Last updated: 5 October 2026
This policy explains what Lockshield Learning Ltd does with personal information when you use the LockyLearn app or this website. We have written it in plain English, because the people who rely on it are parents, carers and teachers.
Lockshield Learning Ltd is the data controller for the personal information described in this policy. We are registered in England and Wales under company number 16682264. You can reach us about anything in this policy at [email protected].
LockyLearn is built so that information about your child stays with your child. The following is stored only in the app's protected storage on your own device, is not transmitted to us, and is not accessible to us:
Removing a child's profile in the app removes their information straight away. Deleting the app removes it too. On Android that happens immediately. On iPhone and iPad, Apple's system keeps an app's protected storage after the app is deleted, where nothing else can read it; if LockyLearn is installed again, the first thing it does is clear what was left behind. Because we never receive any of this, there is nothing for us to delete at our end and nothing for us to disclose if we were ever asked for it.
To give you an account and keep you signed in, we collect and store your email address together with the authentication information associated with your account. If you create your account in the app, you also confirm that you are a parent or carer aged 18 or over and that you agree to our terms of use and this policy. We use this to create your account, to verify that it is you signing in, to keep your settings available across your devices, and to contact you about the service, for example to verify your email address, to reset your password or to tell you about a change that affects you.
Our legal basis is performance of our contract with you (UK GDPR Article 6(1)(b)): we cannot provide an account without it.
Your account belongs either to a school that provides LockyLearn to its families, or to home learning, which families pay for themselves. We store which against your account. This is what lets the app open the right homework services on any device you sign in to, and it is what keeps everything else locked out. These are choices about services, not records of what your child does inside them: we do not receive your child's schoolwork, scores, progress or activity.
Our legal basis is again performance of our contract with you (Article 6(1)(b)).
If your child's school gives you a LockyLearn code, you can use it to create your account in the app. Your account is then linked to that school, and we record which code you used, so that we can stop a code that has been shared beyond the school. We may tell a school how many families have joined with its code, but never who they are.
To stop codes being guessed, we limit how many times a code can be tried in an hour. To do that we keep a scrambled form of the internet address the attempt came from, which cannot be turned back into the address, and delete it within a day.
When a school's contract with us ends, your account stays open, with your children and settings on your device just as they were, and moves to home learning, where you can choose to subscribe. We keep a note of the school you came from, so that if the school renews we can link your account to it again, and so that we can tell the school how many of its families are still using LockyLearn. You can ask us to remove that note at any time.
Our legal basis is performance of our contract with you (Article 6(1)(b)) for linking your account to the school, and our legitimate interests (Article 6(1)(f)) in protecting codes from misuse and in telling schools how many of their families use LockyLearn.
When you sign up for home learning, we ask which school your child goes to. You can answer, tell us that you home educate, or skip the question. The answer does not change what you get: it tells us where families want LockyLearn, so that we can offer it to those schools. We may tell a school how many of its families use LockyLearn, but never who they are, and only once at least three families have named it, so that a small number cannot point to anyone.
Our legal basis is our legitimate interests (Article 6(1)(f)) in bringing LockyLearn to more schools. You can ask us to change or remove the school you named at any time.
If you pay for home learning, you pay Apple or Google, through the App Store or Google Play. They take the payment and are responsible for your payment details under their own privacy policies; we never see your card or bank details. To know whether your subscription is active, we receive the plan you chose, when a free trial or subscription began, renews or ends, the store's reference for the purchase, and your country and currency. We link these to your account's identifier, never to your child.
Our legal basis is performance of our contract with you (Article 6(1)(b)). Apple and Google keep the records of what you paid; the payments they pass on to us do not identify you.
When you sign in, sign up or manage your subscription, the app tells our analytics provider which of those steps you went through, for example that a sign-in succeeded or that a free trial started, along with the kind of device and how it was held. Each event is linked to your account's identifier, never to your email address or username. We use this only to find where parents get stuck and to make those screens better. The app sends nothing to analytics while your child is using it, and never anything about your child: not their name, their profile, which homework they open or anything they do there. The analytics are stored in the EU.
Our legal basis is our legitimate interests (Article 6(1)(f)) in making the app work well for the parents and carers who set it up.
When the app runs into a problem, it sends us a crash report. These reports describe the fault rather than the person: typically the device model, the operating system version, the version of the app, and the technical details of what went wrong. They are used to find and fix faults and to keep the app stable and secure. They are not used to build a profile of anyone, and they are not used for advertising.
Our legal basis is our legitimate interests (Article 6(1)(f)) in keeping the app working correctly. We have considered this against your interests and rights, and we limit what is collected to what we need to diagnose faults.
