Privacy policy

1. Who we are

Bright Atoms, at brightatoms.com, is run by FALLINGHIPPO LIMITED, which trades as FallingHippo. In this policy “we”, “us” and “our” mean that company. We decide why and how the personal data described here is used, which makes us its “controller” under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We haven’t appointed a data protection officer. The law only requires one for public bodies and for organisations whose core work involves large-scale monitoring of people or large-scale use of sensitive data, and we do neither. Privacy questions sent to the address above are read and answered by a person.

2. What this policy covers

This policy covers personal data we handle when you:

• visit brightatoms.com or any page on it, including the lessons, the simulations and the periodic table;
• email us, or write to us by post, for example to report a mistake in a lesson.

It doesn’t cover other websites that we link to, such as IUPAC, NIST, PubChem or the exam boards. They are run by other people and have their own policies. Our other websites and apps, such as fallinghippo.com, have their own privacy policies as well.

3. A few terms we use

• Personal data means any information about you from which you can be identified, directly or indirectly. Your name, email address and IP address are all personal data.
• Controller means the organisation that decides why and how personal data is used. For this policy that’s us.
• Processor means a company that handles personal data on a controller’s behalf and only on its instructions, such as our web host.
• Processing means anything done with personal data, including collecting, storing, reading, sharing and deleting it.

4. What we collect and where it comes from

When you visit the site

You don’t have to sign up or give us anything to use Bright Atoms. When your browser asks for a page, a picture or a font, our web host, Cloudflare, automatically receives and logs some technical information, as any web server does. This usually includes:

• your IP address, which can show your approximate location (country or town, never your street);
• the date and time of the request and the page or file requested;
• your browser type and version, operating system and device type, as your browser reports them;
• the address of the page that linked you here, if your browser shares it;
• security information, such as whether a request looks like it comes from an automated attack.

This comes from your device. We don’t combine it with anything else to work out who you are. We don’t download, copy or keep these logs ourselves, and we don’t use them to follow what individual visitors do.

If your browser reports a network problem

Cloudflare asks some browsers to send it a short report when a page fails to load because of a network fault. The report contains the address of the page, your IP address, your browser type and what went wrong. It is sent by your browser, not by any script of ours, only when something has failed, and only by browsers that support the feature. It lets Cloudflare find and fix faults on its network. We don’t see or use these reports.

The simulations and the Motion setting

Everything the simulations do, from dissolving salt to working out moles, is worked out inside your browser. What you type into a simulation, such as a chemical formula in the mole calculator, isn’t sent anywhere and isn’t kept.

If you press the Motion button at the top of a page, the site remembers your choice in your browser’s local storage, so that animation stays off (or on) on the next page and next time. That one word stays on your device. It is never sent to us. Our cookies and storage page has the details and the legal basis.

Because we never receive this information, it isn’t personal data that we hold. We describe it so that you can see exactly what happens.

When you email or write to us

We receive your email address, your name if your email shows it, the content of your message, any attachments, and the technical details that come with any email, such as the time it was sent. If you write by post, we receive your name and address and what you write. We only get what you choose to send. Please don’t send us sensitive information, such as details about your health, unless we’ve asked for it.

What we don’t collect

There are no accounts, comments, forums, quizzes that send results to us, forms, newsletters, surveys or competitions on this site. We don’t use analytics, advertising, social media buttons, embedded videos or fingerprinting. We don’t collect sensitive (“special category”) data such as health, religious beliefs, ethnicity or sexual orientation, and we don’t collect information about criminal convictions. We don’t buy personal data from anyone. Our fonts, pictures and scripts are all served from brightatoms.com itself, so loading a page doesn’t send your details to Google or any other company.

5. How we use it and our lawful basis

Data protection law only lets us use personal data where we have a lawful basis. The table lists every way we use the data in section 4, the basis we rely on and how long we keep it. Section 6 explains our legitimate interests.

You don’t have to give us any personal data to use this site. If you want a reply to a message, we need a way to contact you. We don’t use your data for any purpose that isn’t in this table. If we ever want to use it for a new purpose, we’ll check it’s compatible with the original one, or ask for your consent, and update this policy first.

The Motion setting kept on your device is covered by the Privacy and Electronic Communications Regulations 2003 rather than by a lawful basis under the UK GDPR, because it stays on your device. See section 7.

