Privacy policy
The Quiet Isles is made for children, so we collect as little as we can.
Last updated 15 September 2026
Who we are
The Quiet Isles is run by QUITE RIGHT LIMITED, a private limited company registered in England and Wales, company number 17053815. Registered office: Mansion House Lodge, Canynge Road, Bristol, England, BS8 3LJ.
We are the controller of the personal data described here. For any privacy question or request, email team@thequietisles.com.
Our approach
- Accounts belong to grown-ups. Children do not have their own accounts.
- There is no advertising and no third-party tracking or analytics.
- We do not sell personal data or share it for marketing.
- The app does not record your child's voice. It has no camera, location, chat or social features.
What we collect
Account details. Your email address and your password. We store the password only as a secure hash that we cannot read.
Details about your child. The first name or nickname you enter, and their reading level and reading mode. The name labels your child's reading lines in the books. You can use a nickname if you prefer.
Reading activity. Which books were downloaded and to which device, books finished and the story route taken, keepsakes and other rewards earned in the books, and your reading settings. This lets your progress follow your account across devices.
Sign-in and security data. For website sign-ins, your IP address, browser type and the time of the session. For the app, a device name and a sign-in token, which we store only as a hash. We also keep short-lived counts of failed sign-in attempts to stop password guessing.
Payments. Stripe takes your card details. We never see or store them. Stripe tells us your subscription status, plan and renewal date, or that you bought lifetime access, and we keep your Stripe customer ID.
Schools. If a school subscribes, we keep the school's name and which student accounts it created. The school gives us each student's email address and a password, which we store only as a secure hash.
Referrals. If a friend referred you, we keep which member referred you. If you join the referral programme, we keep your code, how many friends joined with it and your earnings. When someone opens a referral link, we record the visit with a scrambled form of the IP address, so we can count visits and stop misuse.
Emails. If you email us, we keep the message and our reply.
How we use it
| Use | Lawful basis (UK GDPR) |
|---|---|
| Running your account, signing you in on your devices, delivering books, and syncing settings and progress | Contract |
| Showing your child's name and using their reading level in the books | Contract. You give it for this purpose as the parent or carer. |
| Taking subscription payments and renewals | Contract |
| Running the referral programme: recording referrals, working out earnings and checking for self-referral | Contract, and legitimate interests for the checks |
| Sending service emails, such as password resets, and replying to you | Contract |
| Keeping the service secure, preventing misuse and fixing faults | Legitimate interests |
| Counting overall use, such as how many books are finished, from our own records | Legitimate interests |
We do not make automated decisions about you that have legal or similarly significant effects. We do not send marketing emails.
Who we share it with
We use a small number of service providers. They process data only on our instructions.
- Railway Corporation hosts the website, the app service and the database. Its servers are in the United States.
- Purelymail hosts our email.
- Stripe takes subscription payments and will pay referral earnings. For some payment data Stripe is a separate controller under its own privacy policy.
If we add a provider, we will update this list first.
We may also share data if the law requires it, to protect people's safety, or as part of a sale or restructure of our business. A new owner would have to protect it in the same way.
International transfers
Our hosting provider stores data in the United States. When personal data leaves the UK, we rely on the safeguards UK law requires, such as the UK International Data Transfer Addendum or the UK–US data bridge.
How long we keep it
- Account, child details, settings and reading activity: while your account is open. When you close your account, we delete them within 30 days. Copies in backups are removed as those backups expire.
- Website sign-ins: expire after 30 days.
- App sign-ins: until you sign out, reset the app or the sign-in expires.
- Failed sign-in counts: a few minutes.
- Emails with us: up to 2 years after the conversation ends.
- Payment and referral earnings records: 6 years after the payment, as UK tax law requires.
- Referral link visits: 13 months.
Information stored on your device
The app keeps your reading settings, downloaded books and anything waiting to sync on your device. If you choose Remember me on Windows, your sign-in token is encrypted by Windows. Your password is never saved. The web version stores downloaded books in your browser's storage. See the cookie policy.
Security
Passwords and sign-in tokens are stored only as secure hashes. All connections use HTTPS. Only the people at QUITE RIGHT LIMITED who run the service can see account data. Sign-in attempts are rate-limited.
Your rights
You have the right to get a copy of your data, to correct it, to have it deleted, to restrict or object to how we use it, and to move it to another service.
Email team@thequietisles.com to use any of these rights. We will reply within one month. You can change your child's name, reading level and settings yourself in the app, and reset reading progress in Settings.
These rights cover your child's data too.
If you are unhappy with how we use your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
We follow the ICO's Age Appropriate Design Code. Children use the service with a grown-up's account. We only collect the few details a book needs to address your child. If you believe a child has created an account, email us and we will delete it.
Changes
If we make important changes to this policy, we will email account holders before they apply.