🔒 Privacy, in plain words

Draft for review. This describes how the software is built to behave. It has not been reviewed by legal counsel and is not a final privacy policy or a statement of legal compliance in any country. Version draft-2026-10-11.

For kids 🧒

You don't need to tell us your name to play.
The stars you win are kept on your own device. We can't see them.
Only a grown-up can make an account.
We never ask for your photo, your address or your birthday.
If something online ever makes you feel worried, tell a grown-up you trust.

Who runs this site

The company or person responsible for this site will be named here before launch. A privacy contact address will be added here before launch.

Children

Children don't need an account. We collect nothing about children who browse, play or draw without signing in.
Accounts are for parents and guardians aged 18 or over. When a parent signs up they confirm this, and accept these terms, and we keep a record of when they did.
We never ask for a child's name, photo, birth date, address or contact details. Optional “learner” profiles are a nickname and a learning stage, entered by a parent.
We don't show advertising, we don't track what children do across sites, and we don't build profiles of children to target them.
Children's progress (stars, practice days, games they make) is kept in the browser on the device they use. It is not sent to us.
Drawings stay in the browser unless a parent signs in and saves them. Saved drawings are private to that parent.

What we keep, why, and for how long

This list is built from the same source our developers use, and a test fails if a new kind of data is added without being listed here.

Parent account
Kept:
our database
What:
name; email address; a one-way scrambled (hashed) password, never the password itself; language; preferences (suggestions on or off, weekly summary on or off, default learning stage); when the account was made and last used; whether the email is confirmed.
Why:
To let a parent sign in and keep their saved things.
Who else sees it:
Nobody. Our email provider sees the address when we send a confirmation or reset email.
How long:
Until the parent deletes the account. An account whose email was never confirmed and that nobody ever signed back in to is removed after 30 days.
How to remove it:
Settings & privacy, Delete account.
Record of the parent's confirmation
Kept:
our database
What:
the moment they confirmed they are a parent or guardian aged 18 or over; the moment they accepted the Terms and Privacy notice; which version of those texts they accepted.
Why:
To be able to show that an adult created the account and what they agreed to.
Who else sees it:
Nobody.
How long:
As long as the account exists.
How to remove it:
Deleted with the account.
Learner profiles
Kept:
our database
What:
a nickname; a learning stage (for example 6 to 8).
Why:
To tailor suggestions if a parent switches them on.
Who else sees it:
Nobody.
How long:
Until the parent removes the learner or deletes the account.
How to remove it:
Settings & privacy, Learners. We ask for a nickname, never a full name, photo or birth date.
Favorites and collections
Kept:
our database
What:
which games and stories were saved; names of collections.
Why:
So a parent can find things again.
Who else sees it:
Nobody.
How long:
Until removed or the account is deleted.
How to remove it:
Account pages, or delete the account.
Saved drawings
Kept:
our database
What:
the picture file; its title, type, size and date.
Why:
So a parent can keep a child's drawing.
Who else sees it:
Nobody. Private to the parent who saved it.
How long:
Until deleted or the account is deleted (the file is deleted too).
How to remove it:
Gallery, or delete the account.
Plan and access
Kept:
our database
What:
which plan, its status and dates; which features it unlocks; a reference from the payment provider once one is connected.
Why:
To unlock Premium content.
Who else sees it:
A payment provider, once one is connected. We do not store card numbers.
How long:
As long as the account exists.
How to remove it:
Deleted with the account.
Leaderboards (optional)
Kept:
our database
What:
a computer-made nickname such as Brave Panda 482; the star total for each Premium game.
Why:
Friendly rankings, only if a parent opts in.
Who else sees it:
Other Premium families see only the made-up nickname and the stars.
How long:
Until the parent leaves the leaderboard or deletes the account.
How to remove it:
Leave the leaderboard on any game page (this deletes all scores), or delete the account.
Sign-in helper links
Kept:
our database
What:
a scrambled copy of the one-time link sent for email confirmation or password reset; when it expires and was used.
Why:
To confirm an email address or reset a password safely.
Who else sees it:
Nobody.
How long:
Removed 7 days after it expires or is used.
How to remove it:
Removed automatically.
Abuse protection counters
Kept:
our database
What:
a one-way scrambled code made from an IP address, an email address or an account (we cannot turn it back into the address); a count of attempts in a time window.
Why:
To slow down people who guess passwords or flood the sign-up form.
Who else sees it:
Nobody.
How long:
24 hours.
How to remove it:
Removed automatically.
Reports about content
Kept:
our database
What:
the reason and any words the person typed; which item it is about; the account that sent it, if signed in; the status.
Why:
So our team can review something a family flags.
Who else sees it:
Only our review team.
How long:
Open reports are kept until handled. Resolved or dismissed reports are removed after 365 days (1 year).
How to remove it:
Removed automatically; the link to the account is cut if the account is deleted.
Record of administrator actions
Kept:
our database
What:
which administrator did what, to which item, and when.
Why:
Accountability and handling abuse.
Who else sees it:
Only administrators.
How long:
730 days (about 2 years).
How to remove it:
Removed automatically.
Sign-in cookie
Kept:
this device's browser
What:
a signed token that says which account is signed in.
Why:
To keep a parent signed in. It is strictly necessary for signing in.
Who else sees it:
Nobody.
How long:
7 days, or until the parent signs out.
How to remove it:
Sign out, or clear the browser's cookies.
Language choice cookie
Kept:
this device's browser
What:
the language a visitor picked.
Why:
To show the site in the language they chose. The choice is the visitor's own and is only used for that.
Who else sees it:
Nobody.
How long:
1 year, or until the cookie is cleared.
How to remove it:
Clear the browser's cookies for this site.
Learning progress on this device
Kept:
this device's browser
What:
stars and levels for lessons and games; which days something was finished (dates only, no times); learner profile nicknames; games a child made and saved; stories a child wrote and saved in Story Studio; language and sound choices.
Why:
So children keep their progress and parents can see a progress report.
Who else sees it:
Nobody. It never leaves the device.
How long:
Until a parent clears it or the browser's site data is cleared. Activity days are kept for 120 days.
How to remove it:
Settings & privacy, Erase everything stored on this device. Or the Progress report's clear buttons.
Animations made on this device
Kept:
this device's browser
What:
the pictures a child draws in the Animation Studio (the frames, speed, scene and a name for each saved animation); a count of finished animations and which animation challenges were completed, for certificates.
Why:
So a child's animation is still there when they come back, and so certificates can be earned.
Who else sees it:
Nobody. It never leaves the device unless a signed-in parent saves a copy to their private gallery.
How long:
Until a parent clears it or the browser's site data is cleared.
How to remove it:
Settings & privacy, Erase everything stored on this device. Or the Animation Studio's Start over button for one animation.
Bot check on sign-up and sign-in
Kept:
a service we use
What:
a challenge answer, plus technical details of the visitor's browser and connection that the provider uses to tell people from bots.
Why:
To stop automated fake sign-ups.
Who else sees it:
Cloudflare (Turnstile). It only runs on the sign-up and sign-in forms, never while a child plays.
How long:
Decided by Cloudflare under its own policy.
How to remove it:
Not stored by us.
Premium payments
Kept:
a service we use
What:
the parent's email address and the amount, sent to the payment provider to start checkout; card, GCash, Maya or GrabPay details, which the provider collects on its own page and we never see or store.
Why:
To take payment for Premium and switch it on.
Who else sees it:
Xendit (Philippines) or Stripe (everywhere else). Payment happens on their hosted page, not ours. Children never see checkout.
How long:
Our record of a purchase (plan, provider reference, end date) stays with the account. The provider keeps payment records under its own policy and the law.
How to remove it:
Deleting the account removes our record. The provider's own records follow its policy.
GCash payment receipts
Kept:
our database
What:
the GCash reference number; a screenshot of the GCash receipt (it can show the sender's name and number); the amount and the date.
Why:
To check a GCash transfer by hand before switching Premium on.
Who else sees it:
Nobody. Only administrators can open the screenshot.
How long:
The reference number and result stay with the account. A rejected receipt's picture is deleted right away.
How to remove it:
Deleting the account removes the record.
Email delivery
Kept:
a service we use
What:
the parent's email address and name, and the text of the confirmation or reset email.
Why:
To send the confirmation and password-reset emails.
Who else sees it:
Our email delivery provider (not chosen yet).
How long:
Decided by the provider under its own policy.
How to remove it:
Not stored by us beyond the account.
Videos
Kept:
a service we use
What:
whatever YouTube or Vimeo collects when a video is played.
Why:
To show a video a family chose to watch.
Who else sees it:
YouTube (privacy-enhanced mode) or Vimeo, only after someone presses play.
How long:
Decided by YouTube or Vimeo under their own policies.
How to remove it:
Not stored by us.