6. Our legitimate interests

“Legitimate interests” is a lawful basis that lets an organisation use personal data for a genuine reason, as long as that use is necessary and isn’t outweighed by your interests, rights and freedoms. Where we rely on it, we have done this balancing exercise. In summary:

• Running and securing the site. Every website has to receive basic technical information to send pages to your browser. Using it to spot attacks protects you as well as us. The data is limited, short-lived and not used to identify or profile you. Protecting the security of networks and systems is one of the “recognised legitimate interests” listed in the Data (Use and Access) Act 2025.
• Answering messages. If you write to us, you expect a reply. We only use your message for that conversation and the record of it.
• Keeping the lessons accurate. If you tell us about a mistake, you expect us to look at it and perhaps to write back. We keep a note of what was changed and why.
• Legal claims. Keeping relevant records for the time a claim could be made protects both sides.

You have the right to object to any use based on legitimate interests (see section 13). If you’d like a copy of our assessment for a particular use, email us.

7. Cookies and similar technologies

Cookies are small files a website saves on your device. Similar technologies include local storage, pixels and device fingerprinting. The Privacy and Electronic Communications Regulations 2003 (PECR) say a website must ask for your consent before storing or reading anything on your device, unless it’s strictly necessary for a service you asked for or falls within another exception listed in the regulations. Since 5 February 2026 those exceptions include one for adapting how a website looks or works to your preferences, as long as you are told and can easily object.

Bright Atoms sets no cookies. It keeps one small thing in your browser, and only once you press the Motion button: the word “on” or “off”, so that your choice of animation is remembered. The site also reads, inside your browser, whether you have asked your device for reduced motion, and the size of your screen, so that the simulations fit and respect your setting. Neither is sent anywhere. The full account is on the cookies and storage page, and that is why there is no cookie banner.

8. Marketing

We don’t have a mailing list for this site and we don’t send marketing emails. If you email us, we won’t add you to a list. If we ever start a newsletter, we’ll only send it to people who have actively signed up, and every email will have a simple way to unsubscribe, as PECR requires.

9. Who we share it with

We don’t sell personal data, rent it or share it with advertisers. We share it only in the situations below.

Companies that process data for us

These companies act as our processors. They may only use personal data on our instructions and to provide their service to us, under written terms that meet the requirements of Article 28 of the UK GDPR.

Professional advisers

We may share relevant information with our accountants, lawyers and insurers where they need it to advise us or provide their service. They are bound by professional duties of confidentiality and act as controllers in their own right.

The authorities

We’ll disclose personal data to the police, a court, a regulator or another public body if the law requires us to, or where it’s necessary to prevent or detect crime or to protect someone’s safety. We share only what is needed and check that each request is lawful.

If the business changes hands

If we sell or transfer all or part of our business, or merge with another company, personal data may pass to the buyer or new owner, and to their advisers during the process under confidentiality terms. The new owner would have to use it in line with this policy, and we’d tell you if what happens to your data changed.

Other websites

Lessons link to their sources, such as IUPAC, NIST, PubChem and the exam boards. If you follow a link, that site receives your IP address and the address of the page you came from, and its own policy applies from then on. We don’t pass them anything else.

10. Data sent outside the UK

Cloudflare runs a global network and is based in the United States, and Google can process data in the United States and other countries. This means personal data may be transferred outside the UK. UK law allows this only where the destination has been found to give adequate protection, or where a safeguard approved by UK law is in place.

• The UK has made “adequacy regulations” for the countries of the European Economic Area and some others, so data can flow there freely.
• For the United States, both companies take part in the UK Extension to the EU-US Data Privacy Framework, which the UK recognises as giving adequate protection to data sent to certified companies.
• Both companies’ data processing terms also include standard contractual clauses with the UK’s International Data Transfer Addendum, which apply where the Data Privacy Framework doesn’t.

Because Cloudflare serves pages from the data centre nearest to you, your request will usually be handled close to where you are. If you’d like more detail on the safeguard that applies to a particular transfer, email us.

11. How long we keep it

We keep personal data only for as long as we need it for the purpose we collected it for, including any legal, accounting or reporting requirements. The table in section 5 gives the period for each use. When a period ends we delete the data, or anonymise it so it can no longer identify you.

Cloudflare doesn’t publish a fixed retention period for the server logs it keeps when serving a customer’s site. Its privacy policy says it keeps personal information for a period that is consistent with its business purposes and then deletes it. We don’t download, copy or keep these logs ourselves.

The Motion setting stays on your device for as long as you leave it there. We can’t delete it for you, because we never have it, but you can remove it by clearing this site’s data in your browser.

Emails deleted from our mailbox may remain in Google’s backups for a short time before they are permanently removed, in line with Google’s data processing terms.

12. How we keep it safe

We use technical and organisational measures that are appropriate to the risk, including:

• serving the site over HTTPS, and redirecting any request made over plain HTTP, so pages can’t be read or changed on their way to you;
• collecting nothing from you that we don’t need, which is the surest way to keep it safe;
• loading no scripts from anyone else’s servers, and enforcing that with a content security policy;
• limiting access to our mailboxes and accounts to the people who need it;
• keeping passwords in a password manager and never sharing them by email or chat;
• choosing providers that offer strong security commitments and written data processing terms.

No system is completely secure. If a breach of security led to personal data being lost, changed or disclosed, we would assess it straight away. Where the law requires, we’d report it to the Information Commission without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach was likely to put you at high risk, we’d also tell you directly and explain what you can do to protect yourself.

If you think you’ve found a security problem with this site, please tell us at hello@fallinghippo.com.

13. Your rights

The UK GDPR gives you the following rights over your personal data. Some only apply in certain situations, and we’ll explain if one doesn’t apply to your request.

14. How to use your rights

Email privacy@fallinghippo.com with “Privacy request” in the subject line, or write to us at our registered office. Tell us which right you want to use and give us enough detail to find the data, such as the email address you wrote from. You don’t have to use a particular form or particular words, and you can ask someone else, such as a parent, carer or solicitor, to make the request for you with your permission.

• Checking it’s you. We may ask for information to confirm your identity, so we don’t give your data to someone else. We’ll only ask for what we need.
• How long it takes. We’ll respond without undue delay and within one month of receiving your request. If we need to confirm your identity or ask you to clarify the request, the month starts when we get your reply. If a request is complex, or you’ve made several, we can extend this by up to two further months. We’d tell you within the first month and explain why.
• How we search. For access requests, we’ll make reasonable and proportionate searches for your data, as the law requires.
• Cost. It’s free. If a request is clearly unfounded or excessive, we can charge a reasonable fee based on our costs or refuse it. We’d explain why and tell you about your right to complain.
• If we can’t do what you ask. We’ll tell you why, unless the law stops us, and tell you how to complain.
• Server logs. If you ask about data in Cloudflare’s logs, we’ll tell you what we can, but we don’t hold those logs ourselves and can’t search them by visitor. Please include the date, the page and your IP address if you want us to ask Cloudflare.

15. Automated decisions

We don’t make any decisions about you by automated means alone, and we don’t use your data to build a profile of you. The quizzes in the simulations, such as naming the metal from its spectrum, mark your answer inside your browser and keep no score anywhere.

16. Children

Bright Atoms is written for GCSE and A-level students, so many of the people who use it will be children. It is built to need nothing from them. There are no accounts, no ads, no tracking and no way to talk to other visitors, and nothing a child types into a simulation leaves their device. We have kept the ICO’s Age-Appropriate Design Code (the “Children’s code”) in mind in building it: we collect as little as we can, we don’t profile anyone and we don’t use nudges to keep people on the site.

If you are under 13, please ask a parent or carer before you email us. If you’re a parent or carer and believe a child has sent us personal data, email us and we’ll delete it. We never knowingly ask children for personal data.

17. Other websites

This site links to other websites, including the sources of its data and our own other sites. Those sites have their own privacy policies and we’re not responsible for how they use your data.

18. Complaints

If you’re unhappy with how we’ve handled your personal data, please tell us first so we can try to put it right. The quickest way is to email privacy@fallinghippo.com with “Complaint” in the subject. We will:

• acknowledge your complaint within 30 days of receiving it;
• look into it without undue delay and keep you updated on our progress;
• tell you the outcome and what we’ve done about it.

You also have the right to complain to the Information Commission, which regulates data protection in the UK. It took over from the Information Commissioner’s Office (ICO) on 30 September 2026 and still uses the ICO name and website. Its website is ico.org.uk/make-a-complaint and its helpline is 0303 123 1113. It will usually expect you to have raised the matter with us first. You also have the right to go to court if you believe your rights have been breached.

19. Changes to this policy

We review this policy at least once a year and whenever we change how the site handles personal data. If we make a change, we’ll update this page before the change takes effect and change the date at the top. If a change significantly affects how we use data we already hold about you, and we have your contact details, we’ll tell you directly. Earlier versions are available on request.

• 11 November 2026. First version.

20. Contact us

For anything about this policy or your personal data, email privacy@fallinghippo.com. For anything else, email hello@fallinghippo.com. You can also write to FALLINGHIPPO LIMITED, 71-75 Shelton Street, London, England, WC2H 9JQ. That is our registered office address, which is used for official post, so email is quicker.