A deletion request is completed within 30 days

Who can ask

• A parent or carer, for their own child.
• A school or district, for a child or a whole class.
• An adult, for their own account.

How to ask

1. Parents and carers: ask the child's teacher or school, who passes the request on, or write to the operator yourself.
2. Schools: write to the operator from a school address, naming the class or the child's teacher.
3. Adults: write from the email address your account uses.

The operator checks that the request comes from someone entitled to make it, deletes the data and replies when it is done.

Wren is run by Muscoota Ventures LLC. Write to privacy@muscoota.com.

What is deleted

• For a child: their profile and targets, every practice record, home links and the grown-ups' settings, consent records, and any research recordings with their ratings.
• For a class: every child in it, its invites and who belonged to it.
• For an adult: their email, name and PIN. A class they shared moves to another adult in it, and a class only they belonged to is deleted. Their marks on a child's tries stay with that child's record, under a placeholder with no details.

What stays

The audit log keeps that a deletion happened, with record ids and the time but no names. Encrypted backups expire within 36 days, and the deletion reaches them as they do.

How long data is kept

Without any request, Wren deletes data every night on the schedule below.

Wren runs on Render in the United States. Microsoft Azure Speech scores each try and keeps nothing, Cloudflare stores the encrypted backups, and Anthropic drafts adults' progress notes only when a school switches Claude on, which is off in the beta. The privacy notice says more.

• Your child's voice on each try

  Not kept

  Scored in the server's memory and released at once, never written to a disk or the browser

• The Hear me replay of the last try

  The current try only

  Held in the device's memory and cleared at the next word or when the child leaves

• Research recordings, kept only with a parent's separate research consent, with the raters' ratings and play log

  The study's retention period, then deleted; at once if the consent is withdrawn

  An encrypted store outside the app's disk and backups; deleted nightly and on withdrawal

• Practice records: sessions, tries and their scores, adults' marks, progress, approvals, flags and progress notes

  The end of the school year they last changed in, plus 90 days

  Deleted nightly once that date passes; a sound pattern flagged for a speech-language pathologist stays until they review it

• A child's profile and targets: nickname, avatar and secret picture, birth month and year, dialect, languages and support settings

  Until the child or class is archived, then 30 days, or within 30 days of a school's request

  Deleted nightly 30 days after archiving; the operator deletes on request

• Classes: name, class code, time zone and the school's consent record

  Until the class is archived, then 30 days

  Deleted nightly 30 days after archiving, with every child in it

• Practice and research consent records

  As long as the child's profile; a withdrawn consent until the end of that school year plus 90 days

  Deleted with the child, or nightly once a withdrawn consent's date passes

• Home links and the grown-ups who open them: reminder days and time, suggested languages and an opt-in contact

  30 days after the link expires or is turned off

  The contact is cleared when the link ends, and the rest deleted nightly 30 days later

• Adult accounts: email, display name and a hashed PIN

  Until deletion is requested, or after 24 months without signing in

  Deleted nightly after 24 months without a sign-in; the operator deletes on request

• Which adults belong to which class, and their role

  While they belong; after leaving, until the end of that school year plus 90 days

  Deleted with the class or the adult, or nightly once that date passes

• Permissions for supervised scorers to mark a child's tries

  While granted; after revoking, until the end of that school year plus 90 days

  Deleted with the child or the adult, or nightly once that date passes

• Invite codes for adults, stored hashed

  30 days after the code is used or expires

  Deleted nightly

• School and caseload names

  While a class or adult belongs to them

  Deleted nightly once nothing belongs to them and they are 30 days old

• Research rater accounts: email, display name and a hashed PIN

  Until revoked and none of their ratings remain

  Deleted nightly once both are true

• Product event log: the kind of event, its day, the age band and a count, never a child, a session or a time of day

  90 days

  Deleted nightly

• Audit log: the action, the role, record ids and the time, never names or content

  Kept while the service runs

  It holds no names, contacts or content, so a deleted record's ids identify no one

• Scheduled job log: when each nightly run started and finished, and its counts

  1 year

  Deleted nightly

• Speech engine versions, accuracy checks per sound and the cache of spoken words, with no child or adult details

  Kept while the service runs

  They hold no personal details

• Server logs, never with request bodies, audio or names

  At most 30 days

  The host's log retention

• Encrypted backups of the database

  Deleted within 36 days

  Off-site copies expire after 35 days, so a deletion reaches the backups when they do

• Microsoft Azure Speech: the audio of one try and its word, with no names or ids

  Not kept

  Processed in memory with audio logging turned off

• Anthropic Claude, when switched on (off in the beta): numbers and dates for a progress note, never audio, names or notes

  Up to 30 days at Anthropic

  Anthropic's API retention