Privacy policy

Who to contact

Headstart Reader is operated by Mark Harvey. For questions about personal information, access requests or removal of a story, contact markjharvey@hotmail.co.uk.

This notice describes the service as currently implemented. The operator’s full legal business details, formal retention schedule and supplier-specific international transfer arrangements are still awaiting confirmation; this notice will be updated when those details are confirmed.

Accounts and reading preferences

We receive your email address, account identifier, display name and the information your selected sign-in provider supplies. Lovable Cloud handles authentication, password credentials and account storage. We store your chosen plan, subscription status and saved reading colour. Account and subscription information is available to authorised administrators where needed to operate Headstart.

We use this information to provide the service you request (contract), protect accounts and troubleshoot problems (legitimate interests), and meet applicable legal obligations. You do not need to tell us whether you or your child has dyslexia.

Camera, photos and read aloud

Live camera text recognition runs on your device. Camera frames and recognised text from live scanning are not sent to our AI reader unless you explicitly choose “Read with AI”. Camera access requires your browser’s permission, which you can revoke in its settings.

Uploaded photos and photos sent using “Read with AI” go through Headstart’s server to Lovable’s AI service and its model provider to extract text. The app does not save those photos or extracted text to an account database; supplier processing and diagnostic retention may still apply. We have not yet confirmed all supplier retention periods, so do not submit confidential documents, sensitive personal information or identifiable information about children.

Photo processing is used to perform the reading service you request (contract). Read aloud uses your browser or device’s speech service, which may use an online voice provider according to your device settings. The live reader may download recognition software and English language data from external delivery services.

Payments and service emails

Stripe receives the details you enter at checkout, together with your email address and Headstart account identifier. Headstart stores payment customer and subscription references, plan, trial dates and status; full card details are handled by Stripe, not stored in Headstart’s account database. See Stripe’s privacy policy.

We use payment data to administer your subscription (contract), keep legally required financial records (legal obligation), and investigate fraud or disputes (legitimate interests). Lovable’s managed email service processes your address and message contents for account confirmations, welcome emails and trial notices. The operator receives sign-up and trial notices containing the subscriber’s email address. These are service messages, not consent to promotional mailing.

Reviews and parent stories

A parent can submit a chosen name, email address and story without an app account. The email stays private for moderation and contact about the submission. Only approved stories and chosen names are published. Public reviews also show deliberately published names and feedback.

Story publication is based on your permission (consent); moderation and private correspondence use our legitimate interest in handling genuine submissions. You can withdraw publication permission by emailing us. We can remove content from Headstart but cannot guarantee deletion of copies others have already made. Do not include a child’s full name, school, health details or other identifying information.

Visitor analytics

Lovable’s analytics uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors. Lovable collects this data for us. Lovable’s privacy policy explains how it handles it.

With the site’s current settings and no consent banner, clicks and app events are recorded for every visitor. App events include completed sign-ups and camera hold/editor actions, using plan labels and random per-hold identifiers—not camera images or recognised text. Page visits, time on page, page speed and errors are also recorded for every visitor, without cookies and without identifying anyone.

The analytics records pages visited, where visitors came from, country, browser, operating system, device type, duration of visits, page load speed, errors and clicks. Detailed data is kept for 90 days and daily summaries for a year. We use these anonymous statistics to understand and improve the service.

Browser storage and external services

Headstart’s sign-in session is stored in your browser so you can remain signed in. A reading tint chosen while signed out is saved in local storage. Your plan choice can be kept in session storage while you complete sign-in. Clearing browser storage removes these local settings and may sign you out; it does not delete your account.

Google Fonts supplies the site’s fonts and receives ordinary connection information such as your IP address when your browser requests them. Google, Apple and Lovable sign-in providers handle their own sign-in screens under their privacy policies. These services are separate from Lovable’s cookie-free visitor analytics.

Retention, sharing and transfers

Account and preference records currently remain until deletion is arranged; cancelling a subscription does not delete an account. Submitted stories remain pending, declined or published until removed. Payment and email services may keep their own records. Headstart does not yet have a confirmed fixed deletion schedule for these categories; contact us to request removal or details of retention applicable to your information.

We share information with the services described above and authorised people operating Headstart, and may disclose it where the law requires. We do not sell your personal information. Suppliers may process data outside the UK or EEA. The operator still needs to confirm relevant locations and safeguards, such as adequacy decisions or approved contractual clauses; contact us for the current position rather than assuming all data stays in the UK.

Your rights

Where UK GDPR or EU GDPR applies, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. Some rights depend on the legal basis and exceptions such as required financial records.

Email us with your request. We may need proportionate proof of identity and normally respond within one month; complex requests may allow an extension with an explanation. Do not send passwords or payment card details. Headstart does not use automated decisions with legal or similarly significant effects.

You can complain to the UK Information Commissioner’s Office or the data protection authority in your EU country. You do not need to contact us first.

Children and changes

Accounts and paid subscriptions are intended for adults. Children should use Headstart with a parent or carer rather than providing their own account or story details. If a child’s information has been submitted unintentionally, contact us so we can investigate and arrange removal.

We will update this notice when our practices change. Important changes affecting existing personal data will be communicated where appropriate. This page follows transparency topics in ICO guidance; a notice alone is not a guarantee of GDPR compliance.