1. WHO WE ARE
Pixelverse Academy is operated by [FULL LEGAL NAME — your own name if you're a sole trader, or the registered company name and number if you've incorporated].
We are the data controller for the information described here. That means we decide what is collected and why, and we're responsible for looking after it.
Contact: info@pixelverse-academy.com
Postal address: [POSTAL ADDRESS — required]
ICO registration number: [NUMBER, or remove this line]
To do — postal address. A contactable address is expected in a privacy notice. If you'd rather not publish your home address, a registered office or virtual business address (typically £30–£150/year) is the usual route. Sort before the pilot widens.
To do — ICO registration. Most UK organisations processing personal data electronically must pay the ICO data protection fee. Now that progress can be stored on a server rather than only on the device, you're very likely in scope. Check the ICO self-assessment; tier 1 is around £52/year.
2. USING THE APP WITHOUT AN ACCOUNT
The app works fully without any account at all.
In that case, your child's progress is saved only in your device's own browser storage. It isn't transmitted to us, and we have no way of seeing it. If you clear your browser data or lose the device, that progress is gone — we can't recover it, because we never had it.
3. WHAT WE COLLECT IF YOU SET UP CLOUD BACKUP
Cloud backup is optional and is set up by an adult, from the Parent Zone. If you choose to use it, we collect the following.
Parent or carer account
- Email address — to identify the account, confirm it, allow sign-in on other devices, and reset a forgotten password.
- Password — stored only as a secure cryptographic hash. We never see, and cannot recover, your actual password.
- Account dates — when the account was created and last used.
Child profile
- First name or nickname — whatever is typed when creating an explorer profile, shown in the app so a child recognises their own profile. A first name or nickname is enough; please don't enter a surname.
- Avatar choices — the robot appearance a child has picked.
Learning progress
- Missions completed, stars earned, and accuracy per topic
- In-app coins earned and cosmetic items unlocked
- Streak information and dates of activity
- Questions answered incorrectly, so they can be revisited in the Repair Bay
Technical information
When your device contacts our servers, our hosting providers process your device's IP address and basic connection details as an unavoidable part of delivering the service and protecting it from abuse.
4. WHAT WE DO NOT COLLECT
To be explicit, we don't collect or ask for:
- Surnames, home addresses, phone numbers or dates of birth
- School names, class details or teacher information
- Photographs, video, audio recordings or voice data
- Location or GPS data
- Contacts, calendar or any other data from your device
- Health, fitness or sensor data
- Payment card details
- Advertising identifiers or cross-site tracking data
We don't use advertising cookies, analytics that profile individuals, or third-party tracking pixels. There's no advertising in the app, and no real-money purchases — in-app coins are earned by learning and cannot be bought.
We never ask a child directly for personal information. The only free text a child enters is the name on their own profile.
5. WHY WE PROCESS THIS, AND OUR LAWFUL BASIS
| What | Why | Lawful basis |
|---|---|---|
| Parent email and password | To create and secure the account, and let you sign in on another device | Performance of a contract |
| Child first name and avatar | So a child can recognise and choose their own profile | Legitimate interests |
| Learning progress | To back up progress, restore it on another device, and show parents insights | Legitimate interests |
| Service emails | To confirm your address and send password resets | Performance of a contract |
| Optional progress summary emails | To send you a summary of your child's learning | Consent |
| Security and abuse prevention | To keep the service running safely | Legitimate interests |
Where we rely on legitimate interests, we've considered the interests and rights of the children involved and limited what we collect accordingly. You can object to this processing at any time (see section 9).
We don't use this information for automated decision-making or profiling that produces legal or similarly significant effects, and we don't use it to train machine-learning models.
6. WHERE IT'S STORED, AND WHO CAN ACCESS IT
Progress data is stored in a Postgres database hosted by Supabase, in a European region. Each account's data is isolated at the database level using row-level security, so one family's account cannot read another's, even if someone obtained the app's public key.
Access is limited to [NAME/ROLE — e.g. "the founder, currently the only person operating Pixelverse Academy"], and only where necessary to run, support or debug the service.
