Explorilla privacy policy

Effective: [EFFECTIVE DATE]

The short version

Explorilla does not collect, send or share any information about you or your child. Everything the app remembers stays on this device. There are no accounts, no sign-in, no adverts, no tracking and no analytics. Some stories and pictures download from our own server the first time they are needed; those requests carry nothing about you or your child (see 'Downloads'). The optional family plan is bought through Apple, and we never see who bought it or how they paid.

Explorilla is made by Kevin McGeever ("we"). This policy explains exactly what the app keeps on the device and why.

What the app keeps on this device

To work, the app saves the following in its own private storage on this device. None of it is sent to us or to anyone else.

Each child's profile: the name or nickname typed in when the profile was made, the name and colour chosen for their companion, the school year and curriculum a grown-up chose, and settings such as the money used in questions, the reading voice, the default way to play and any daily play limit.

Each child's learning progress: which skills they are working on, how well the app thinks they know each one, their answers (right or wrong, and how quickly), and what they have earned in the game, such as stars, creatures, vehicles, home-base items and high scores.

When each child played and for how long, so the daily play limit works and the parent area can show time spent.

The last 60 questions each child answered, and any question reported as looking wrong, so it can be checked and fixed (see 'Reporting a problem and sharing').

Any spelling lists a grown-up types in the parent area for a child (the school's weekly words), and how the child is getting on with each word. Children cannot type into these lists.

The parent PIN, kept only as a scrambled (salted and hashed) code, never as the PIN itself.

Sound, music and hand (left or right) settings, the downloads setting (Wi-Fi only, or mobile data too), and any goals a grown-up has set in the parent area.

The stories, pictures and music it has downloaded (see 'Downloads'), kept in the app's own cache.

For the free daily questions: how many questions each child has answered today, and, if a grown-up has bought the family plan, whether the plan is active and when its current period ends, as Apple's purchase system reports it on this device.

A problems log: if the app hits an error, it notes the time, which part of the app it was in and the technical error message, so a grown-up can pass it on. It is for technical details only and does not include a child's profile or progress.

What the app does not do

The app connects to the internet in two ways only. Apple's own purchase system on the device (StoreKit) talks to Apple when a grown-up looks at, buys or restores the family plan, and when the app checks whether the plan is active. And some stories, pictures and music download from our own server the first time they are needed, as explained in 'Downloads'. It does not use the camera, the microphone, location, contacts, photos or any advertising identifier. It contains no third-party analytics, advertising or tracking code.

There are no links for children. The only links in the app are to this policy and to the Terms of Use on our website, on the family plan screen in the parent area, each behind the grown-up question.

Most pictures, sounds, music and recorded words are built into the app; the rest download as explained in 'Downloads'. Where a word has no recording (for example a word a grown-up added to a spelling list), the app uses a speech voice built into the device, and never picks one of the device's online voices.

Downloads

A few parts of the app are too big to build in, so they download in the background: for example the moving pictures of a History story, a story in Story mode, and the pictures in Reading. On Wi-Fi they download by themselves, one at a time, and each appears in the app once it has arrived; nobody needs to tap anything. By default nothing downloads over mobile data; a grown-up can change that in the parent area, which also shows each download's size and can remove them. Seasonal music downloads only on Wi-Fi, whatever that setting. Once downloaded, it stays on the device and works with no internet. Downloads are kept in the app's cache, which is not part of the device's backup and which the device may clear when it is short of space; anything cleared or removed downloads again the next time the app is open on Wi-Fi.

Each download is an ordinary web request for one file from content.explorilla.app, our download server, which runs on Cloudflare R2 (Cloudflare's file storage service, which stores the files for us and delivers them). Like any web request, it tells the server the device's internet (IP) address and which file is wanted; in place of the device's details the app sends only the fixed label 'Explorilla'. The request carries nothing about you or your child: no name, no account, no identifier, no settings and no progress. We set no cookies, there are no accounts, and we collect no information about children. The files are pictures, sounds, videos and data files that the app checks against fingerprints built into it; no code is ever downloaded.

Cloudflare handles these requests for us as our data processor, under its data processing terms. It uses the IP address to deliver the file and to protect its network (for example from attacks), and its privacy policy says it keeps such information only as long as its business purposes need; it does not give a fixed period. We have not switched on any Cloudflare analytics, log storage or log export for this server, so we do not see or keep any record of which device downloaded what. Cloudflare's privacy policy is at cloudflare.com/privacypolicy.

The family plan and purchases

Every child can play a number of free questions each day. A grown-up can buy the Explorilla Family plan, which removes the daily limit for up to four children on the device. Plans and prices appear only in the parent area, behind the grown-up question and the parent PIN; children never see a price or a request to buy.

Purchases are made through Apple, under Apple's terms and privacy policy. We never receive payment details, an Apple Account, a name or an email address. The app does not send anything about a purchase anywhere: Apple's purchase system checks on this device whether the family has the plan, and the app keeps only that answer and when the plan's current period ends.

Reporting a problem and sharing

While playing, a child can tap 'Something looks wrong?' to flag the question on screen. This is a single tap: a child cannot type anything into a report. In the parent area a grown-up can also report a question, choose reasons and add a short note. Reports are saved on this device only. Nothing is sent anywhere unless a grown-up exports the reports (as a spreadsheet or a PDF) or copies the problems log, after the grown-up question, and even then the app only hands the file to the device's own share sheet or print dialog, where the grown-up picks where it goes (for example a message or an email to us).

An exported question report contains the question, the answers shown, the answer given, the right answer, how the question was made, the reasons and any note a grown-up added, and the app's version number. It does not contain the child's name. Please do not put personal details in a note. If you send it to us, we use it only to fix the question, and we keep the message only as long as needed to do so.

A grown-up can also print a certificate or the weekly report from the parent area, or email the weekly report to themselves. The page is made on this device and carries the child's first name or nickname and their progress. It leaves the app only if the grown-up prints it, shares the PDF or emails it, after the same grown-up question, and the app sends nothing itself. 'Email this to me' opens the device's own Mail app with the report attached and no address filled in: the grown-up types the address and sends it from Mail. The app never asks for, keeps or sends an email address.

A grown-up can also make a share card in the parent area: a picture of one achievement, such as a skill mastered or a boss beaten. It is drawn on this device and carries the child's first name or nickname unless the grown-up switches the name off. It leaves the app only if the grown-up shares it, after the same grown-up question, and the app sends nothing itself.

The parent area, the privacy policy, the family plan and every way of sharing or leaving the app sit behind a parental gate: a grown-up question, then the parent PIN.

Children

Explorilla is made for children aged 5 to 11. Because it collects no personal information, it collects none from children. It is designed to meet the Apple App Store Kids Category rules, the Google Play Families policy, the US Children's Online Privacy Protection Act (COPPA) and the UK Age Appropriate Design Code.

Backups, the app stores and your device

If your device backs itself up (for example iCloud Backup or Android's backup to your Google account), that backup can include the app's saved data (not its downloads, which can always be downloaded again). It is held under your own account and settings; we never see it.

Apple and Google run the App Store and Google Play under their own privacy policies. If you have chosen in your device settings to share diagnostics with app developers, Apple or Google may send us anonymous crash reports. These do not identify you or your child.

Deleting information

To delete one child's information, open the parent area and choose 'Delete player'. To delete everything, delete the app from the device. We hold no copy, so there is nothing for us to delete.

Changes and contact

If the app ever changes what it keeps, or starts to send any information beyond the download requests described above, this policy will be updated first and the change will be shown in the app.

Questions about this policy: privacy@explorilla.app.