Privacy Policy

Version 2026-07-26 · Last updated 26 July 2026

The short version. Your child has no account and we never ask for their real name. We hold your email, a hashed password, and whether you subscribe. If you subscribe we also keep one copy of the game's save data so the same robot appears on your other devices — we never open it. We do not store AI conversations. There is no advertising and nothing at all about your child leaves the device. When you sign up or subscribe we do tell Meta (Facebook) that it happened, identified by a one-way hash of your email address, so we can tell which adverts work — that is about you, the adult, and it is described in full below. Deleting your account deletes all of it.

Before you publish: fill in the bracketed items — they are the only parts that cannot be read off the software. Then have a solicitor review it. Services used by children sit under COPPA in the US and the GDPR's children's provisions in the EU/UK, and this document is a description of the system, not legal advice.

1. Who is responsible
2. What we hold
3. What stays on the device
4. Children
5. The AI Buddy
6. Robo's Notebook
7. Advertising measurement
8. What we never collect
9. Who else is involved
10. Why we are allowed to
11. How long
12. Your rights
13. Security
14. Changes

1. Who is responsible

The data controller is [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. For anything about your data, write to [CONTACT EMAIL]. [IF YOU ARE REQUIRED TO APPOINT A DATA PROTECTION OFFICER OR AN EU/UK REPRESENTATIVE, NAME THEM HERE]

2. What we hold on our server

This is the complete list. It is short because the system was built to keep it short.

Your email address. To identify the account, confirm it, send password resets and receipts, and reply to support tickets.
A hash of your password (scrypt). We cannot read your password and we could not tell you what it is.
Subscription state: a customer reference from our payment provider, whether the subscription is active, and when the paid period ends.
A daily count of AI messages per account, so the limit can exist. A number, not the messages.
Support tickets you write, and our replies.
Whether you ticked the optional "email me about new packs" box.
For subscribers only — one copy of the game's save data. See below.

The saved game, for subscribers

If you subscribe, the Academy keeps a copy of the same save data your browser already holds, attached to your account, so a child who moves from the iPad to a laptop keeps the robot they raised. It contains the robot's chosen nickname, stars, costumes, stickers, which activities have been completed, Robo's Notebook (below) and any pixel art your child drew.

It is stored as a single opaque blob. Our server does not read or interpret it, it is not shown in any internal view, it is never used to train anything, and it is deleted when you delete your account. On the free tier nothing is uploaded at all.

3. What stays on your child's device

All of the above save data also lives in your browser's local storage on the device your child plays on. On the free tier that is the only copy in existence. Clearing your browser data for this site erases it, and we cannot recover it.

4. Children

The Academy is designed so that a child can use it without us learning who they are.

There is no child account and no way for a child to create one.
We never ask for a child's real name. The name your child types is a name for the robot, and the app says so. Many children pick "Bolt".
We do not ask for their age, birthday, school, photo or location.
The parts of the app a child can reach never collect anything. The one zone that talks about secrets — the Lighthouse — contains no text input at all, on purpose: there is nowhere to type a real one.
The AI Buddy requires an adult to unlock it every session, and its safety brief tells it never to ask for personal information and to remind your child not to share any.

Because the account and the consent are the parent's, and because we ask for no personal details about the child, we do not knowingly collect personal information from children directly. If you believe we hold something about your child that we should not, write to us and we will delete it. [CONFIRM YOUR COPPA / GDPR-K POSITION WITH A SOLICITOR BEFORE RELYING ON THIS PARAGRAPH]

5. The AI Buddy

Messages your child sends are relayed by our server to Anthropic, who run the Claude model, and the reply is relayed back.
We do not store the conversation. Our server passes it through and keeps only a per-day count for the limit. Closing the tab is the end of it.
Anthropic processes the message in order to answer it, under their own terms as our processor. Your child's name is not sent — only the robot's nickname, so it can answer to it.
The child-safety brief is added by our server and cannot be altered from the browser.

6. Robo's Notebook

The game keeps a small tally of in-app play — which zones were visited, which sprites were picked, what was built — so the robot can say things like "you always pick the penguin". Every such remark carries a "How do I know?" tap that shows the actual counts behind it, because the honest version of a recommendation algorithm is the lesson.