Service providers we use
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, accounts and authentication | EU region (US-headquartered) |
| Netlify | Website and app hosting | [REGION] |
| Google Workspace | Our email (info@pixelverse-academy.com) | EU/US |
These providers act as our processors: they handle data on our instructions and may not use it for their own purposes. Some are headquartered outside the UK. Where data is transferred internationally, this is covered by the safeguards in their data processing agreements, including the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
To do — transfers. Confirm and record that you've accepted Supabase's and Netlify's data processing agreements, and that each includes the UK Addendum. Choosing an EU region controls where data is stored; it doesn't by itself resolve access from outside the UK/EEA. Keep copies.
7. HOW LONG WE KEEP IT
- Account and progress data — for as long as your account is active.
- Inactive accounts — if unused for [24] months, we'll email the address on file and then delete the account and all progress if there's no response within [30] days.
- On request — deleted within 30 days of a verified request.
- Deleted child profiles — removed from our servers within [30] days.
- Waitlist email addresses — kept until you unsubscribe or ask us to remove you, or until the waitlist closes.
- Backups — deleted data may persist in encrypted backups for up to [30] days before being overwritten.
8. KEEPING IT SECURE
- All traffic between the app and our servers is encrypted in transit (HTTPS).
- Data is encrypted at rest by our database provider.
- Passwords are stored only as salted hashes.
- Row-level security rules isolate each account's data at the database level.
- The parent PIN that protects the Parent Zone is stored only on the device and is never sent to us.
No online service can promise perfect security, but we've designed this one to hold as little as possible in the first place.
9. YOUR RIGHTS
Under UK data protection law you can ask us to access a copy of what we hold, correct anything inaccurate, delete it, restrict or object to how we use it, port it to another service, or withdraw consent where we rely on it.
Because this data mostly concerns children, we treat deletion requests as a priority and won't ask you to justify one.
To exercise any of these, email info@pixelverse-academy.com. We'll respond within one month. We may need to confirm you control the account email before acting. Parents and carers may exercise these rights on behalf of their child; older children may also exercise their own.
Deleting your data
- Delete one child's profile: in the app, from the profile picker.
- Delete your whole account: email us and we'll remove the account, all child profiles and all progress within 30 days.
- Stop backing up but keep playing: sign out in the Parent Zone. Progress stays on your device.
To do — deletion must actually work before this goes live. If deleting a profile in the app removes it locally but not the matching server row, it'll return on the next sync and the claim above is untrue. Either finish server-side deletion first, or reword this to say profile deletion is by email request only for now.
10. CHILDREN'S PRIVACY
This app is designed for children aged 7–11 and used with a parent or carer.
- Accounts can only be created by an adult, from an area protected by a parent PIN.
- Children can't message each other, see other children's data, or share anything publicly. There's no chat, no user-generated content, and no social features of any kind.
- There are no leaderboards ranking children against one another.
- There's no advertising and there are no real-money purchases.
- We collect no more from a child than a first name and their own learning progress.
We've designed the service with the ICO's Age Appropriate Design Code (the Children's Code) in mind, including data minimisation, privacy-by-default, and switching off anything not needed to provide the service.
To do — DPIA. The Children's Code expects a Data Protection Impact Assessment for services likely to be accessed by children. It's a documented internal assessment, not a public page, but the ICO can ask to see it, and its absence is a common finding against small operators. The ICO publishes a template. Worth doing before the pilot widens.
11. LOCAL STORAGE AND COOKIES
The app stores information in your browser's local storage to work properly: your child's progress (so it works offline and without an account), your sign-in session if you use cloud backup, and settings such as sound preferences and the parent PIN.
These are strictly necessary for the app to function. We don't use advertising, analytics or tracking cookies. Clearing your browser data will remove all of the above, including progress that hasn't been backed up. Fonts on this website are loaded from Google Fonts, so your browser makes a request to Google's servers to fetch them.
12. WAITLIST AND EMAILS
If you join our waitlist, we collect your email address to tell you about the app's release. It's handled by Netlify and stored on Netlify's infrastructure. We won't pass it to anyone else. Every marketing email includes an unsubscribe link, and you can ask us to remove you at any time by emailing info@pixelverse-academy.com.
Optional progress summary emails are separate and can be turned off in the Parent Zone without affecting your account.
13. CHANGES TO THIS NOTICE
If we make significant changes — particularly to what we collect or why — we'll update this page and, where the change is material, email account holders directly. The version number and date at the top will always tell you which version you're reading.
14. COMPLAINTS
If you're unhappy with how we've handled your information, please tell us first at info@pixelverse-academy.com so we can put it right.
You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — helpline 0303 123 1113, ico.org.uk.