Draft — to be reviewed by a lawyer before launch. This text is a working draft. It is not legal advice and it may change.
Privacy
Privacy policy
For parents and guardians. This explains what we collect, why, and the choices you have.
Who we are
Maia’s Pet Club is a maths game for children in Years 4 and 5. It is run by [Business name and ABN to be added] (“we”). You can reach us at [contact email to be added: hello@maiaspetclub.com]. [Postal address to be added.]
A parent or guardian sets up the account. Children never create accounts, never give us an email address and never give consent themselves. When you sign up, we ask you to confirm that you are the child’s parent or guardian. We do not ask anyone how old they are.
There is also a short page written for children: Your privacy.
The short version
- We know your email address and your child’s nickname, not their real name.
- We keep your child’s pet and maths progress so the pet remembers them.
- No ads, no tracking, no selling or sharing of data, and no chat between users.
- Feelings check-ins are off unless you turn them on, and they are deleted after 30 days.
- You can see, download and delete everything in the parent area.
- Data is stored in Australia (Amazon Web Services, Sydney).
What we collect
| Data | Why | How long |
|---|---|---|
| Your email address | To sign you in with an emailed link and to contact you about the account. | Until you delete the account. |
| Consent records: which consent, granted or withdrawn, date and time, the policy version shown, the method (emailed sign-in link plus checkbox), and a keyed hash of your IP address (not the IP address itself) | To show that you consented, and when. | Until you delete the account. |
| Your child’s nickname, year level and pet choice | To set up the game. | Until you delete the child or the account. |
| Picture PIN (3 of 9 pictures), stored only as a one-way scrambled hash | To stop siblings swapping profiles on a shared device. | Until you reset it, or delete the child or account. |
| Game progress: pet name, care tasks and answers, hearts, room decorations, minutes played | So the pet remembers your child, and so you can see their progress. | Until you delete the child or the account. |
| Feelings check-ins (only if you turn them on) | So the pet can respond and remember. | 30 days, then deleted automatically. |
| Sign-in link records | To check a sign-in link once. | The link expires after 15 minutes and its record is deleted within a day. |
| Sign-ups where consent was never given | To complete signing up. | Deleted after 14 days. |
What we do not collect
We do not collect photos, location, contacts, dates of birth, real names, advertising identifiers or free text typed by a child. We do not collect a password: you sign in with a link.
Feelings check-ins
A feelings check-in is a tap on a face: love it, happy, okay, sad or cross. It is off by default. We store check-ins only if you turn them on in the parent area. That is a separate choice with its own consent record, and you can change your mind at any time.
- When it is on, each check-in is kept for 30 days and then deleted automatically.
- When it is off, check-ins stay on your child’s device only, so the pet can respond. They are never sent to us.
- Turning it off deletes any stored check-ins.
- Maia’s Pet Club is not a health, wellbeing or counselling service. We never send alerts or labels about a child’s mood. If your child seems upset, please talk with them or seek help from a qualified person.
How we use it
We use the data only to run the game and the parent area, and to send sign-in emails. We show no ads, we do not sell or share data, we do not profile children, we do not market to children, and we use no third-party analytics or trackers. The pet chat is made of pre-written taps. There is no chat between users.
Because a parent can see a child’s progress in the parent area, we tell children about this on their own page and in the game.
Who we share it with
We never sell your data. We use a small number of service providers to run Maia’s Pet Club. They handle data only for us:
- Amazon Web Services (AWS), which hosts our API and database in Sydney, Australia.
- Vercel, a US company, which hosts the website pages. Children’s data does not pass through Vercel.
- Amazon Simple Email Service, which we plan to use to send sign-in emails. [Region to be confirmed.]
We may also disclose information if the law requires it.
Where it is stored
Personal data goes from your browser straight to our API and database in Australia (AWS, Sydney region). The website pages are hosted by Vercel in the United States, but they do not receive or store your family’s data.
Cookies and device storage
We use only what is strictly necessary to make the game work, so there is no cookie banner. We use no analytics or advertising cookies.
- A parent sign-in cookie, kept for 14 days or until you sign out.
- A “this device is set up for my child” cookie, kept for 180 days or until you remove the device in the parent area.
- A child sign-in cookie, kept for 8 hours.
- Browser storage on the device: the game’s progress (also when no account is used), and a note that the device is set up and which child is playing.
How long we keep it
- Sign-in links expire after 15 minutes and their records are deleted within a day.
- Sign-ups where consent was never given are deleted after 14 days.
- Feelings check-ins are deleted after 30 days.
- An account stays until you delete it.
- We plan to email you after 18 months of inactivity and, if we get no reply, delete the account 30 days later. This is not built yet.
- Deleting in the parent area is immediate.
- Database backups are kept for up to 7 days, so deleted data is gone from backups within 7 days.
Your choices and rights
In the parent area you can:
- see your child’s progress;
- correct a nickname, year level or pet;
- reset a picture PIN;
- see and remove devices;
- turn feelings check-ins on or off;
- see your consent history;
- download all the data we hold as a JSON file;
- delete a child;
- withdraw consent, which deletes your children’s profiles and data; and
- delete the whole account, which removes everything and cannot be undone.
You can also ask us by email at [contact email to be added: hello@maiaspetclub.com]. We answer within 30 days. Children have their own page: Your privacy.
Security
Data is encrypted in transit (HTTPS) and the database is encrypted at rest. Sign-in links, sessions and picture PINs are stored only as hashes. Repeated wrong picture PINs pause sign-in for a while. The picture PIN stops siblings swapping profiles. It is not strong security.
Data breaches
If a data breach could seriously harm anyone, we will tell the affected parents and, in Australia, the Office of the Australian Information Commissioner (OAIC).
For families outside Australia
Maia’s Pet Club is designed for Australian families. We aim to follow good practice for children’s privacy elsewhere too. Some details differ by country:
- United States. We intend to use parental consent by email, followed by a confirmation, because children’s data stays inside our own service and is not disclosed to others. A launch in the United States is subject to legal review. [To be confirmed.]
- United Kingdom. A parent or guardian gives consent for children under 13. We design to collect only what the game needs. [UK contact details and any representative to be confirmed.]
- New Zealand. The same parent consent and the same choices apply.
Changes to this policy
We will change this policy if what we collect or do changes. We will tell you, and we will ask for your consent again when what we collect changes. The version and date are at the top of this page.
Contact and complaints
Please contact us first at [contact email to be added: hello@maiaspetclub.com]. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC) in Australia, the Information Commissioner’s Office (ICO) in the United Kingdom, or the Office of the Privacy Commissioner in New Zealand.
Payments
There are no payments. Maia’s Pet Club is free at launch. If paid features come later, only the parent account will be able to pay, and we will give notice and ask for your consent again before anything changes.