Privacy Policy — Learning Hub

Last updated: 12 August 2026 (v3.1) — added family sign-ins (parent-created learner sign-ins, §3.2); v3 (10 August 2026) introduced anonymous app-usage measurement (§5a)

1. Who We Are

Hanalytic Limited is a company registered in England and Wales. We operate the Moyako brand, including Learning Hub, as a trading name of Hanalytic Limited. We are the data controller for the personal data described in this policy.

2. Scope & Age

Learning Hub is a study tool for students preparing for GCSE (and equivalent) exams — typically aged 14–16, and suitable for secondary-school learners aged 13 and over. Because much of our audience is under 18, we design the service to the UK Age Appropriate Design Code (the "Children's Code"): see §8.

• Signed-out use — you can practise without an account. In this mode all your data (progress, settings, and any postcode you enter) stays on your own device and is never sent to us.
• Signed-in use — creating an account is optional. It lets your progress sync across devices, unlocks Learning+ if you subscribe, and enables the optional parent view.
• Parent accounts — a parent or carer can create an account and either create and manage sign-ins for their learners (family sign-ins) or link to a learner's own account with that learner's confirmation (see §3.2).

3. Data We Collect

What we collect depends on how you use Learning Hub.

3.1 If you create an account

• Email address — to identify your account and let you sign in.
• Display name (optional) — shown in your own account and, if you link a parent, to that parent.
• Account type — student or parent, to give the right features.
• Family sign-ins — if a parent creates a learner's sign-in (see §3.2), the parent provides that learner's display name, sign-in email and password (stored only as a secure hash, as below), plus the family link between the two accounts.
• Password — stored only as a secure one-way hash (bcrypt). We never store or see your actual password.
• Learning data — your topic mastery, practice attempts, exam-simulator scores, daily streaks, and chosen course. This is tied to your account so we can show your progress and choose which questions to practise next.
• Learning+ subscription data — if you subscribe, we store your current status (free, active, or cancelled), your plan (monthly or annual), and a payment-processor reference (a Stripe customer and subscription ID, or a Google Play / Apple purchase reference on mobile). We do not store card numbers or any payment details — all payment data is held by the payment processor (see §7).

We also process standard server-side technical data — IP address, user-agent, and request timestamps — used only for security, rate-limiting, and short-term troubleshooting.

3.2 Parents & family sign-ins

There are two ways a parent can be connected to a learner, with different privacy rules:

• Linked learner (the learner's own account) — if a learner and a parent both agree to link their accounts, the parent can see the learner's aggregate progress only: their course, current streak, overall training band, and a short list of weaker topics. Linked parents never see answers, individual question content, or anything the learner types, and can never open the learner's account. Either side can unlink at any time.
• Family sign-in (created by a parent) — a parent or carer can create and manage sign-ins for up to four learners. Here the parent is the account manager and consent-giver for that learner's account (UK GDPR Article 8): they set the learner's name, sign-in email and password, can reset that password, and can open that learner's practice from their own sign-in — so for family sign-ins the parent can see that learner's practice, not just aggregates. Returning to the parent side always requires the parent's password. A Learning+ subscription on the parent account also covers its family sign-ins. Removing a family sign-in from the account ends the connection but keeps the learner's account and learning data intact.

3.3 Data that stays on your device

• Signed-out progress and settings — kept in your browser/app local storage only; never transmitted to us.
• Postcode — if you enter a postcode for a nearby-school/college feature, it is used entirely on your device and is never sent to our servers.
• The practice questions themselves — generated on your device; we do not receive the questions or your working.

4. How We Use Your Data

• Provide the service — sign you in, show your dashboard, and save and retrieve your progress.
• Personalise your practice — we use your own results to decide which topics and questions to show you next and to calculate your personal training band. This is done solely to help you on your own dashboard; it is never shared and never used for advertising or marketing.
• Process Learning+ subscriptions — confirm your entitlement and manage renewals and cancellations. The lawful basis is performance of a contract (UK GDPR / EU GDPR Article 6(1)(b)). Taking payment, issuing receipts, and keeping transaction records for tax are handled by the payment processors (see §7); Moyako does not process or store payments itself.
• Enable the parent view — share aggregate progress with a linked parent, and let a parent manage the family sign-ins they created, as described in §3.2.
• Send essential service messages — occasional messages relating to your account or subscription where needed. We do not send marketing emails.
• Keep the service safe and lawful — prevent abuse, meet legal obligations, and fulfil your data rights (§9).

5. Advertising & Tracking

Learning Hub does not show you advertising. The Android app is built on the same shared framework as our games, so Google's AdMob library is present in the package — but it is configured with a placeholder test identifier and never requests or displays an ad, and we hold no advertising account for this app. There are no advertising cookies on the website, and we do not use behavioural analytics or third-party tracking of any kind.

Because the library ships with the app, the Google Play listing carries Google's standard “Contains ads” label. If we ever do introduce advertising, it will be contextual only: personalised advertising is switched off for every user and cannot be turned on, and we will update this notice before any ad appears.

5a. Anonymous Usage Measurement

To understand whether Learning Hub is being discovered and used — for example, how many people install the app, try a practice session, or start a Learning+ subscription — the mobile apps record a small set of anonymous, aggregated usage events using Google Firebase Analytics.

What this measurement is, and is not:

• Anonymous — events are never linked to your name, email, account, or an advertising identifier. We have switched off Firebase's advertising-ID collection and never attach your user ID to analytics.
• Aggregated — we look only at totals and trends (for example, “how many installs this week led to a sign-up”), never at individuals.
• Minimal — events cover app usage milestones only (app opened, practice started, sign-up, subscription started). Your questions, answers, scores, and learning content are never included.
• No personalised advertising — ad-personalisation signals are permanently disabled and cannot be enabled; this data is never used to target you with ads.
• Where we advertise Learning Hub elsewhere (for example in search results), we may measure in aggregate whether those adverts lead to installs and sign-ups, using Google's measurement infrastructure. This counts outcomes; it does not profile users.
• The website (learning.moyako.com in a browser) uses no third-party analytics. Our servers keep only anonymous, aggregate counts of sign-up funnel steps, with no cookies and no user identifiers.

Lawful basis: legitimate interests (understanding and improving a service we offer, and measuring our own advertising), balanced against our mostly under-18 audience by the safeguards above (UK GDPR Article 6(1)(f)). A Data Protection Impact Assessment is on file.

6. Cookies & Local Storage

Learning Hub uses only essential storage on your device:

• Sign-in token — after you sign in, to keep you signed in.
• Your settings and progress — theme, tone, and (in signed-out mode) your practice progress, stored locally on your device.

There are no advertising or tracking cookies. Essential storage is required for the app to work and cannot be turned off while you use it; clearing it (or signing out) removes it.

7. Third-Party Services

We use a small number of service providers that process data on our behalf, under contract, as our processors:

• Hostinger — hosting for learning.moyako.com and our servers. Standard server logs may be recorded. Hostinger Privacy Policy.
• Stripe — payment processing for Learning+ subscriptions purchased on the web. Stripe handles card data directly as a PCI-DSS Level 1 provider; Moyako never receives full card numbers. Stripe Privacy Policy.
• Google Play Billing and Apple — where a subscription is purchased inside the mobile app, the app store processes the payment under its own rules. Google Privacy Policy · Apple Privacy Policy.
• Firebase (Google) — app infrastructure in the mobile apps (app delivery and, where enabled, push notifications) and the anonymous usage measurement described in §5a. Advertising-identifier collection is off; analytics events are anonymous and aggregated. Firebase Privacy.

We do not use any advertising or tracking service providers; our only analytics is the anonymous, aggregated measurement described in §5a.

8. Children & the Age Appropriate Design Code

Learning Hub is used by under-18s, so we follow the UK Age Appropriate Design Code (the "Children's Code"). In practice:

• High-privacy by default — no ads, no profiling, no advertising identifier, and only anonymous, aggregated usage measurement (§5a), for everyone.
• Measurement without identity — analytics events carry no user identity, ad-personalisation is permanently off, and a Data Protection Impact Assessment covering under-18 users is on file.
• Data minimisation — we collect only what is needed to run the service; the app works fully signed-out with nothing sent to us.
• No advertising or marketing use of learning data — it is used only to personalise your own practice, never to target ads.
• No selling or sharing of children's data.
• Parental involvement — an optional, consent-based parent view that shows aggregate progress only for learners with their own account; for family sign-ins the parent or carer creates and manages the learner's account and acts as its consent-giver (UK GDPR Article 8) — see §3.2.

If you are a parent or carer and have any question about your child's data, contact info@moyako.com.

9. Your Rights (UK GDPR / EU GDPR)

Under UK GDPR, EU GDPR and the Data Protection Act 2018, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (see below and §10)
• Object to, or ask us to restrict, processing
• Data portability — receive a copy of your data
• Lodge a complaint with the Information Commissioner's Office (ICO) or your local EU supervisory authority

To delete your account — email info@moyako.com with the subject line "Delete my account". We will verify the request and permanently erase your account and associated learning data within one month (usually much sooner). If you have an active Learning+ subscription, cancel it first or ask us to cancel it as part of the deletion.

For any other right — email info@moyako.com with the subject line "Data Subject Request" describing what you would like us to do. We verify your identity and respond within one month, as required by law.

10. Data Retention

• Account and learning data (email, display name, account type, progress, exam-simulator scores, streaks): retained while your account is active; deleted on your request, or after 24 months of inactivity.
• Learning+ subscription data (status, plan, payment-processor reference IDs): retained while your account is active and deleted when you delete your account. The underlying payment and transaction records — including anything needed for tax and accounting — are held by the payment processors (Stripe, Google, Apple) under their own retention policies; Moyako neither stores nor retains them.
• Server logs (IP address, access time): up to 30 days on the hosting provider, then purged.
• On-device data (signed-out progress, settings, any postcode you enter): never sent to us, so nothing to retain on our side; you can clear it on your device at any time.

11. International Transfers

Some of our service providers (for example Google, Apple, Stripe) may process data outside the UK / EEA. These transfers are covered by the EU-US Data Privacy Framework, the UK International Data Transfer Addendum, or equivalent standard contractual clauses. Our primary hosting (Hostinger) operates within the UK / EEA.

12. Changes to This Policy

We may update this policy. Material changes will be announced on this page, and for signed-in users via an in-product notice on the next session. The "Last updated" date above reflects the most recent revision.

13. Contact Us

Data Protection queries: please use the same email and include "Data Protection" in the subject line.