🔒 Privacy Policy

1. In short

Kunskapsstjärnan is built so that your work stays in your own browser. You do not need an account, we never ask children for an email address, and we cannot see what you do in the apps.

• Everything you create is stored locally on your device, not with us.
• No account is needed to use anything on the site.
• Ads are only shown if you have actively said yes.
• Pupils and parents cannot create accounts – only schools can.
• You can view, export and delete everything at any time under My data.

The rest of this page covers the details.

2. Who is responsible

For the site in general, Kunskapsstjärnan is the data controller. Contact: daniel@kunskapsstjarnan.se.

For pupil accounts it is different. There the school's controller is the data controller and Kunskapsstjärnan is the processor. That is why a school must sign a data processing agreement before any pupil accounts can be created – without one we process no pupil data at all.

3. What is stored on your own device

Most of it. Drawings, mind maps, word lists, stories, results and progress are stored in the browser's IndexedDB. Settings such as language, theme and your answer to the cookie question are stored in localStorage, because they must be read before the page is drawn.

None of this is sent to us. We hold no copy and cannot read it. Under My data you can see exactly what is stored, how much space it takes, and export it all to a file or delete it.

The flip side: if you clear your browsing data or change browser, it is gone. Export anything you want to keep.

4. Cookies

Necessary

A session cookie keeps track of whether you are signed in. If you are a pupil on your own device, a further cookie keeps you signed in until you sign out yourself. Neither contains anything about what you do in the apps, and they cannot be switched off – without them signing in does not work.

Advertising cookies

Ads are only shown on the menu pages – never inside an exercise. On pages without ads, nothing at all is loaded from Google.

The ads come from Google. You choose whether they may be personalised, that is, whether Google may use cookies to pick ads based on you. If you choose non-personalised ads we ask Google not to.

Non-personalised ads are not entirely cookie-free, however: Google still sets cookies to count impressions and detect fraud. The difference is that they are not used to select ads for you.

You can change your choice at any time: open the ad choice again. Schools with a Star subscription are entirely ad-free.

5. Accounts

Pupils and parents cannot create accounts. Teacher accounts are created by the school, or by a teacher whose controller has a data processing agreement. Pupil accounts are in turn created by the teacher.

A pupil account holds as little as possible: a first name, a username and a password. Surname and class are optional. No email address is collected from children.

For teacher accounts we store name, email address, school affiliation and sign-in history. The email address is used for signing in, password resets and important messages about the service.

6. Synchronisation

Schools with a Star subscription can let a pupil's work sync between devices. Then – and only then – a copy of the pupil's app data is stored on our server, so the same work is available on the school tablet and at home.

The original stays local. If the subscription or agreement ends, the server copy is handled as the controller has chosen: deletion, export to the controller, or freezing for a grace period. The pupil's local data is never affected – neither we nor the school can reach it.

7. Activity log in TTime

TTime can show what a pupil has worked on during a lesson. The feature is off by default and is switched on by the teacher.

The log is stored locally in the pupil's browser and records which app was used, for how long and how it went. Free text written by the pupil is never stored. The feelings and energy check-in requires a separate yes, and even then only reports that a check-in was made – never what the pupil felt or wrote.

8. Who we share with

We do not sell data and do not share it for marketing.

• Hosting: the site runs at Websupport, who process data on our behalf as a processor.
• Google: if you have accepted ads, Google processes data under its own policy. If you have not accepted, no such processing takes place.
• The pupil's teacher: with a Star subscription, teachers linked to the pupil can see the pupil's work.

9. How long we keep data

• Locally on your device: until you delete it or clear your browser. We cannot affect this.
• Teacher accounts: as long as the account is active. The link to a school must be renewed yearly and otherwise lapses automatically.
• Pupil accounts and synced data: as long as the school has a valid agreement, then as the controller has chosen.
• Sign-in logs: 90 days, then deleted automatically.

9b. Sign-in logs

Every sign-in attempt is recorded with the time, IP address, browser and the username that was entered – including failed attempts. This applies to both teachers and pupils.

We do this for three reasons: to detect someone guessing passwords, to be able to investigate and report an incident within the 72 hours the GDPR requires, and so that you can see your own recent sign-ins under My profile and react if one looks wrong.

The legal basis is our legitimate interest in protecting accounts (Article 6(1)(f)). Records are deleted automatically after 90 days. The period is chosen so that a suspicion raised after a month can still be investigated, but no longer than that.

10. Your rights

You have the right to know what data we hold about you, to have it corrected or erased, to object to processing, and to receive it in a readable format.

For anything stored locally you do not need to contact us – you do it yourself under My data. For pupil accounts, contact the school, which is the data controller. Otherwise contact us at daniel@kunskapsstjarnan.se.

11. Children's privacy

Kunskapsstjärnan is used by children, and the whole design starts from that. Children cannot register themselves, no email address is collected from children, and all work stays on the child's own device unless the school has actively chosen synchronisation under an agreement.

We do not profile children and do not use data to target content. Ads are not personalised by us, and are only shown after consent.

12. Changes and complaints

If this policy changes, the date at the top is updated. Significant changes are announced on the site.

If you are unhappy with how we handle personal data you can complain to the Swedish Authority for Privacy Protection (IMY), or to the supervisory authority in your own country.

📧 Contact us

Email: daniel@kunskapsstjarnan.se