Privacy policy

Who is the data controller

The controller of your personal data is the publisher of the Cifrika game: [publisher name], [address], email: [your email address]. For anything concerning personal data, including children’s data, write to that address.

What data we process

• •Child profile data — first name or nickname, avatar, topic settings, results, stars and rewards. It is stored only locally in the browser on the device and is not sent to a server.
• •Parent email address — only if you enter it yourself, to switch on the weekly summary or buy Premium. Together with it we store the profile name, avatar and summary results on the server in order to send that email.
• •Class results — only if a player joins a class with a teacher code: profile name, topic, number of correct answers and total score, visible to the teacher in their panel.
• •Subscription and payment data — Stripe customer and subscription identifiers, status and period end date. We have no access to card or bank details.
• •Technical and security data — IP address, server logs and device information, processed by our hosting provider to run and protect the service.

Legal bases for processing

• •Art. 6(1)(a) GDPR (consent) — the weekly summary email and the processing of a child’s data, for which a parent or legal guardian gives consent.
• •Art. 6(1)(b) GDPR (performance of a contract) — providing the game and handling the Premium subscription.
• •Art. 6(1)(f) GDPR (legitimate interest) — service security, abuse prevention and pursuing claims.

Children and parental consent (under 16)

The game is meant for children, so we apply data minimisation: we do not collect a child’s contact details, we do not build advertising profiles, we do not profile and we show no ads.

In Poland consent to the processing of personal data in connection with offering a child information society services (such as this game and the email summary) is valid only when given by the parent or legal guardian of a child under 16. By creating a child profile and switching on the summary you confirm that you are that parent or legal guardian.

If the game is used in another country, we apply the age required by that country’s law, and never lower than 13.

You can withdraw consent at any time: by deleting the child profile in the app (which removes results, stars and rewards from the device) and by switching the summary off in the parent panel. Withdrawal does not affect the lawfulness of processing carried out before it.

Who we share data with

• •Stripe — payment and Premium subscription handling.
• •Base44 — the app’s hosting and backend provider.
• •Our email service provider — sending the weekly summaries.
• •We do not sell personal data and do not share it for advertising.

Transfers outside the EEA

Some providers (for example Stripe) are based in the United States, so data may be transferred outside the European Economic Area. This happens under the standard contractual clauses approved by the European Commission or a decision finding an adequate level of protection.

How long we keep data

• •Profile data, results and rewards — on the device until the profile is deleted.
• •The summary email address and the child data in the summary — until summaries are switched off in the parent panel.
• •Class results — until the teacher deletes them or asks us to.
• •Billing data — for the period required by tax law.

Your rights

We answer requests within 30 days. To use your rights, write to the address in section 1.

• •access to your data, rectification, erasure or restriction of processing,
• •data portability and the right to object to processing based on legitimate interest,
• •withdrawal of consent at any time,
• •a complaint to the supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

Data security

We use technical and organisational measures: an encrypted HTTPS connection, restricted access to data and local storage of profile data on the device. We never store card details.

Cookies and browser storage

We use no advertising or tracking cookies. We only use the browser’s local storage (localStorage) for the language, profiles, results, stars, rewards and settings, plus the session files needed when a grown-up signs in. Clearing your browser data removes the saved profiles.

Automated decisions and profiling

We make no automated decisions that produce legal effects and we do not profile users, including children, for advertising.

Changes and contact

If we change this policy we will update the date at the top of the page and mention the key changes in the app. Please send any questions or requests about personal data to the address in section 1.