Little Quest · Information for families
Family privacy notice
Small quests, clear choices. Here is what saved family play remembers and how you can manage it.
Effective 16 October 2026 · Operated by Aero · Privacy contact: aero@lwazisibanda.online
Who is responsible
Little Quest is operated by Aero. For privacy questions, support, or requests about your family’s information, email aero@lwazisibanda.online. This notice covers the free guest game and saved family service on littlequest.lwazisibanda.online.
A short explanation for children
Your grown-up chooses a nickname and starts your island. We remember the number questions you practise, your hints and your island decorations so you can come back later. Your grown-up can see your progress. Other families cannot see your learning profile. Extra review is off unless your grown-up chooses it. Ask your grown-up if you want to change or remove your profile. You can play the guest game without a saved family profile.
What information we use
For a parent account, we store your email address, an internal account identifier, a securely hashed password, account dates and any family-access expiry date. WordPress also holds the account information needed for password setting and resets. If you contact us, we receive the information you include in your message.
For a learning profile, we store a nickname, a built-in avatar, selected times tables and difficulty, reporting timezone, comfort settings, optional review preference, rewards and island decoration. Please use a nickname that does not identify your child.
Learning records include multiplication facts practised, activity type, independent or supported answers, counts of unsuccessful tries, skips, completion times, current quest state, progress summaries and future review dates. The learning records do not retain a list of the child’s incorrect guesses.
We receive profile details from the parent, activity from play, and generate progress summaries from that activity. We do not ask children for their email, full name, birthday, school, diagnosis, photograph or precise location.
Why we use this information
We use parent account information to provide and administer the account you request, authenticate access and send essential account or password emails. We rely on legitimate interests in operating the private family learning service requested by adults.
We use children’s profile and learning information to resume quests, award decorations and show their parent a progress report. We rely on legitimate interests in helping families practise maths and understand progress, with particular regard to children’s rights. Nicknames, limited collection, private profiles, a guest alternative and deletion controls reduce the impact on children.
We use necessary security information to prevent misuse, protect accounts and investigate faults, relying on legitimate interests in operating a secure service. If a particular law requires a disclosure or retention, we rely on that legal obligation for that specific use.
Reading this notice or creating an account is not blanket consent to every use of personal information. The right to object to our legitimate-interest uses is explained below.
Optional personalised review
Personalised review is off by default. When enabled by a parent, the game uses the facts practised, support needed and previous successes to choose facts that are due for another practice. It uses ordinary game rules; it does not infer a diagnosis or make school, admission or eligibility decisions.
A parent can turn review off in the profile settings. That stops optional review selection; ordinary saved quests and progress reporting continue. Deleting the profile removes its stored learning records. We rely on the limited learning-service legitimate interest described above for this optional feature. Enabling it is a practice preference, not permission to use information for unrelated purposes. It does not make decisions with legal or similarly significant effects.
Guest play and your choices
The guest game does not create a saved family profile; its game progress is held for the current page session. Ordinary website requests can still reach the hosting and security services.
You are not legally required to provide an email address or a learning profile. An email address and account credentials are needed for saved family access. A nickname and practice settings are needed for a saved profile. You can choose guest play instead. Children do not have their own email logins.
Cookies and signed-in sessions
The family service uses three necessary first-party cookies. The gate cookie, lqf_gate, protects account requests and lasts about one hour. The parent cookie, lqf_parent, lasts at most two hours, with a 30-minute inactivity limit. The play cookie, lqf_play, permits one selected profile to play for at most eight hours. Sign-out expires the relevant session cookie.
These cookies are Secure on HTTPS, HttpOnly and SameSite Strict. Starting child play ends the parent portal session on that browser and clears WordPress login cookies there. Child play cannot open the parent’s settings. WordPress sign-in and password-reset routes may also use their own necessary login, test and reset cookies.