Before families could sign up in the app, you could register your interest instead. If you did, we hold your email address and the school you named, and, if you filled in the form that followed, your name and the homework services your child uses. We use it to tell you when LockyLearn is available for you. Our legal basis is our legitimate interests (Article 6(1)(f)) in answering someone who has asked to hear from us, and you can ask us to delete it at any time.
This website is separate from the app. It uses Google Analytics to understand which pages people find useful. These analytics cookies are only set if you accept them in the cookie banner, and you can change your mind at any time using the "Update cookies preferences" link in the footer of any page. If you decline, no analytics cookies are set. Cookies that are strictly necessary for the site to function are always used, as the law allows.
Our legal basis for website analytics is your consent (Article 6(1)(a)), and we rely on the Privacy and Electronic Communications Regulations for the storing of those cookies.
If you contact us through the form on our for schools page, we collect your name, your role, your email address, your school, roughly how many pupils it has, the homework services it uses and anything you add in the notes. We use it to answer you, to quote for a licence and to arrange a pilot. We do not add you to a marketing list off the back of an enquiry.
Our legal basis is our legitimate interests (Article 6(1)(f)) in responding to someone who has asked us to get in touch. The enquiry is stored alongside our other data in the European Economic Area, and the notification it triggers is sent through the same email provider we use for the rest of the service. We keep enquiries while we are in contact with you and for a reasonable period afterwards, and you can ask us to delete yours at any time.
To keep automated spam out, the form is protected by Google reCAPTCHA Enterprise, which checks that a real person is sending it. It starts when you first click into the form, not when the page loads, and sends Google information about your device, your browser and how you interact with the page so that it can tell people from bots. Our legal basis is our legitimate interests in protecting the form from abuse. Google's use of this information is covered by the Google Privacy Policy.
LockyLearn is made for primary school children, and children are the people who use it day to day. We have designed it so that using it does not require us to collect anything about them.
We have designed the service with the Information Commissioner's Age Appropriate Design Code in mind, which asks that services likely to be used by children put the child's best interests first. If you are a parent, carer or teacher and you are concerned that we have somehow come into information about a child, please contact us at [email protected] and we will investigate and delete it.
We do not sell personal data, and we do not share it for anyone else's marketing. We use a small number of service providers who process information on our behalf and only on our instructions:
Apple and Google take payment for home learning subscriptions. They do this as independent organisations under their own terms and privacy policies, not on our behalf.
Each of our service providers is bound by a contract that requires them to keep the information secure and to use it only for the purpose we have given them. We may also disclose information if the law requires it, for example in response to a valid court order, or to establish or defend legal claims.
We are a UK company. Your account data (your email address, your sign-in information, your school and the state of any subscription) is stored in Google's European multi-region, on servers in Belgium and the Netherlands, and the app's analytics are stored in the EU. Transfers of personal data from the United Kingdom to the European Economic Area are permitted under UK adequacy regulations.
Some of our providers are established outside the UK and the EEA, and some data is processed outside those areas: crash reports; the subscription records RevenueCat keeps, in the United States; and support access by provider personnel. Where that happens, the transfer is covered by a safeguard recognised under UK law, being the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses in our contracts with those providers. You can ask us for details of the safeguards that apply.
You can delete your account yourself, in the app: open the Parents Area, choose Delete account and enter your password. We then delete your account, your sign-in, your school and the subscription records our providers hold for you, other than anything we are required by law to keep, and the app removes your children and their saved logins from that device.
If you no longer have the app, email [email protected] from the address you signed up with, and we will delete your account and everything listed above within 30 days.
Deleting your account does not cancel a subscription: only Apple or Google can do that. Cancel it first in your Apple ID or Google Play settings, or you may still be charged. The app reminds you of this before you delete.
Information held on the device is kept in the app's protected storage, using the security features the operating system provides. Information sent between the app and our servers is encrypted in transit, and access to account data is limited to the people who need it to run the service. No system can be guaranteed completely secure, but we take these obligations seriously and review them as the service changes.
Under UK data protection law you have the right to ask us for a copy of the personal data we hold about you, to have it corrected if it is wrong, to have it deleted, to ask us to restrict how we use it, to object to our use of it where we rely on legitimate interests, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
To exercise any of these, email [email protected]. We will respond within one month. Exercising your rights is free, and we will not treat you differently for doing so.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would appreciate the chance to put things right first.
The homework services your child uses in LockyLearn are run by other organisations: usually your child's school or its suppliers, or, for home learning, the organisations that publish those sites, such as Oak National Academy and the BBC. Once your child is working inside one of those services, that organisation's own privacy policy applies to what happens there. We do not control those services and we do not receive your child's activity within them.
If we change this policy we will update the date at the top of this page. If the change materially affects how we use your information, we will tell you in the app or by email before it takes effect.
Questions about this policy, or about anything we hold: