For school IT and data protection

What this site does with data

Every claim below can be checked from the page source. That is the point of writing it this way.

teenandgrowrich.com is a static companion site for a printed book aimed at readers aged 13 and up. It supplies the book's worksheets, checklists and safety material as web tools. It is not a learning platform, it holds no pupil records, and it has no administrator view of anything.

Verify it yourself, in about two minutes

Open developer tools, reload any page, and work down this list. We would rather you checked than believed us.

No accounts, no login, no registration.: There is no sign-in route anywhere on the site. Nothing is behind a wall, so there is nothing to sign in to.
No cookies are set.: Application → Cookies in developer tools, on any page. The list is empty, including after completing a worksheet.
No analytics, no tag manager, no advertising or social pixels.: Search the page source for the usual script names. There is no third-party script of any kind, so there is nothing to search for.
No third-party requests. Fonts and images are served from this domain.: Network tab, filter by domain. Every request is same-origin. A build step (tools/verify-no-external-hosts.mjs) fails the release if any external host appears in the output.
A Content Security Policy blocks external connections in the browser as well.: Read it in the page source: it is a meta element with http-equiv="content-security-policy", near the top of the head. The policy is deliberately not transcribed onto this page — a copy here would drift out of step with the real one, and the element itself is the authority. What it does is confine the page to this origin: scripts, styles, fonts and images all same-origin, forms unable to post anywhere else, no plugins, no rewritten base URL. One caveat we would rather state than have you find: the CSP specification tells browsers to ignore frame-ancestors when a policy arrives in a meta element, so protection against this site being framed needs a response header from the host, and this page does not claim to have one.
One form, and it carries no personal data.: Search the page source for <form>. There is one form on the whole site, and it appears on two pages — the homepage and the 404 page: a page-number field that GETs to /p/ on this same origin, so a reader holding the printed book can reach a tool without JavaScript. form-action 'self' means no form on this site can ever post to a third party. Nothing anywhere asks a pupil for their name, their email address or anything else about them.
No comments, messaging, profiles or uploads — no user-generated content at all.: There is no route to post anything. This is deliberate: it also keeps the site outside the Digital Services Act's definition of an online platform.

What is written to the device

Two keys in localStorage, both written only in response to something the pupil does, never on page load. Neither is transmitted. Both are visible in Application → Local Storage.

tgr.theme.v1: Dark or light, when a pupil presses the theme button. An explicit preference the pupil asked for.
tgr.log.v1: The pupil's own ticks and typed answers, written only when they act. The work itself. It never leaves the browser, and there is no code path that sends it anywhere.

Clearing site data removes both, and nothing is lost that exists anywhere else, because nothing exists anywhere else. On a shared or managed device the data is gone at sign-out, which is expected rather than a fault. We tell pupils their work iskept in this browser — never that it is kept anywhere else — and every tool can print or copy its output as plain text, so the durable record is the one in the pupil's hand.

What the hosting provider processes

This is the part other privacy pages get wrong. Any hosted website receives the visitor's IP address, User-Agent, the URL requested and a timestamp, and an IP address is personal data under the GDPR. So the accurate statement is: we collect nothing, and our hosting provider processes connection metadata as our processor. "Nothing is processed" would be false for any site on the internet.

Your 24-Hour Build

To be completed before launch — six items, named

The hosting provider is not chosen yet, so this section cannot be written honestly today. Rather than leave you to guess what is missing, here is the exact list that will fill it. If you are reviewing the site and any of these is still unanswered, the page is not finished and you should treat it as such on this one point.

The hosting provider's name, and the country the site is served from.
The provider's own data-processing terms, linked — the document that makes it our processor rather than an independent controller.
Whether any personal data leaves the EEA, and on what transfer basis if it does.
What the access logs actually contain, field by field, rather than the phrase “standard server logs”.
How long those logs are kept before deletion, as a number of days.
Whether logging is switched off entirely, or IP addresses are truncated or hashed before they are written.

Nothing above changes what this site itself collects, which is nothing. It is the provider's processing that is undocumented here, not ours.

The two AI tools, which will be the only exception

Two tools are planned that would send anything off the device: Scam Check, where a reader pastes an offer or message they have been sent, and Shrink My First Step, where a reader types a goal. Neither is live. Both pages exist and both say so on themselves; there is no serverless function behind either, and today nothing on this site sends anything anywhere. When they are switched on:

They will be single-purpose — one input, one structured answer, never a chat window.
Nothing a reader types into them will be stored — not the input, not the output, and no log of either.
They will run only when a reader chooses to use them. No page will call them on load.
Every other page and tool on the site will work whether or not those two are available, exactly as it does now.
Each will carry a visible notice that it uses AI, and fixed referral wording for messages about self-harm, abuse, grooming or blackmail.

If your filtering policy is to block them, blocking those two routes does not affect anything else here.

Crawlers

The robots file disallows nothing and blocks no crawler, and it names the AI crawlers as allowed rather than leaving it implied — OAI-SearchBot, GPTBot, ChatGPT-User, PerplexityBot, ClaudeBot, Claude-Web, Google-Extended, Applebot-Extended and CCBot. Teachers increasingly find material through an assistant rather than a search box, and since the site collects nothing, there is nothing for a crawler to expose. It also carries a Sitemap line, and the sitemap is at/sitemap.xml.

Age

The book is written for readers aged 13 and up. There is no age gate because there is nothing to gate: no account, no profile, no personalization, and no processing that depends on knowing who the reader is. Nothing on the site is locked behind a payment or an email address either.

Contact

One adult-monitored mailbox, linked in the footer of every page. There is no contact form anywhere on this site, and there will not be one — a form would be a way for a 13-year-old to send us personal data, which is the thing this site exists not to do. Nobody reads that mailbox urgently, and it is not a crisis service.

For the teacher rather than the reviewer

Printing and photocopying

Yes — print or photocopy these worksheets for your class, free, no permission needed.

That covers the worksheets, the 19 builds and the tools. It also covers running them in a lesson, a club, a library session or at home. You do not need to ask, you do not need to tell us, and there is nothing to buy first.

Two limits, and they are the only two. The material may not be sold or included in any paid program. And the 19 Reality Checks — the safety paragraphs — may be copied but not altered, because an edited safety warning that still carries the book's name is the one thing here that could do real harm. The full wording is onthe terms page.

The print stylesheets are built for this. Every printable page reverts to the book's own layout in black on white, and the three colored boxes stay distinguishable on a monochrome photocopier by border weight and style as well as by tint.