Updated 18 October 2026.
What we collect
The initial assessment needs no account. Further tests require a parent or carer account: we use the adult’s email address for sign-in. We do not ask for a child’s name, email, date of birth or school. Answers are processed to check your work. In the MySQL edition, the server checks answers but does not keep pupil-level results. Hosting services may process routine connection and security logs, including IP addresses.
Optional Google and Facebook sign-in
When enabled and chosen by a parent or carer, Google or Facebook authenticates the adult account. We store its provider identifier and adult email address for sign-in. We do not request contacts, posts or a child’s profile. The essential bs_oauth cookie lasts up to ten minutes to protect the sign-in redirect. Provider privacy policies apply on their sign-in pages. Existing accounts are not automatically linked by email.
Optional parent result emails
Result emails are off by default. A parent or carer can opt in at sign-in or later under My account, then confirm ownership of the account email address. Once delivery is configured and the address confirmed, completed tests can email scores, subject breakdowns and suggested next steps. Assessment emails do not contain correct answers. We store the preference, its consent date and version, and email-verification details in MySQL. A private delivery queue holds email summaries for up to seven days; message content is removed after sending, cancellation or permanent failure. The delivery provider processes recipient addresses and email content under its own retention terms. Results are not emailed for anonymous assessments. Turn emails off in My account or through the link in a result email. These summaries are separate from optional browser progress storage; no child’s name is requested. Email delivery is awaiting setup.
Remembering sign-in
Parents and administrators can choose Remember me for 30 days. This essential HttpOnly cookie keeps that device signed in until expiry or sign-out; clearing cookies also removes it. Without Remember me, the sign-in cookie is session-only. Social sign-in uses a temporary essential bs_oauth_remember cookie for up to ten minutes to carry this choice through the provider redirect.
Question problem reports
You can report an unclear question, a possible answer error or a display issue without giving your name or email. The question reference, test mode, issue type and optional description are stored in MySQL for administrator review. Please do not include personal information. Reports do not change test scores or reveal answers.
Reading preferences
Reading options let you choose a background, font, text size, spacing and reduced motion. They are applied for the page visit unless you explicitly select Remember these reading settings on this device, which stores only your chosen settings in sproutsteps-reading-options until you restore defaults, turn remembering off or clear browser storage. This is separate from progress and advertising choices. No diagnosis or account is required.
Storage on your device
brightsteps-consent-v2 stores your choices and their date, for up to 180 days before we ask again. brightsteps-progress stores up to 100 completed practice/assessment summaries only if you accept progress storage. It includes scores, subjects, completion times and assessment subject breakdowns. It stays until cleared, permission is withdrawn, or browser data is removed. Unfinished tests remain in memory for the current page visit. Nothing is sent to an advertiser from these progress records. In the password-account edition, the essential bs_session cookie keeps sign-in working for this browser session, or up to 30 days when Remember me is selected. The hosted preview uses its platform’s sign-in and security cookies. The essential bs_initial marker remembers for up to one year that this browser has used the free assessment; it does not contain a name or email.
Google advertising — planned
We intend to fund free tests with Google AdSense. Advertising is currently disabled. When enabled, Google and its listed partners may use cookies or similar storage for advertising delivery, fraud prevention and measurement, subject to the consent choices shown by the certified advertising consent service. Child-restricted treatment and non-personalised advertising are required for this site; non-personalised ads can still use cookies. This storage popup does not grant advertising consent.
Before advertising launches, the site owner must complete the child-directed setup, appropriate parental-consent arrangements, a verified list of active cookies and vendors, and the owner’s contact details. No live ad integration is authorised by a child merely pressing this popup’s buttons.
How Google uses information from partner sites ↗ · Google’s cookie information ↗
Home-screen app storage
The optional home-screen app keeps a public connection-help page and app artwork available if the connection fails. This app cache does not contain question API responses, answers, account details, scores or management pages. Installing does not automatically copy progress saved in another browser. Remove stored website data in your browser or device settings to clear the app cache; removing the app icon alone may not clear website data.
Changing your mind
Use Cookie settings in the footer. Turning off progress storage deletes the stored progress from this browser. My progress can also clear it. Rejecting optional storage never blocks practice. Once the Google consent service is configured, Advertising choices will reopen its settings; browser controls can remove third-party cookies already stored.
Children and shared devices
These tests are designed for children. A parent or carer should help with privacy choices. Other people using the same browser may see saved scores. No advertising appears inside assessment questions.
Contact and rights
Bright Reasoners is currently in preview. For privacy requests, use the contact information provided by the person or organisation that directed you to this service. The operator’s direct privacy contact and full account-support details will be published before independently hosted registration or advertising is enabled. UK privacy guidance is available from the Information Commissioner’s Office ↗.