1) What we collect
Account & Auth: name, email, institution, and authentication IDs (e.g., Google sign-in). We do not store passwords for OAuth sign-ins.
Usage: basic diagnostics (pages used, game sessions joined/created, device/browser, rough location from IP) to maintain reliability and detect abuse.
Content you submit:CSV/spreadsheet files, question sets, templates, room names/codes, and optional profile data. Gameplay content is not personally identifying and is stored securely on encrypted servers.
Payments (if applicable): handled by providers like PayPal/Stripe; we receive transaction metadata (status, plan, last 4 digits where applicable) but not full card numbers.
2) How we use data
- Operate and secure the platforms; provide features you request.
- Improve performance and usability; debug issues.
- Communicate important updates, service notices, or changes.
- Honor legal, security, and academic integrity obligations.
3) Legal bases (GDPR)
We rely on: legitimate interests (running and improving educational tools), contract (providing the services you requested), and consent when required (e.g., certain analytics or marketing).
4) Cookies & similar tech
Essential (required): login/session, load balancing, security.
Functional (optional): remembering preferences, recently used rooms.
Analytics (optional): anonymized usage to improve features. You can opt-out where prompts are provided or via browser settings.
5) Children & classrooms
Platforms are designed for teacher-led classroom use. Where students under 18 (or under 13 in the U.S.) participate, access should be provisioned and supervised by the school/teacher. We do not knowingly allow children to create personal accounts without appropriate adult oversight.
We support institutional compliance (e.g., FERPA, COPPA) by minimizing personal data and allowing educators to request deletion of session data.
6) Sharing & processors
We don’t sell personal data. We use trusted processors to run the service (e.g., hosting/CDN, database, email, authentication, payments). Examples include Google (auth), PayPal/Stripe (payments), and infrastructure providers (e.g., AWS).
Processors are bound by agreements to process data only on our instructions and with appropriate safeguards.
7) Retention & deletion
We keep data only as long as needed for the purposes above. Teachers can delete game sessions and uploaded assets. Teachers can also delete their accounts directly on the site if they choose to do so. To protect student privacy and support research on game-based learning, we may keep anonymized game activity (for example, how many games were played or which tools were used), but it can no longer be linked back to your identity.
8) Security
We take reasonable organizational and technical measures (encrypted transport, restricted access, monitoring). No method is 100% secure; please protect your account and report suspected issues to Contact Us.
9) Your rights
Depending on your region, you may have rights to access, correct, delete, port, or restrict processing of your data. You can also object to certain processing or withdraw consent where we rely on it.
For California residents, you may opt-out of “sale”/“sharing” (as defined by CCPA/CPRA). We do not sell personal data; if you have questions, contact us.
10) International transfers
Data may be processed in the U.S. and other countries by our team and processors. Where applicable, we use appropriate safeguards to protect personal data.
11) Changes to this policy
We’ll update this page when our practices change, with a new “Last updated” date. Material changes will be highlighted or communicated when appropriate.
12) Contact
Email: Contact Us • For legal or data requests: Contact Us
If you’re an educator acting on behalf of a school, please include your institution and course details so we can locate the correct records.