Privacy Policy

Draft published 11 August 2026 · factually expanded 25 August 2026 · Progress Path Ltd · provisional, awaiting UK solicitor review

Who we are

Progress Path Ltd, a company registered in England and Wales, number 17318199. Fay Birmingham is the founder and the person you will hear from directly.

What we collect

When you apply to become a Founding Family, join the waitlist, or apply as a school or fostering agency, we collect the information you give us in that form. For a family that is your first name, surname, contact number, email address and, if you choose to fill it in, your children’s ages. The ages box is optional and the form works without it. For a school or fostering agency it is your name, role, organisation name, organisation type, registration number if you have one, postcode, work email and an optional phone number.

Why we collect it

We use this information to reply to your application, keep you updated on the Founding Family programme, and let you know when Progress Path launches. We do not use it for anything else.

Where it is stored

Sign-up information is stored in Mailchimp, our email platform, which is used only to send you updates you have asked for. We do not sell, rent or share your information with any third party for marketing purposes.

Children’s information

This site is intended for parents, guardians, and school or fostering agency professionals. We do not knowingly collect personal information directly from children through this site. If your child’s name appears anywhere in your application, it is only because you have chosen to include it.

Schools and fostering agencies

If your child’s school or fostering agency becomes a Founding School partner, a separate, parent-controlled sharing model applies to what the school can see about your child. You choose what is shared, from a simple note with no access to family information at all, up to one specific thing you choose to share for a set period and purpose. There is no option to share everything, and you can withdraw access at any time. Full detail is on our Data Use page. This model has not launched publicly, and it remains subject to a solicitor’s review and a signed agreement with each partner school.

Your rights

You can ask us what information we hold about you, ask us to correct it, or ask us to delete it, at any time. Every email we send includes an unsubscribe link, or you can email admin@progresspath.uk directly.

Changes

As Progress Path moves from testing towards public launch, this policy will be reviewed properly and expanded. We will let you know if anything material changes.

The Progress Path app (staging testing)

The sections above describe this website. During the Founding Family testing phase there is also a staging version of the Progress Path app. If you take part in that testing, the app processes the following, all created by you or your family and private to your family account:

• Adult accounts and your family record. You sign in with an email address and password. Your family's setup answers, routines, observations, reflections and reward history are kept as an authenticated family record in our database. One account is one family.
• Child profiles and child device access. You, the parent or carer, create each child's profile (name or nickname, age, date of birth, an optional gender word and an education setting). A child never creates an account. A child's device connects only through a device code you generate; it gives that child a restricted view of their own day, rewards, messages and their own media, checked by our server every time, and you can cancel every child device code at any time.
• Family roles, invitations and permissions. You can invite another trusted adult by email. Invitation links are single use, expire after 7 days, can be resent at most three times a day and can be revoked. An invited adult sees only the children and the permission level you chose, and you can revoke their access. An invited adult may have been given access to more than one family. They see one family at a time, and never information from one family while in another.
• Database and private storage. The family record, profiles and permissions are held in Supabase (our database, sign-in and storage provider), hosted in London (AWS eu-west-2). Media files are held in private storage areas that are never publicly accessible.
• Proud Moments photographs and documents. Images or PDF files of up to 4 MB each, stored in a private bucket, visible only to your family's signed-in adults and, for a child's own items, that child's device. A Proud Moment shared with a school shows only its title, its category and its date. The photograph itself is never included, and there is no route in Progress Path that shares one.
• Voice notes. Short recordings of up to 120 seconds and 3 MB each, stored in a private bucket with the same access rules.
• Faith and reflection preferences. If you choose faith-aware wording, that choice can reveal religious belief, which UK law treats as special category data. The condition for processing it is marked below as awaiting solicitor review. Choosing "None of these" stores only that choice and creates no faith placements.
• Behaviour, emotional growth, routine and school information. Your private observation notes, positive-week records, daily routines, feelings practice and school-day records, entered by you or shared by your child inside the app. Children never see observation notes or scores.
• Invitation email delivery. Invitation emails are sent through Resend (processed in Ireland) from notify.progresspath.uk. The email contains only the invitee's address, the inviting grown-up's chosen name and relationship word, and the invitation link. No child's name or family content is included, and open or click tracking is switched off.
• Audit information and operational metrics. The app keeps an audit trail of significant account actions (who did what and when, without child content) and content-free operational events (for example "setup completed"), with the family identifier stored only as a one-way hash.
• Retention and automated deletion. Security audit records are kept for 365 days and operational metrics for 90 days; a daily automated job deletes anything older. These are staging and pilot defaults and will be reviewed, with a data protection impact assessment, before any production launch.
• Export and deletion. From Settings you can download your family's record as a file, and you can permanently delete the whole family (a typed confirmation is required; photographs and voice notes are deleted first). You can also permanently delete a single child's profile from Settings: the deletion is named, explained and confirmed by typing the child's name, the child's photographs and voice notes are deleted first, the child's device codes stop working immediately, and everything about the rest of your family stays exactly as it is. If you would rather we do it for you, email admin@progresspath.uk.

Who processes app information, and where

No live feature of the app uses artificial intelligence. The pack suggestion at the end of setup is deterministic logic applied to the answers you gave, and it is shown to you with its reasons.

Consent and lawful basis

Applying to become a Founding Family is an application to take part; it is not, by itself, consent to every form of processing described above. The precise lawful basis for each purpose under Article 6 of UK GDPR, the condition for special category data under Article 9 (for example faith preferences and sensitive wellbeing information), the appropriate policy document requirement under the Data Protection Act 2018, and our ICO registration position are all awaiting UK solicitor review and will be confirmed and published before any public launch.