Privacy notice

Version 1.0 · Last updated 17 October 2026

This privacy notice is from Zing Performance Ltd (trading as Vast Jr) ("Vast Jr", "we", "us" or "our"). It explains how and why we collect, store, use and share ("process") your personal information when you use our services ("Services"), including when you:

• use the Vast Jr mobile app on iPhone or Android
• take the free Vast Jr check-up on the web
• visit our website at vastjr.com
• contact us or engage with us in other related ways, including sales, marketing and support

Questions or concerns? Reading this notice will help you understand your privacy rights and choices. If you don't agree with our policies and practices, please don't use our Services. If you still have questions, contact us at info@zingperformance.com.

Summary of key points

Table of contents

1. What information do we collect?
2. How do we process your information?
3. What legal bases do we rely on to process your information?
4. When and with whom do we share your personal information?
5. Do we use cookies and other tracking technologies?
6. Is your information transferred internationally?
7. How long do we keep your information?
8. How do we keep your information safe?
9. Do we collect information from children?
10. What are your privacy rights?
11. Controls for Do-Not-Track features
12. Do United States residents have specific privacy rights?
13. Do we make updates to this notice?
14. How can you contact us about this notice?
15. How can you review, update or delete the data we collect from you?

1. What information do we collect?

Personal information you give us

In short: We collect the personal information you give us when you set up and use Vast Jr.

About the parent or guardian:

• name, email address, phone number and country (country sets the time zone for reminders)
• username and password (stored in scrambled form, never as plain text)
• answers to the grown-up questionnaire after each assessment, including any notes you add
• email and notification preferences, and whether you'd like tips and news
• messages you send to our support team

About the child:

• date of birth or age, used to compare results with the right age group
• first name, used in their report and letter
• nickname and chosen animal (the nickname can't be their real name, and we check it before it's used)
• hobbies, if added (optional), used to make the report letter more personal
• assessment results from the memory, listening, attention, speed and balance sessions
• self-reflection answers about things like concentration, memory, coordination, reading and handwriting
• session activity: sessions completed, streaks, badges, points, and how they rate each exercise, including if one hurts

Sensitive information. Self-reflection answers, questionnaire answers and exercise feedback may count as information about a child's health. We process these only with the explicit consent of the child's parent or guardian, and only to tailor the programme and the report.

Payment data. We don't collect payment card details in the app. Payments are handled by Stripe, which processes your payment details under its own privacy policy.

Information automatically collected

In short: Some technical information about your device is collected automatically when you use the Services.

• App: a random ID created on the device, the device type, model and operating system version, the app version, and the device's date and time. We use these to keep you signed in, fix problems and keep the Services secure.
• Web check-up: your IP address and the date and time you took it.
• Website: the technical data any web server receives, such as IP address and browser type.
• Push notifications (iPhone and iPad only): the app includes OneSignal, a push-notification service. When the app's avatar loads, OneSignal creates an anonymous ID for the device and records basic app activity, such as when the app is opened and whether notifications are switched on. This is used to send and measure notifications. It isn't linked to your child's name or account, isn't used for advertising and isn't shared for tracking. The Android app doesn't include OneSignal.

Vast Jr doesn't use location, the camera, the microphone or motion sensors, and it doesn't use advertising IDs.

2. How do we process your information?

In short: We process your information to provide, improve and run Vast Jr, communicate with you, keep it secure and comply with the law.

• To create and manage accounts and keep you signed in
• To deliver the programme: run sessions, score assessments against your child's age group and show their progress
• To write reports, including the optional personal report letter written with AI (see section 4)
• To run the League, where children see each other's nickname, animal and points
• To send reminders you've switched on, such as app notifications for sessions and assessments. We don't send emails at the moment; if we start, you'll be able to choose which ones you get
• To follow up after the free check-up and, if you agree, send tips and news about Vast Jr
• To respond to you and provide support
• To keep the Services secure, prevent misuse and fix problems
• To comply with the law

3. What legal bases do we rely on to process your information?

In short: We only process your personal information when we have a valid legal reason under UK and EU data protection law.

• Performance of a contract: to provide Vast Jr to you, including accounts, sessions, assessments, results, the League and reminders.
• Consent: for the AI report letter and for marketing. You can withdraw consent at any time.
• Explicit consent: for health-related information about your child, given by you as their parent or guardian.
• Legitimate interests: to keep the Services secure, fix problems, improve Vast Jr, answer support requests, and follow up after the free check-up. You can object at any time.
• Legal obligation: to keep records the law requires, or to respond to lawful requests.
• Vital interests: where needed to protect a child's safety.

4. When and with whom do we share your personal information?

In short: We share information only with the service providers who help us run Vast Jr, and in the specific situations below. We never sell it.