It records nothing from outside the app and never anything typed into the AI Buddy. It is part of the save data described above, and a "Make Robo forget" button in the Notebook wipes it at any time.

7. Advertising measurement

We advertise the Academy, and we need to know which adverts brought families here rather than guessing. So at three moments — you create an account, you start the checkout, and a subscription payment succeeds — our server tells Meta (Facebook) that the event happened.

This is the complete list of what is sent:

a SHA-256 hash of your email address. Not the address itself: the hash is a one-way fingerprint, and it is how Meta recognises a customer it already knows without us handing over your address.
your IP address and browser user-agent, for the two events that happen while you are using the site.
the amount and currency, for the checkout and the payment.

And this is what is never sent, at any of those moments: anything about your child. Not the robot's name, not a game result, not a level, not a drawing, not the Notebook. None of it is on our server in a form tied to a person, and none of it is in these events.

There is no Meta pixel, and no tracking script of any kind, in the app or on this site. Nothing watches your child play. This happens on our server, about the adult's account, three times.

Meta acts as our partner for measuring this, under their own terms, and may use it for their own purposes as described in their data policy. If you would rather we did not, write to us at [CONTACT EMAIL] and we will exclude your account. [IN THE EU/UK THIS KIND OF MEASUREMENT IS NORMALLY CONSENT-BASED - CONFIRM WITH A SOLICITOR WHETHER YOU MUST ASK FIRST]

8. What we never collect

No analytics on your child's play. No advertising shown to your child, ever. No third-party trackers, pixels or social buttons in the app. No cookies except the one that keeps you signed in. No device fingerprinting. No location. We do not sell personal data, and the only thing we share with anyone is the short list in section 7 and the processors in section 8.

9. Who else is involved

Dodo Payments — merchant of record for subscriptions. They take the payment and handle your card; card details never reach us.
Anthropic — runs the Claude model behind the AI Buddy.
Brevo — sends the confirmation, password-reset and receipt emails.
Meta — receives the three advertising-measurement events in section 7. A hashed email address, never your child.
Railway — hosts the application and the database.

Some of these operate outside the UK/EU, so data may be transferred internationally under the safeguards their own terms provide. [LIST THE TRANSFER MECHANISM YOU RELY ON — e.g. standard contractual clauses — AFTER CHECKING EACH PROVIDER'S CURRENT TERMS]

10. Why we are allowed to hold it

To perform our contract with you: your account, the subscription, the saved game, support.
Our legitimate interests: keeping the service secure, enforcing the message limit, preventing abuse, and measuring whether our advertising works (section 7).
Your consent: the optional marketing email box, which is off by default and which you can withdraw at any time.
Legal obligation: keeping payment records where tax law requires it.

11. How long we keep it

Account data and the saved game: until you delete the account.
Sign-in sessions: 30 days, or until you sign out.
Confirmation links 48 hours; password-reset links one hour.
Daily AI counts: about 40 days, then dropped.
Support tickets: while the account exists.
Payment records: as long as tax law requires, held by our payment provider.

12. Your rights

You can ask us to show you what we hold, correct it, delete it, or send it to you in a portable form; you can object to processing based on legitimate interests and withdraw consent for marketing. Most of it you can do yourself, immediately, in the Parent Room: Delete my account removes everything from our server, and Make Robo forget wipes the Notebook.

Write to [CONTACT EMAIL] for anything else. If you are unhappy with our answer you can complain to your data protection authority — [NAME THE REGULATOR FOR YOUR JURISDICTION].

13. Security

Everything travels over HTTPS. Passwords are stored as scrypt hashes with a per-account salt. Our AI provider's key lives only on the server and is never sent to a browser. Session cookies are HttpOnly and SameSite. The adult area sits behind a gate that re-locks every session. No system is perfect; if we ever have a breach affecting you we will tell you, and the regulator, as the law requires.

14. Changes

If we change this policy we will update the version at the top, and email you before any change that materially affects what we do with your data.