Support questions go to Wren's operator by email
A draft under review by counsel. Notice version 2026-11.
Contact
Wren is run by Muscoota Ventures LLC. Write to privacy@muscoota.com.
Say which class and device you mean, never a child's name.
Common fixes
- A child is not heard: open Mic Check on that device, move to a quieter spot, and use a wired headset if you have one.
- A child cannot sign in: the class code and the child's secret picture are on the login card the teacher keeps.
- A home link stopped working: links last 30 days and can be turned off, so ask the child's teacher for a new one.
- An adult forgot their PIN: the operator resets it once they have checked who is asking.
A security or privacy problem
Write to the operator at once with what you saw and when. Leave out children's details; the operator will ask for what they need.
Deleting data
Parents, schools and adults can ask for their data to be deleted. How to ask for a deletion
How long data is kept
Wren runs on Render in the United States. Microsoft Azure Speech scores each try and keeps nothing, Cloudflare stores the encrypted backups, and Anthropic drafts adults' progress notes only when a school switches Claude on, which is off in the beta. The privacy notice says more.
Show how long each kind of data is kept
Your child's voice on each try
Not kept
Scored in the server's memory and released at once, never written to a disk or the browser
The Hear me replay of the last try
The current try only
Held in the device's memory and cleared at the next word or when the child leaves
Research recordings, kept only with a parent's separate research consent, with the raters' ratings and play log
The study's retention period, then deleted; at once if the consent is withdrawn
An encrypted store outside the app's disk and backups; deleted nightly and on withdrawal
Practice records: sessions, tries and their scores, adults' marks, progress, approvals, flags and progress notes
The end of the school year they last changed in, plus 90 days
Deleted nightly once that date passes; a sound pattern flagged for a speech-language pathologist stays until they review it
A child's profile and targets: nickname, avatar and secret picture, birth month and year, dialect, languages and support settings
Until the child or class is archived, then 30 days, or within 30 days of a school's request
Deleted nightly 30 days after archiving; the operator deletes on request
Classes: name, class code, time zone and the school's consent record
Until the class is archived, then 30 days
Deleted nightly 30 days after archiving, with every child in it
Practice and research consent records
As long as the child's profile; a withdrawn consent until the end of that school year plus 90 days
Deleted with the child, or nightly once a withdrawn consent's date passes
Home links and the grown-ups who open them: reminder days and time, suggested languages and an opt-in contact
30 days after the link expires or is turned off
The contact is cleared when the link ends, and the rest deleted nightly 30 days later
Adult accounts: email, display name and a hashed PIN
Until deletion is requested, or after 24 months without signing in
Deleted nightly after 24 months without a sign-in; the operator deletes on request
Which adults belong to which class, and their role
While they belong; after leaving, until the end of that school year plus 90 days
Deleted with the class or the adult, or nightly once that date passes
Permissions for supervised scorers to mark a child's tries
While granted; after revoking, until the end of that school year plus 90 days
Deleted with the child or the adult, or nightly once that date passes
Invite codes for adults, stored hashed
30 days after the code is used or expires
Deleted nightly
School and caseload names
While a class or adult belongs to them
Deleted nightly once nothing belongs to them and they are 30 days old
Research rater accounts: email, display name and a hashed PIN
Until revoked and none of their ratings remain
Deleted nightly once both are true
Product event log: the kind of event, its day, the age band and a count, never a child, a session or a time of day
90 days
Deleted nightly
Audit log: the action, the role, record ids and the time, never names or content
Kept while the service runs
It holds no names, contacts or content, so a deleted record's ids identify no one
Scheduled job log: when each nightly run started and finished, and its counts
1 year
Deleted nightly
Speech engine versions, accuracy checks per sound and the cache of spoken words, with no child or adult details
Kept while the service runs
They hold no personal details
Server logs, never with request bodies, audio or names
At most 30 days
The host's log retention
Encrypted backups of the database
Deleted within 36 days
Off-site copies expire after 35 days, so a deletion reaches the backups when they do
Microsoft Azure Speech: the audio of one try and its word, with no names or ids
Not kept
Processed in memory with audio logging turned off
Anthropic Claude, when switched on (off in the beta): numbers and dates for a progress note, never audio, names or notes
Up to 30 days at Anthropic
Anthropic's API retention