Privacy Policy
WonderED is a child-development platform, which means privacy is not a compliance annex — it is the product's spine. This policy explains, in plain language, exactly what we collect, why, and what control you have. It is written to satisfy and exceed COPPA (US), GDPR/GDPR-K (EU), and the UK Age-Appropriate Design Code, applied to all users regardless of location.
1. Who is responsible
WonderED (development-phase operator; interim contact [email protected]) is the data controller for the Service.
2. Our privacy commitments, up front
- Children never hold accounts. Adults create accounts; children use profiles under recorded parental consent.
- Data minimization by design. A child profile is a nickname, a birth month (never a full birth date), an avatar, and optional interests. We never ask for a child's legal name, photo, school, or address.
- No third-party advertising or tracking — ever. Zero ad-tech, zero third-party analytics SDKs, zero social pixels, in both child and parent surfaces. The only analytics are our own, on our own server.
- No selling or sharing of personal data.
- Voice stays on the device. Speaking and recording mechanics process audio on-device; recordings are not uploaded.
- You can see, export, and delete everything, per child or for the whole account, from inside the app.
3. What we collect
About you (the Guardian): email address, display name, password (stored only as an argon2 hash), parent-zone PIN (hashed), locale/region, consent records, subscription status, and an audit trail of account-level actions.
About each child profile: nickname, birth year-month, avatar choice, optional interests, accessibility preferences, and the derived age band.
From play: which activities were attempted and at what difficulty; play events (correct/incorrect responses, hints, retries, saved reflections, completion times); the skill-level estimates derived from them; and the observations you record.
Technical: transient server logs (including IP addresses) for security and abuse prevention, and first-party usage events stored in our own database.
What we deliberately do not collect: children's real names, precise birthdates, photos or camera access, contact lists, location, voice recordings (on-device only), or data from third-party brokers.
4. Why we process it
| Purpose | Data | Legal basis |
|---|---|---|
| Operating your account and the app | Guardian account data | Contract (Terms of Service) |
| Personalizing your child's activities and difficulty | Child profile + play evidence | Verifiable parental consent (withdrawable), recorded per child with policy version |
| Progress reflections and parent reports | Play evidence + your observations | Parental consent |
| Payments and entitlements | Subscription records (no card data — held by the payment provider) | Contract / legal obligation |
| Security, abuse prevention, audit | Logs, audit trail | Legitimate interest (protecting families' data) |
| Improving activities | Aggregated, de-identified usage only | Legitimate interest |
We do not use children's data for marketing, profiling beyond the app's educational personalization, or automated decisions with legal effect.
5. Parental consent, verifiably
Creating a child profile requires ticking an explicit consent statement tied to a policy version; the consent event is stored with your account and shown in your consent history. You can withdraw consent per child at any time; withdrawal stops collection for that profile and unlocks export and deletion.
6. Where data lives and who processes it
All application data is stored on our own server infrastructure (a European data-center server we operate), in our own PostgreSQL database. Infrastructure processors:
- Hosting: our own dedicated server (Hetzner, EU).
- Payments: Razorpay (when live payments are enabled) — receives payment details directly; we receive only subscription status.
- Email: a transactional email provider (when enabled) — receives your email address for sign-in codes and receipts.
No processor receives child play data. If we ever add one that would, we will update this policy and re-request consent first.
7. Retention and deletion
- Account and child data: kept while the account is active.
- Child-profile deletion: removed from active systems immediately and purged from backups on the 30-day backup rotation.
- Account closure: the same for everything; minimal consent/audit records retained for 24 months where the law requires demonstrable consent history, then purged.
- Server security logs: rotated within 30 days.
- Backups: encrypted at rest on our infrastructure, 30-day retention.
8. Your rights (and where the buttons are)
- Access & export: parent zone → export data (full JSON per child or whole account).
- Deletion: parent zone → delete child profile or close account.
- Rectification: edit profile details in the app any time.
- Withdraw consent: per child, in the parent zone.
- Complaint: to your local data-protection authority — though we'd appreciate the chance to resolve it first.
Requests received by email are verified against the account email and answered within 30 days.
9. Security
Passwords and PINs are hashed with argon2; sessions use short-lived tokens with rotating refresh tokens and theft detection; every child-scoped request is checked against guardian ownership on the server; consent changes and data-rights actions are audit-logged; the database is not exposed to the internet; transport is HTTPS everywhere. If a breach affects your data, we will notify you and the relevant authority without undue delay and within legal deadlines.
10. Age-appropriate design
The child surface contains no ads, no external links, no chat with strangers, no public profiles, no dark patterns, no infinite feeds, and no purchase surfaces; purchases and settings live behind the parent PIN. Session-length guidance is built in with gentle wind-downs. Reward design is mastery-oriented, not engagement-maximizing.
11. Development preview note
While the Service is in its development phase: sign-in codes may be shown in-app instead of emailed (until the email provider is enabled), and premium purchases may be simulated with no payment collected. These conveniences never weaken the child-data protections above and will be removed at commercial launch.
12. Changes to this policy
Material changes are announced in-app at least 14 days in advance with a new version number. Changes that expand processing of child data require fresh parental consent before they apply to any child profile.
13. Contact
Privacy questions and rights requests: [email protected] (interim development-phase contact).