Privacy & Safety

1. Who this applies to

PlayPack is available worldwide. Wherever you live, we apply a single high privacy baseline and then honour the specific rights your local law gives you — see “Your rights by region” below.

2. What we collect

• Your account email — only to sign you in and send essential account messages.
• Google sign-in — you sign in with your Google account (it’s the only way to sign in). From Google we store the account’s name and a link to its profile picture, its Google account ID, and the sign-in tokens Google issues, plus a session record that keeps you signed in. We use these only to sign you in (and your name to greet you). We never see your Google password, and we don’t ask for access to your Gmail, contacts or files.
• Each child’s first name (or a nickname) and level — so the right pack loads. No surname, date of birth, photo, or contact details.
• Gameplay progress — streaks, stickers and which games were played, to power the parent dashboard.
• Billing — handled by Stripe. We store your subscription status and a Stripe customer id; we never see or store card numbers. Stripe’s Link is the merchant of record for payments, so Stripe holds your payment, billing and tax details in its own right (and a Link account, if you use one) under Link’s privacy policy — including for the receipts and tax records it is legally required to keep.
• Proof of the renewal terms you agreed to — when you tick the box to agree to the automatic renewal terms for a subscription or classroom seats, we keep the terms and checkbox wording you were shown, when you agreed, your email address, time zone, IP address and browser type. US auto-renewal laws (such as California’s) require us to keep this for at least 3 years, or 1 year after your plan ends if that’s longer, so we keep it even if you delete your account.
• A record that you’ve had your free trial — there’s one free trial per person, so when a trial starts we keep a coded version of your sign-in email address (a keyed hash), with the date. We can only use it to check whether an address has already had a trial, and we use it for nothing else. We keep it even if you delete your account, because otherwise deleting and re-joining would start a new trial.
• Withdrawal requests — if you use “Withdraw from contract here”, we keep what you submit (name, email, what you’re withdrawing from, order details and, if given, country) plus your IP address and browser type, to handle your request, prove when we received it and prevent abuse. We keep it for as long as we need to deal with any refund, dispute or legal claim.
• The free sample pack — when you ask for it we keep your email address so we can send it. Asking for the pack doesn’t sign you up to anything: our other emails are a separate, unticked box. If you tick it, we send a few tips over the following week, then news and a free pack about once a month, and we store the exact wording you agreed to, when, your IP address and browser type, so we can show what you consented to. So that we don’t send offers you don’t need, we check whether your address already has a PlayPack plan, and whether it has already had its free trial. Unsubscribe and we stop straight away; we keep a note of when you unsubscribed so we don’t email you again unless you tick the box again.
• A count of page views — on our marketing pages (the home page, the printable pack pages, /free, /teachers and /gift) we record that a page was viewed: the page address, the campaign tags in the link you followed (so we can tell which pin or email brought you), the website that linked to you, the country our host reports, and whether the screen is phone-sized. That is the whole record. There is no cookie and nothing is stored on your device, and we keep no IP address, no browser string and no identifier of any kind — so two visits by you cannot be told apart from visits by two people, and nothing in it can be traced back to you. The kids’ app itself has no counter at all. If your browser sends “Do Not Track” or Global Privacy Control, we don’t count the visit.
• Emails we send — order confirmations, reminders, acknowledgements and (if you opted in) our tips and monthly emails are sent through Resend, and we keep a log (address, subject, time and whether it was sent) so we don’t send duplicates.

We only collect what is reasonably necessary to provide the service (data minimisation).

3. How we use it — and what we never do

We use personal information solely to run PlayPack. We never:

• show ads or use ad networks;
• use third-party analytics, social pixels or tracking SDKs — our page count is our own, stays on our own server, and holds nothing about a person;
• sell, rent or share your data with data brokers;
• collect location, contacts, photos, microphone or camera.

4. International data transfers

To run the service we use a few processors that may store or process data outside your country, including in the United States and the EU: Stripe (payments — for payments Stripe is the merchant of record and acts in its own right, not only on our instructions), Google (sign-in), Resend (email) and our hosting/database provider. Where data leaves your region we rely on recognised safeguards — the EU–US Data Privacy Framework, Standard Contractual Clauses, and adequacy decisions — and, for Australia, we take reasonable steps to ensure APP-consistent handling (APP 8).

5. Children’s privacy (worldwide)

PlayPack is designed for children, so a parent or guardian (or, for a class, the teacher) creates and controls the account and provides the only personal detail we hold about a child — a first name or nickname — which they can review, correct or delete at any time. We do not knowingly collect personal information directly from children. This model is built to satisfy children’s-privacy rules across regions, including COPPA (US, under 13, verifiable parental consent), the GDPR children’s provisions (EU, parental consent below the local age of 13–16), the UK Age-Appropriate Design Code, and Australia’s forthcoming Children’s Online Privacy Code.

Schools and classrooms. A school teacher may use PlayPack with a class only with their school’s authorisation, and only for the class’s educational use. If you run a group that isn’t a school (such as a homeschool co-op, library, club or after-school program), you must have each child’s parent’s permission before you add the child. Each student profile holds only the first name or nickname entered on a device signed in to the teacher’s account and a level, plus the progress and stickers earned in the games. Students don’t have their own accounts, email addresses or logins, and teachers should add the profiles themselves before handing devices to students. We use this only to provide PlayPack to that class, never for advertising. The teacher can rename or delete any profile on their dashboard, and we keep each profile and its progress until the teacher deletes that profile or their account.

6. Online safety (Safety by Design)

We design PlayPack to be safe by default — there is no user-to-user chat, no user-generated content, no public profiles and no ads. This follows the eSafety Commissioner’s Safety by Design principles and comparable child-safety expectations elsewhere. Report a concern at safety@playpackkids.com.

7. Security & data breaches

We take reasonable technical and organisational steps to protect personal information and to delete or de-identify it when it is no longer needed. If a breach is likely to cause serious harm, we will notify affected individuals and the relevant regulator within the timeframes required by law (for example, GDPR’s 72-hour rule, US state breach laws, and Australia’s Notifiable Data Breaches scheme).

8. Your rights (everywhere)

Wherever you live, you can:

• Access & export everything we hold — from your dashboard (Export my data).
• Correct a child’s name or level any time on your dashboard.
• Delete any child, or your whole account and all associated data, instantly — we also cancel any active subscription.
• Object / opt out and withdraw consent where your law provides it.

9. Your rights by region

Pick your region to see the specific rights and who to contact.

10. Marketing

We only send marketing emails if you opt in, by ticking the box when you ask for a free pack: a few tips over the following week, then news and a free pack about once a month. We don’t send offers to an address that already has a plan. Every message says who we are, gives our postal address and has an unsubscribe link, and if your email app shows its own unsubscribe button, that works too (per CAN-SPAM in the US, PECR/GDPR in Europe, the Spam Act in Australia, and similar laws elsewhere). Unsubscribing takes effect straight away, and we keep a note that you unsubscribed so we don’t email you again unless you tick the box again. Essential account and billing emails are not marketing.

11. Complaints & contact

Contact our Privacy Officer at privacy@playpackkids.com and we’ll respond within a reasonable time. If you’re not satisfied you can complain to your local authority (see the region panel above). EU/UK users can also reach our representative at eu-rep@playpackkids.com.