For school IT and data protection

What this site does with data

Every claim below can be checked from the page source. That is the point of writing it this way.

teen-andgrowrich.com is a static companion site for a printed book aimed at readers aged 13 and up. It supplies the book's worksheets, checklists and safety material as web tools. It is not a learning platform, it holds no pupil records, and it has no administrator view of anything.

Verify it yourself, in about two minutes

Open developer tools, reload any page, and work down this list. We would rather you checked than believed us.

No accounts, no login, no registration.: There is no sign-in route anywhere on the site. Nothing is behind a wall, so there is nothing to sign in to.
No cookies are set.: Application → Cookies in developer tools, on any page. The list is empty, including after completing a worksheet.
No analytics, no tag manager, no advertising or social pixels.: Search the page source for the usual script names. There is no third-party script of any kind, so there is nothing to search for.
No third-party requests. Fonts and images are served from this domain.: Network tab, filter by domain. Every request is same-origin. A build step (tools/verify-no-external-hosts.mjs) fails the release if any external host appears in the output.
A Content Security Policy blocks external connections in the browser as well.: Read it in the page source: it is a meta element with http-equiv="content-security-policy", near the top of the head. The policy is deliberately not transcribed onto this page — a copy here would drift out of step with the real one, and the element itself is the authority. What it does is confine the page to this origin: scripts, styles, fonts and images all same-origin, forms unable to post anywhere else, no plugins, no rewritten base URL. One caveat we would rather state than have you find: the CSP specification tells browsers to ignore frame-ancestors when a policy arrives in a meta element, so protection against this site being framed needs a response header from the host, and this page does not claim to have one.
One form, and it carries no personal data.: Search the page source for <form>. There is one form on the whole site, and it appears on two pages — the homepage and the 404 page: a page-number field that GETs to /p/ on this same origin, so a reader holding the printed book can reach a tool without JavaScript. form-action 'self' means no form on this site can ever post to a third party. Nothing anywhere asks a pupil for their name, their email address or anything else about them.
No comments, messaging, profiles or uploads — no user-generated content at all.: There is no route to post anything. This is deliberate: it also keeps the site outside the Digital Services Act's definition of an online platform.

What is written to the device

Two keys in localStorage, both written only in response to something the pupil does, never on page load. Neither is transmitted. Both are visible in Application → Local Storage.

tgr.theme.v1: Dark or light, when a pupil presses the theme button. An explicit preference the pupil asked for.
tgr.log.v1: The pupil's own ticks and typed answers, written only when they act. The work itself. It never leaves the browser, and there is no code path that sends it anywhere.

Clearing site data removes both, and nothing is lost that exists anywhere else, because nothing exists anywhere else. On a shared or managed device the data is gone at sign-out, which is expected rather than a fault. We tell pupils their work is kept in this browser — never that it is kept anywhere else — and every tool can print or copy its output as plain text, so the durable record is the one in the pupil's hand.

What the hosting provider processes

This is the part other privacy pages get wrong. Any hosted website receives the visitor's IP address, User-Agent, the URL requested and a timestamp, and an IP address is personal data under the GDPR. So the accurate statement is: we collect nothing, and our hosting provider processes connection metadata as our processor. "Nothing is processed" would be false for any site on the internet.

Who serves this site, and from where?: Vercel Inc. The edge node that answered is named in the X-Vercel-Id response header on every request. At the time of writing it is fra1 — Frankfurt, inside the EEA. You can check it yourself: open the network tab, reload, and read the response headers on the document request.
What does this site send them about a reader?: Nothing this site chooses to. There is no analytics call, no beacon, no third-party request and no cookie set by us. What reaches the host is what reaching any web server requires: the request itself.
Is Vercel our processor rather than an independent controller?: Yes. Their data-processing terms are public and linked below, and they are the document that makes that so.
Can data leave the EEA?: Vercel Inc. is incorporated in the United States, so the possibility exists even when a request is served from Frankfurt. The transfer terms are in the same document. We are not going to summarise someone else's legal mechanism in one line here; read it, or ask us and we will point at the clause.

Vercel's data-processing terms: vercel.com/legal/dpa. That is an outbound link: nothing is requested from it until you choose to follow it, so the "open the network tab and check" claim on this page still holds.

Your 24-Hour Build

Still open — two items, named

These are facts about someone else's system, and a number invented here would be worse than a gap. If you are reviewing this site and either is still unanswered, treat the page as unfinished on this one point and ask us.

What the access logs actually contain, field by field, rather than the phrase “standard server logs”.
How long those logs are kept before deletion, as a number of days, and whether IP addresses are truncated or hashed before they are written.

Neither changes what this site itself collects, which is nothing. It is the provider's processing that is not yet documented here, not ours.

The two AI tools, which will be the only exception

Two tools are planned that would send anything off the device: Scam Check, where a reader pastes an offer or message they have been sent, and Shrink My First Step, where a reader types a goal. Neither is live. Both pages exist and both say so on themselves; there is no serverless function behind either, and today nothing on this site sends anything anywhere. When they are switched on:

They will be single-purpose — one input, one structured answer, never a chat window.
Nothing a reader types into them will be stored — not the input, not the output, and no log of either.
They will run only when a reader chooses to use them. No page will call them on load.
Every other page and tool on the site will work whether or not those two are available, exactly as it does now.
Each will carry a visible notice that it uses AI, and fixed referral wording for messages about self-harm, abuse, grooming or blackmail.

If your filtering policy is to block them, blocking those two routes does not affect anything else here.

Crawlers

The robots file disallows nothing and blocks no crawler, and it names the AI crawlers as allowed rather than leaving it implied — OAI-SearchBot, GPTBot, ChatGPT-User, PerplexityBot, ClaudeBot, Claude-Web, Google-Extended, Applebot-Extended and CCBot. Teachers increasingly find material through an assistant rather than a search box, and since the site collects nothing, there is nothing for a crawler to expose. It also carries a Sitemap line, and the sitemap is at /sitemap.xml.

Age

The book is written for readers aged 13 and up. There is no age gate because there is nothing to gate: no account, no profile, no personalization, and no processing that depends on knowing who the reader is. Nothing on the site is locked behind a payment or an email address either.

Contact

One adult-monitored mailbox, linked in the footer of every page. There is no contact form anywhere on this site, and there will not be one — a form would be a way for a 13-year-old to send us personal data, which is the thing this site exists not to do. Nobody reads that mailbox urgently, and it is not a crisis service.

For the teacher rather than the reviewer

Printing and photocopying

Yes — print or photocopy these worksheets for your class, free, no permission needed.

That covers the worksheets, the 19 builds and the tools. It also covers running them in a lesson, a club, a library session or at home. You do not need to ask, you do not need to tell us, and there is nothing to buy first.

Two limits, and they are the only two. The material may not be sold or included in any paid program. And the 19 Reality Checks — the safety paragraphs — may be copied but not altered, because an edited safety warning that still carries the book's name is the one thing here that could do real harm. The full wording is on the terms page.

The print stylesheets are built for this. Every printable page reverts to the book's own layout in black on white, and the three colored boxes stay distinguishable on a monochrome photocopier by border weight and style as well as by tint.