Privacy policy and notice to parents

Updated October 19, 2026. This policy covers the Pipalo website, the parent app, and the children’s games at playpipalo.com and our other site addresses.

In short: children don’t sign up or give us personal details. A parent creates an account with an email address and connects the child’s device with a code. We keep only what’s needed for the games to adapt and for the parent to see progress. No ads, no selling or sharing of personal information, and no third-party trackers in the children’s games. You can download and delete everything yourself in the parent app.

Notice to parents about children’s information (COPPA)

Pipalo is designed for children about 5 to 8 years old, together with a parent. This section is our direct notice to parents under the Children’s Online Privacy Protection Act (COPPA) and the FTC’s COPPA Rule.

• Who collects it: the Pipalo team, which operates playpipalo.com. Contact us at hello@playpipalo.com.
• What we collect from children: only the gameplay, pet, and device information described below, and only after a parent connects the device. Children are never asked for their name, email address, photo, voice, or location, and there’s no chat or way to share content with other people.
• How we use it: to run and adapt the games and to report progress to the parent. We don’t use it for advertising, and we don’t disclose it to third parties other than the service providers listed below, which process it on our behalf.
• Parental consent: only a parent can create an account and a child profile, and the child’s device sends information to us only after the parent enters a one-time code from the parent app. Until then, play stays on the device.
• Your rights as a parent: at any time you can review your child’s information (export), have it deleted (delete the child or your account), and stop further collection (disconnect the device) in the parent app, or by emailing hello@playpipalo.com. You can agree to our collection of your child’s information without agreeing to disclosure to third parties other than our service providers. We won’t require a child to share more information than is reasonably necessary to play.
• Anonymous measurement on the children’s app: limited to the aggregate counters and 30-minute visit IDs described below, used only to operate and improve the service, never for advertising or profiling. It’s turned off when Do Not Track or Global Privacy Control is set.
• If you believe a child gave us information without a parent’s knowledge, contact us and we’ll delete it.

What we store

About the parent

• Email address and a display name (from your sign-in account, or the first part of your email address).
• A single-use sign-in code sent by email. Stored only as a hash, valid for 10 minutes, and deleted after use.
• A secure HttpOnly sign-in cookie, nitzotz_parent_session, valid for up to 30 days. The server stores only its hash.
• Settings you choose: learning areas, priorities, daily goal, spoken instructions, and observations you mark in reports (for example “had adult help”).

About the child (entered by the parent or recorded by the game)

• A nickname and grade level (Kindergarten, Grade 1, or Grade 2) chosen by the parent. No full name, birth date, or photo. We recommend a nickname that doesn’t identify your child.
• Gameplay: which game was played, level, whether a round was completed, number of mistakes, whether a hint was used, instruction replays, active time, and the item practiced (for example “3+4” or the word in the game). In the feelings game we keep only which of three fixed ways to help was chosen (hug, breathing, asking for help). Free-form answers and scenario text aren’t stored on our servers.
• The chosen pet, its growth stage and outfit, and a backup of the game state (pet, care, and wardrobe saves) so it can be restored on a new device.
• Connected devices: a general device type (for example “Android” or “iPad”), when it was connected, and when it last synced. The device secret is stored only as a hash. We don’t store IP addresses, precise location, contacts, voice, or camera data.

Before a parent connects the device, and in the demo, progress stays only in the browser’s local storage on the child’s device and isn’t sent to our servers.

Anonymous website measurement

• We count general events (page view, opening an app, starting a game, completing an activity, connecting a device). We keep daily totals by event type, traffic source, campaign, game, language, and demo mode, with no names, email addresses, child IDs, or IP addresses.
• A random visit ID is kept in the tab’s sessionStorage and replaced after 30 minutes. The server stores only its hash. Per-visit records (active time, site area, country) are deleted after 7 days; only aggregate totals are kept.
• A country hint (a two-letter code) comes from our hosting provider or a same-site /cdn-cgi/trace request. From the browser we derive only general categories: device type (phone, tablet, computer), operating system, and browser. IP addresses, full user-agent strings, and referrer URLs aren’t stored.
• Attribution: UTM tags from a fixed list, the kind of referring site (for example “search” or “social”), and, for visitors who arrive from an email invitation link, a visit count and active time linked to the invited contact, deleted after 7 days.
• If your browser sends Do Not Track or Global Privacy Control, measurement is turned off completely. You can turn this on in your browser at any time.