The family plugin does not use advertising cookies or browser local storage to save learning records. Hostinger also processes ordinary website requests for delivery and security. The unused Hostinger Reach marketing plugin has been disabled.
Who can receive information
Aero and authorised people maintaining the service may access information when needed for support, security or administration. Hostinger provides the website hosting, database infrastructure, email and backups. Those services and their authorised subprocessors receive information needed to operate, deliver and protect the service. Learning profiles are not published to other families.
Hostinger operates internationally, so processing and support may take place outside the UK. Its Data Processing Addendum describes its processing commitments and subprocessors. For restricted UK transfers, that agreement provides for the UK Addendum to the EU Standard Contractual Clauses where applicable. You can ask Aero for information about the arrangements relevant to your data and a copy of applicable safeguards.
We may disclose necessary information where legally required, or to appropriate professional advisers dealing with a specific dispute or security incident. We do not sell family learning information. The family service has no public leaderboard, child-to-child messaging or advertising audience feature. Registration does not subscribe you to marketing, and no payment processor is currently enabled.
Optional read-aloud
If you choose read-aloud, the browser’s speech service receives the displayed maths text. Depending on your browser, device and chosen voice, speech may be produced on the device or by that provider’s online service. Little Quest does not request microphone access for this feature. Read-aloud does not need the profile nickname or parent email.
How long information stays
Detailed answer records and request-retry records older than 90 days are removed by scheduled daily cleanup. Saved quests are removed after 90 days without an update. Cleanup runs through WordPress scheduling, so removal occurs when the scheduled task runs rather than at an exact second.
Profile settings, rewards and aggregate progress remain while the profile exists. There is currently no automatic deletion of an inactive parent account or profile. Parents can delete individual learning profiles in the Family Hub or ask Aero to close the parent account.
Family authentication records expire with their sessions and expired records are removed during scheduled cleanup. Sign-in and registration rate limits use a keyed hash derived from the request address, with a 15-minute expiry after the latest counted attempt. The family plugin does not store the raw IP address in that rate-limit key.
Hostinger’s published web-hosting backup policy retains weekly backups for six weeks and daily backups, where included, for seven days. A deleted record can remain in an older backup until that backup rotates out. Backup copies are for recovery, rather than ordinary use. If a backup is restored, profile and account deletion requests must be reapplied before the restored data is used.
For support messages and rights requests, our retention policy is to retain only what is needed to resolve the matter and evidence the response, normally for up to 12 months after closure. A specific legal obligation or unresolved dispute may justify retaining relevant records longer. We keep the minimum deletion-request information needed to honour the request if a backup is restored, through the backup retention period.
Hostinger controls the retention of infrastructure and security logs under its service policies. The relevant criteria are delivery and troubleshooting needs, abuse prevention, security investigations and legal obligations; the family plugin’s 90-day rule does not control these provider logs. Contact Aero for help with a request concerning those records.
Your information rights
You can ask for access to personal information, correction of inaccurate information, deletion, restriction of use and, where applicable, a portable copy. These rights have conditions and exceptions; children have rights in their own information too.
You have the right to object to processing based on legitimate interests. Contact Aero at aero@lwazisibanda.online to explain your request. A parent can export family learning records and delete individual learning profiles in the Family Hub. Contact Aero for parent account closure or other requests. We may need proportionate information to verify identity and authority before disclosing or deleting records.
We will handle requests within the time required by applicable data protection law and explain any extension or lawful refusal. If you are unhappy, contact Aero first if you wish. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
Keeping information safe
The site uses HTTPS. Passwords are hashed, profile access is checked against the parent account, and child sessions have limited access. Saved progress is held on the website server rather than in a public profile. No online service can promise perfect security. Please keep your password private and sign out on shared devices.
Changes to this notice
We will update this notice when the service or its use of information changes. The effective date above identifies this version. We will explain material new uses before they begin. This notice does not give permission for future advertising, payments or unrelated uses.