Cookies and your browser

We use two cookies: a secure sign-in cookie (only for signed-in parents) and a language cookie (only if you pick a language). Neither is for advertising or analytics, and we use no advertising or analytics cookies or trackers.
Progress and games are saved in the browser's own storage on the device, not in cookies and not on our servers.

Other services that touch this site

Cloudflare Turnstile checks that a visitor is a person on the sign-up and sign-in forms only. It receives technical details of the visitor's browser and connection. It does not run while children play.
YouTube or Vimeo load a video only after someone presses play, and their own policies then apply.
Xendit (Philippines) or Stripe (everywhere else) take payment for Premium on their own hosted checkout page, only for a signed-in parent who presses Upgrade. They collect the card or wallet details, and we never see or store them. We send them the parent's email address and the price. Children never see checkout.
An email provider (to be chosen) will send confirmation and password-reset emails.
No other third-party services run on this site.

Your control

You can see everything we hold about your account: Settings & privacy has Download my account data.
You can download, or erase, everything stored on a child's device from the same page, and clear stars from the Progress report.
You can delete individual pictures, learners and collections at any time.
You can delete your whole account from Settings & privacy. This removes your profile, learners, favorites, collections, artwork files, leaderboard scores and subscription records.
Old, unneeded data is deleted automatically as described above.

Where data is kept

The country or countries where our servers and providers are located will be stated here before launch.

Needs legal review before launch

Which privacy laws apply in each country we launch in. Asia has many different laws, and several set their own age limits for a child's data and their own rules for parental consent.
Whether a parent's tick-box confirmation is enough, or a stronger check is needed, in each country (including COPPA in the US and GDPR/UK-GDPR if we serve those regions).
Lawful bases, data-processing agreements with our providers, where data is stored and whether it may be sent abroad, how long records must be kept, breach-reporting duties, and whether we need a local representative or a named privacy officer.
Translations of this notice by qualified translators, and a Terms of Service with a named company and contact address.
Payment-provider terms, refunds and consumer-protection rules for subscriptions.

Also see our Terms (draft) and Safety for grown-ups.