Privacy Policy

Last updated 7 October 2026 · 简体中文

1. Children never have an account

A child never creates an account and is never asked for an email address, a real name, a date of birth, a school or a phone number. The mountain and the placement test work without signing in.

The only label a child's record can carry is an optional nickname: one the child types on the mountain when getting a code for a parent, or one a parent chooses on the account page. Please use a nickname, not a full name. If you think a child has given us something personal, write to us and we will delete it.

2. On the mountain: what stays in the browser

The mountain keeps a child's progress — questions answered and missed (with the kind of slip behind each miss), placement levels, streaks, lanterns, lumens and patches — in the browser's own storage, on that device. A copy is also kept on our server under the random device id below, so that the progress can be found again if that storage is cleared (section 3). The stand-alone placement test keeps its progress in the browser too, unless you ask us to email the card (section 5).

The questions themselves come from our server. The first time the mountain needs some (the placement, tonight's climb, the patrol), the browser is given a random device id and device key — no name, no email, nothing typed in. We keep the id, a one-way hash of the key and the date it was made, so the device can be recognised next time. The same id and key are also placed in one first-party cookie on this website, so that the mountain can find the progress again if the browser's own storage is cleared; the cookie holds nothing else, and nothing about the child. The id is used only to serve questions, mark answers and count the free daily allowance. Answers are never sent to the browser; so that they do not need to be, our server notes which question ids it sent to that device, keeps that note for a day or two, and counts questions per day. The server marks each answer and does not keep what the child typed. To stop the question bank from being copied in bulk, the server also counts, per day, how many questions, new devices and new accounts come from each network address. The address is not stored: only a one-way, salted fingerprint of it, which cannot be turned back into the address and is deleted after eight days.

3. A copy on our server, and what linking adds

A copy of the learning record (the items listed in section 2, with dates) is kept on our server under the child's random device id from the first climb, so that it can be found again if the browser's storage is cleared. If no parent links it, it is deleted six months after the last climb. Linking the mountain keeps it for as long as the link lasts and lets it follow the child to other devices:

• a parent claims it: the mountain shows a one-time code, and the parent types it on their account page, or opens the invitation link that carries it (before signing in, that link shows the parent only the child's nickname and placement summary); or
• the same child is put on another device: a one-time code is made or entered on the mountain (the code comes from a parent's Add a device, or from the child's other device), or a climber code is used — three random words and a four-digit PIN that the child sets on the mountain, which carry nothing about the child; we keep the words and a one-way hash of the PIN.

From then on the copy is kept in step with every device linked to that child, so progress follows the child. It is stored under the child's random id, never with a name, age or school. If a paid plan's exam practice is used, our server also keeps, for six months, which questions each practice paper set and how it was marked, so that each paper is marked once.

One free trial per child. When a child's mountain is first linked to a parent account, we note on that child's record the date its free trial started and how many nights it has, so that each child gets one free trial however many accounts link them. When this browser stops using its device id (after Erase all progress, after it is unlinked, or when our server no longer recognises it), the browser keeps that old id and key in its own storage until it is given a new one, and sends them once at that moment; our server uses them only to check whether that mountain's trial was already used, and stores nothing new from them. When a child's record is deleted after its trial started, we keep, for one year, a one-way hash of each of its device keys with the trial's start date and length (no id, no name, nothing else), so that the same browser does not start a second free trial; after a year that is deleted too.

4. Parent accounts (optional)

Parent accounts are optional and for adults. Nothing in this section concerns you until you create one.

• Signing in: you type your email address and we send a six-digit code, valid for ten minutes. There is no password.
• What we store: your email address, the date you created the account, your sign-in sessions (stored only as one-way hashes), which children you have linked, the nickname you gave each, and each linked child's learning record (section 3). We never store a child's real name, age, school or location.
• Why: so your plan covers your child's mountain, so progress follows them to another device, so the account page can show you their week, and so we can send the emails you ask for.
• The sign-in cookie: signing in sets one more cookie (besides the mountain's device cookie in section 2), which does nothing but keep you signed in. It lasts up to 180 days, or until you sign out or delete the account.
• Add a device: the account page can make a one-time code, valid for 15 minutes, that lets another browser join a linked child's record. It stops working once used or expired, and is then deleted.
• Weekly report (optional, off until you switch it on): a Sunday email with, for each linked child, days on the mountain, questions and accuracy, where the marks went, and one suggestion — worked out from the record above, nothing new collected. You proved the address is yours when you signed in, so switching it on sends no second confirmation email. Switch it off on the account page, or with the one-click unsubscribe in every report; either stops it at once.
• Mountain reports: a report is worked out from the record above when a placement is finished, every Sunday, and at the end of each month. Each one is kept with the child's record (positions, counts, the missed questions with their causes, and the suggestions in it — nothing new collected) so earlier reports can be reopened from the account page; the Sunday email carries the first page of that week's report. Reports are deleted with the child's record.
• An exam date, if a parent enters one: on the account page a parent can give a child an exam date and a short label of their own (for example “NCEA L1 maths”). It is kept with the child’s record, shown only to the parents linked to that child, and used for one thing: from four weeks before that date the Sunday report turns into a sprint page. A parent can clear it at any time, and it is deleted with the child’s record.
• Account emails: we also send a parent account the service emails that belong to the account itself — the sign-in code, and one reminder shortly before the free trial ends, with each linked child's progress so far; these are not the weekly report and not a mailing list.
• Rope-team code: if you ask for one on the account page, it is kept with your address, together with the number of families who joined with it and the Pro days or gift codes that earned you — never who those families are.
• Gift codes: if you make one (lifetime and founding plans earn them), we keep the code and whether it has been used, and by which account, so that it can be used only once.
• Deals: if your child proposes a deal on the mountain (a goal such as seven nights in a row) and you accept it on the account page, we keep the goal, the one line the child wrote, the reward you wrote, and the dates, under the child's record; we email you when it is proposed and when it is done.
• Payments are processed by Stripe, on Stripe's own checkout page and under Stripe's own privacy policy; Alpenrise is sold by Bravo Consulting Limited, New Zealand. When you choose a plan, your browser goes to Stripe's checkout page, and your name, email, card and billing address go directly to Stripe. We receive only the fact of a purchase, the plan, its status and dates, and Stripe's customer, subscription and payment references — never your card details.

