those rights. Email the contact above. A parent or guardian can ask on a child’s behalf where appropriate. You can also complain to the Information Commissioner’s Office.

This notice applies to the current browser website. It does not describe the discontinued app or old submission services. We will update it if the website’s features or data use change.