First WordsPrivacy notice
Version 2026-11-01
Who we are
First Words is provided by Stewart Healey, 22 Wordsworth Avenue, Droylsden, Manchester, M43 6GA, the data controller for the information you store in the app. Contact us at privacy@firstwords.org.uk.
What we store
About you: your name, email address, password (stored only as a secure hash) and when you agreed to this notice.
About each child: a name (a nickname or first name is enough), an optional date of birth, an optional photo (made small, with location and camera details removed, before it leaves your phone), and the words they say, with optional details such as how they pronounce it, a category, whether it was spontaneous, and notes. We record which adult logged each word.
We do not collect location, contacts, advertising identifiers or analytics, and we do not use third-party tracking.
Why, and our lawful basis
We use this information only to provide the word-tracking service you asked for, including sharing it with the adults you invite (UK GDPR Article 6(1)(b), performance of a contract, and 6(1)(a), consent). Words a child says may reveal information about their development; you choose what to record and can delete it at any time. You confirm that you are the child's parent or guardian, or have their permission, before adding a child.
Who can see it
Only adults you (or another owner) invite to a child can see that child's information. Owners choose whether each adult can view only, or also add words. You can export a child's word list as a PDF or spreadsheet and share it yourself, for example with a speech and language therapist.
These companies process data on our behalf, under data processing agreements:
- Supabase, Inc. hosts the app's accounts and database, on servers in Ireland.
- Resend, Inc. sends sign-up, password-reset and invitation emails, from the USA. An invitation contains only the invitee's address, your name and when it expires, not the child's name.
- ImprovMX forwards emails sent to privacy@firstwords.org.uk to our mailbox.
Where data goes outside the UK, it is protected by the safeguards UK GDPR requires, such as the UK Extension to the EU-US Data Privacy Framework or standard data protection clauses. We never sell data.
Where it is stored
In Ireland (EU), on Supabase servers, encrypted in transit and at rest.
How long we keep it
We keep your information while your account is open. When you delete your account it is erased straight away, along with children you are the only owner of. We keep no backups of our own; short-term recovery copies kept by our hosting provider are overwritten in the normal course.
Your rights
You can see and download all your data (Your account → Download my data), correct it in the app, and delete your account and data (Your account → Delete account). You can also object to or ask us to restrict processing, and withdraw consent at any time, by contacting privacy@firstwords.org.uk. You have the right to complain to the Information Commissioner's Office (ico.org.uk).
Changes to this notice
If we change this notice in a way that matters, the app asks you to read and agree to it again.