5. Email without an account

You can also give us an email address without making an account:

• Your placement card: at the end of the placement test you can ask us to email the card. We send it, and keep the address on our email list so that every message can carry an unsubscribe. The card goes into the email; we do not keep it.
• Our email forms: the launch list and the parents' page, where a parent can ask to hear from us.

For every address on this list:

• It is for adults. Please give a parent's own address, not a child's.
• What we store: the address, the date, which form it came from, and the language you used. No name, no age, no profile.
• What it is used for: only the emails that form offered. Nothing else is sent unless you ask for it. We never sell, rent or share the list.
• Unsubscribing: every email carries a one-click unsubscribe, which deletes the address rather than marking it. You can also write to us and we will delete it by hand.
• Abuse protection: so that scripts cannot flood the forms, we keep a one-way hash of the sending network address for one hour, stored apart from the email address.

Rope-team invitations. If a family you invite opens the placement test with your code, we record that the code was used and whether the placement was finished, with a one-way hash of their network address so that one household counts once a day. If a family opens a parent account with your code, that account records which code it came through, so that the invitation can count. We never tell you who they are, and if they leave their own email address, that address is theirs, on the list or account above, not shown to you.

6. Cookies, statistics and who else handles data

• Cookies: two, both ours and both first-party: the mountain's device cookie (section 2), which holds only the random device id and key so that progress can be found again, and the parent sign-in cookie (section 4). Neither is used for tracking, and no one else sets any.
• Statistics: we keep a few anonymous daily totals — for example, how many placement tests were started and finished, and how many camps were opened on the mountain and lanterns lit. Each is one number per day: no cookie, no network address, nothing that identifies a person or a device.
• Prices in your currency: to show visitors in New Zealand their prices in New Zealand dollars, this website reads the country that Cloudflare, our host, attaches to each request. It is used only to choose the currency for that page and is never stored.
• No tracking, no advertising, no third-party scripts: this website loads no fonts, scripts or images from anyone else (when you pay, you leave this website for Stripe's checkout page, see section 4), runs no analytics service, and does not follow you to other sites. We do not sell data.
• Abuse protection: to stop scripts abusing sign-in and the question server, we count requests per network address or email address; each count expires after an hour.
• Who else handles data: Cloudflare hosts this website, our server and its database; Resend delivers our emails (it receives the address and the message); Stripe handles payments. No other company has access.

7. Deleting your data

• A mountain in one browser: Erase all progress in the mountain's Pack clears that browser's progress, removes its device cookie and unlinks that browser. It leaves alone the copy on our server that the child's other linked devices share.
• A linked child's record: Unlink and delete on the account page removes that child's record from our server — the learning record, any exam-practice marks and every device key. If that child's free trial had started, a one-way hash of each device key is kept for one year with the trial's dates (section 3).
• Your account: Delete my account on the account page removes your email address (with the weekly report and any rope-team record kept with it), your sessions, your links, and any child record that no other parent is linked to. The account page is at alpenrise.app/account.
• A mountain no parent has linked: its copy deletes itself six months after the last climb; write to us and we will delete it sooner. A mountain linked to another device but not to a parent: write to us.
• The weekly report and the email list: the one-click unsubscribe in any email, or write to us.
• Purchase records: a record of each purchase (the plan, its dates and Stripe's references, without your email address) is kept for our accounts, for refunds and for as long as tax law requires. Stripe keeps its own records under its own policy.

8. Contact

[email protected]. A person answers.

Our iOS app

Our iOS app works offline and does not connect to our servers. It has no accounts, no analytics, no advertising and no third-party SDKs, and purchases in it are handled by Apple. Progress is kept on the device and, if the device is signed in to iCloud, in the private database of the user's own iCloud account; we cannot see either. Deleting the app removes the on-device copy, and the iCloud copy can be removed in iOS Settings → your name → iCloud → Manage Storage → Alpenrise.