Business contacts

If we contacted you by business email (for example educators or content publishers), we keep the email address, name, the public source of those details, and the outreach status. You can ask to be removed at any time.

How we use information

• To run the games, sync the child’s device with the parent app, and restore progress.
• To adapt difficulty and show the parent a progress report and suggestions.
• To email sign-in codes. We don’t send marketing email without consent.
• To improve the site using anonymous totals, and to keep it secure (for example by limiting code attempts).

No advertising, no selling or renting of personal information, no sharing for cross-context behavioral advertising, and no marketing profiles of children.

How long we keep information

• Parent account, child profiles, and learning data: as long as the account exists, until you delete them.
• Internal change and deletion history (to recover from mistakes): 30 days. When you delete data yourself, it’s removed immediately.
• Game-state backups: up to the 10 most recent per child; backups older than 30 days are deleted, except the newest one, which is kept while the profile exists.
• Sign-in and pairing codes: 10 minutes. Sign-in cookie: up to 30 days.
• Measurement: per-visit records 7 days; daily totals without identifiers are kept long term.

Service providers

• Cloudflare and the site’s hosting platform: servers, the database (Cloudflare D1), and network delivery. Requests are handled on Cloudflare’s global network, so information may be processed in data centers in the United States and other countries where Cloudflare operates.
• Email provider: to send sign-in codes, Porkbun (SMTP) or Resend depending on the active configuration. It receives only the email address and the code message.
• OpenAI: only if you choose to sign in with a ChatGPT account; we then receive your email address and name to identify you.
• Google Fonts: the parent app loads a font from Google, which receives the browser’s IP address to deliver it.

We disclose information to authorities only when legally required.

Your rights and choices

• Access and export: in the parent app, under “Your data,” download a JSON file with everything stored about your family.
• Correction: change any child’s nickname and grade level.
• Deletion: delete a single child or your whole account. Deletion is permanent and includes backups and internal history.
• Disconnect a device: disconnect each device separately. Progress stays on that device but is no longer sent to us.
• For anything else, or if you can’t do it yourself: hello@playpipalo.com. We aim to respond within 30 days.

California and other US state privacy rights

Depending on where you live, state laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) may give you the right to know what personal information we collect, use, and disclose; to access, correct, and delete it; and to opt out of its sale or sharing. You can use these rights with the tools above or by emailing hello@playpipalo.com. We’ll verify requests by confirming control of the parent account’s email address, and an authorized agent may make a request on your behalf.

• Categories we collect: identifiers (parent email address and display name), child profile details chosen by the parent (nickname and grade level), learning and gameplay activity, and general device and usage information, as described above.
• Sale and sharing: we don’t sell personal information or share it for cross-context behavioral advertising, including information about children under 16.
• Sensitive information: we don’t collect precise location or other sensitive personal information about parents, and we don’t use personal information to make decisions with legal or similarly significant effects.
• Global Privacy Control: we honor GPC and Do Not Track by turning off measurement.
• No discrimination: we won’t treat you differently for exercising your privacy rights.

Security

Connections are encrypted (HTTPS). Sign-in and device secrets are stored only as hashes, code attempts are limited, and every parent action is checked against ownership of the child profile. To limit attempts we briefly keep (up to one hour) a hash of the network address, never the address itself. No system is perfectly secure; if a security incident affects your information, we’ll notify you as required by law.

Changes to this policy

We’ll update the date at the top. For material changes we’ll tell you in the parent app before they take effect, and if a change affects how we collect or use children’s information, we’ll ask for parental consent where COPPA requires it.