• Anthropic (the report letter). If you agree, our server sends your child's first name, age, hobbies, assessment results, self-reflection answers and your questionnaire answers to Anthropic, an AI company, whose AI writes the personal report letter. We never send your email, phone number or address. Anthropic processes this only to write the letter for us, under its commercial terms, and doesn't use it to train its AI models. If you say no, the app shows a short summary instead and nothing is sent. We keep a record of your answer and when you gave it.
• Stripe, which processes payments.
• OneSignal, Inc., which sends and measures push notifications on iPhone and iPad, using an anonymous device ID that isn't linked to your child's name or account. See OneSignal's privacy policy.
• Hosting providers that run our servers, under written contracts that only let them use the information for us: DigitalOcean (the app, accounts and the free web check-up), HubSpot (our sign-up pages) and Cloudflare (this website).
• Vast coaches, only if you agree. Coaching isn't available yet; when it is, we'll ask your permission before a coach can see your child's information.
• Apple and Google, who run the app stores under their own privacy policies.
• Business transfers, if all or part of our business is sold or merged, under this notice.
• Legal and safety reasons, where the law requires it or to protect a child's safety.

The League. Other children using Vast Jr can see your child's nickname, chosen animal and points. Nothing else is shown: no real names, ages, photos or results. There's no chat or messaging between children.

5. Do we use cookies and other tracking technologies?

In short: No advertising and no tracking across other apps or websites. The website sets no cookies. On iPhone and iPad, the app uses an anonymous ID for push notifications.

The vastjr.com website doesn't use cookies or store anything in your browser. It loads typefaces from Google Fonts, so Google receives your IP address. See our cookie policy. The app saves a few things on the phone or tablet so it works smoothly, such as staying signed in (if "remember me" is on), settings, reminder times, and progress waiting to upload when there's no internet. Deleting the app removes them. On iPhone and iPad, OneSignal also stores an anonymous device ID to send and measure notifications (see section 1).

6. Is your information transferred internationally?

In short: Some of our providers are outside the UK, and we protect your information when it's transferred.

Some providers, including Anthropic and OneSignal, are based in the United States. When information leaves the UK, we use the safeguards UK law requires, such as the UK International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, or the UK-US data bridge.

7. How long do we keep your information?

In short: Only as long as we need it for the purposes in this notice, unless the law requires longer.

• Account, results and reports: while the account is open, and 2 years after it closes, unless you ask us to delete them sooner
• Free web check-up details: 12 months, or until you ask us to delete them
• Support emails: 2 years
• Records we must keep by law, such as payment records: 6 years

When we no longer need information, we delete or anonymise it. If that isn't possible straight away, for example because it's in backups, we store it securely and keep it away from any further use until deletion is possible.

8. How do we keep your information safe?

In short: We use organisational and technical measures to protect your information.

We use encrypted connections, limit who can access personal information, and require our providers to protect it. No electronic transmission or storage can be guaranteed to be 100% secure. If something goes wrong that puts your information at risk, we'll tell you and the ICO where the law requires it.

9. Do we collect information from children?

In short: Yes. Vast Jr is designed for children aged 6 to 18, with a parent or guardian in charge.

Each Vast Jr account is for one child, and is set up and managed by their parent or guardian, who makes privacy choices on the child's behalf. By creating an account or starting the check-up, the grown-up confirms they are the child's parent or guardian. For children under 13, we rely on the consent of their parent or guardian.

We design Vast Jr with the ICO's Children's Code in mind: no adverts, no tracking, no location, and the most private settings by default wherever we can. Older children can contact us about their own information, and we'll explain things in a way they understand. If you think we have a child's information without a parent or guardian's agreement, email info@zingperformance.com.

10. What are your privacy rights?

In short: In the UK and EU you have rights that let you access and control your information, and your child's. Requests are free.

• to see a copy of the information we hold
• to correct anything that's wrong
• to have it deleted
• to restrict how we use it, or object to it
• to receive it in a common format (data portability)
• to withdraw consent at any time, for example for the AI letter or marketing. This doesn't affect anything done before you withdrew it.

We'll respond within one month, and may need to check you're the account holder first. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live in the EU, you can complain to your local data protection authority.

Marketing. You can unsubscribe at any time using the link in our emails, or by emailing us.

11. Controls for Do-Not-Track features

Some browsers have a Do-Not-Track setting. There's no agreed standard for responding to it, so we don't currently respond to Do-Not-Track signals. Vast Jr doesn't track you across other websites or apps either way.

12. Do United States residents have specific privacy rights?

In short: If you live in certain US states, you may have the right to know about, correct and delete your information.

Our US business is Zing Performance LLC, 2300 Marsh Point Rd, Suite 302, Neptune Beach, Florida 32266. Depending on your state, you may have the right to know what personal information we collect and how we use it, to access, correct or delete it, and to opt out of its sale or use for targeted advertising. We have not sold personal information, we don't share it for targeted advertising, and we won't treat you differently for using your rights. We'll verify your identity before acting on a request, and you can use an authorised agent. For children under 13, we rely on verifiable consent from a parent or guardian, who can review or delete their child's information at any time.

13. Do we make updates to this notice?

In short: Yes, we update it as needed to stay compliant with the law.

The updated version will have a new date at the top. If we make significant changes, we'll tell you in the app or by email.

14. How can you contact us about this notice?

15. How can you review, update or delete the data we collect from you?

You can update the grown-up's email, phone number and country in the app's profile settings. To delete an account, go to Settings, then Account, then Delete account in the app, or email support@zingperformance.com. We'll confirm with you, then delete the account and its data, apart from anything the law requires us to keep. To see or correct any other information, email info@zingperformance.com.