Privacy policy

Version 2026-10-21 · Applies to NeuroStar, operated by Wellon Chou Coaching, Singapore.

NeuroStar is a family app. It holds information about children, so we keep this notice short, specific and honest. It explains what we collect, why, who can see it, how long we keep it, and how to have it removed. It follows Singapore's Personal Data Protection Act (PDPA).

1. Who is responsible

Wellon Chou Coaching runs NeuroStar and is the organisation responsible for your data. Our Data Protection Officer can be reached at wellonchou.rightbrain@gmail.com. Write there for any question, request or complaint about personal data.

2. What we collect

Parents and trainers: name, email address, password (stored only as a one-way hash), phone number if you add it, and what a trainer teaches.
Children: first name or nickname, an avatar, school and level if the parent adds them, the weekly timetable, tasks and check-ins, stars earned and spent, reward requests, trainer attendance notes and ratings, homework, and any photo or file a child attaches as proof of a task.
Usage: when you sign in, which pages you open, and technical logs needed to keep the service running and secure. We do not use advertising trackers.

We ask for the minimum needed. A child's date of birth, address and identity numbers are never requested.

3. Why we use it

To run the app: show timetables, record tasks and stars, pass lesson notes between trainers and parents, and let children redeem rewards their parent or trainer approves.
To keep accounts safe: sign-in, lockout after failed attempts, and security logs.
To contact you about your account and the service, for example a password reset or an approval waiting for you.
Only if you opt in: to tell you about Wellon Chou Coaching programmes, workshops and membership offers. You can switch this off at any time in Account, and every such message has an unsubscribe link.

We never sell personal data and never share it with advertisers.

4. Children

Children use NeuroStar with a login code and PIN created by a parent or trainer; they do not give us an email or phone number. Everything about a child is visible to the parents in that child's family and to the trainers the family has linked, and to nobody else. A parent can remove a child at any time, which deletes the child's records, or hand a trainer-added child back to the trainer, which deletes the family's part of the records. By adding or claiming a child you confirm you are their parent or legal guardian and consent on their behalf.

5. Who can see what

Parents in the same family see all of their children's information.
Trainers see only the children linked to them: the lessons they teach, their own notes, the child's practice tasks they set, and the child's star balance with them. They do not see home tasks, family rewards or other trainers' notes.
Children see their own timetable, tasks, stars and shop.
Wellon Chou Coaching staff see data only when needed to support you or fix a problem, and are bound by this notice.

6. Where it is stored and who processes it

Data is stored in Singapore with these processors, each under their own data-protection terms: Vercel (hosting), Neon (database) and Vercel Blob (uploaded files). Email is sent through a transactional email provider. These providers process data on our instructions and do not use it for their own purposes.

7. How long we keep it

While an account or child is active, we keep the records so the history is useful.
When a parent removes a child, the child's records are deleted immediately; backups expire within 30 days.
When you delete your account, your personal data is deleted within 30 days, except what we must keep by law.
Accounts with no sign-in for 24 months are deleted after an email warning.

8. Your rights

You can ask to see, correct or delete the personal data we hold about you or your child, withdraw consent to marketing, or withdraw consent entirely by deleting your account. Email the Data Protection Officer and we respond within 30 days. Most of this you can also do yourself in the app: Account for your own details and marketing choice, the child's Settings for their details and removal.

9. Security

Connections are encrypted, passwords and PINs are stored as one-way hashes, accounts lock after repeated failed sign-ins, and uploaded files are served only to the family and trainers allowed to see them. If a breach affects you or your child, we will tell you and the Personal Data Protection Commission as the law requires.

10. Changes

If this notice changes in a way that matters, we will show the new version when you next sign in and ask you to accept it again. The version date at the top always tells you which notice you agreed to.