Privacy Policy
The short version. Earn2Play is used by children, so we collect as little as possible. A parent sets up every child profile. Kids don't need an email address or password. There are no ads and no third-party trackers. We don't sell data. Exercise video is analysed on the device and never uploaded. Parents can see, change and delete their child's data at any time.
1. Who we are
Earn2Play ("we", "us") provides the Earn2Play parent app, the Earn2Play kids app and the website earn2play.net (together, the "Service"). The data controller is [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Contact: privacy@earn2play.net. [EU/UK representative and Data Protection Officer details, if required.]
2. Children and parental consent
The kids app is designed for children aged 4 to 16. We follow the U.S. Children's Online Privacy Protection Act (COPPA), the EU/UK GDPR rules for children's data (including Article 8 "GDPR-K") and the UK Age Appropriate Design Code.
- Only a parent or legal guardian can create a child profile. Parents sign up in the parent app and must be adults (18+).
- Children cannot sign up on their own. A child's device joins the family only by entering a one-time code (or scanning a QR code) that the parent displays. Codes expire after 10 minutes and work once.
- By creating a child profile, the parent gives consent to the collection and use of the child's information described in this policy. [Legal review: confirm the verifiable parental consent method required for COPPA, e.g. a payment-card check or signed form, and age-of-consent thresholds per EU member state.]
- Parents can review the child's information in the parent app, refuse further collection by unlinking the child's device or deleting the profile, and contact us for a full copy.
- We do not condition a child's participation on disclosing more information than is reasonably necessary.
3. What we collect
About parents
| Data | Why |
|---|---|
| Email address, display name, sign-in identifier (email/password, Google or Apple sign-in, handled by Google Firebase Authentication) | To create and secure your account |
| Family name and settings (language, currency, narrator voice) | To run the Service for your family |
| Tasks you create, approvals and rejections, reasons you give | Core functionality |
| Subscription and payment status (card details are handled by our payment provider, not stored by us) | Billing |
| Push-notification token and platform | To notify you, e.g. when a task is submitted |
About children (entered by the parent or created by using the kids app)
| Data | Why |
|---|---|
| First name or nickname, birth year (not full date of birth), optional avatar, language, preferred subjects and daily goal | To personalise content by age group |
| Task activity: tasks started and submitted, quiz answers and scores, exercise rep counts and minutes, streaks, points balance and history | To award points and show progress to the parent |
| Photos or videos submitted as task proof (only for tasks that ask for it) | So the parent can approve the task |
| Device name and a sign-in session for the linked device; push-notification token | To keep the child's device connected securely and send reminders |
| Gift card requests and their status | To fulfil rewards the parent approves |
We do not collect a child's email address, phone number, contacts, precise location, or advertising identifier. Children cannot chat with or message anyone through the Service and cannot make their information public.
Technical data
Our servers keep short-lived logs (IP address, time, request path, error codes) to keep the Service secure and working. These logs are rotated and deleted after [14] days.
4. Camera and photos
- Exercise tasks: the kids app uses the camera to recognise body movements and count repetitions. This processing happens entirely on the device (on-device machine learning). Camera frames are not recorded, stored or uploaded; only the result (for example "20 squats in 3 minutes") is sent to our servers.
- Photo proof: some chores or creative tasks ask the child to take a photo or short video. These are uploaded to our own servers, stored privately, and can be viewed only by members of the child's family through short-lived links. Parents can delete them.
- The camera is only used while the child is actively doing such a task, and the device operating system asks for permission first.
5. How we use information
- To provide the Service: create tasks, generate lessons, count exercises, award points, show reports, and deliver approved gift cards.
- To keep the Service safe: prevent fraud and abuse, enforce our terms, secure accounts.
- To communicate with parents about the account (service messages, not marketing to children).
Legal bases (EU/UK): performance of our contract with the parent; parental consent for children's data; our legitimate interest in security; and legal obligations (e.g. accounting).
We do not use children's data for profiling, behavioural advertising, or to train third-party AI models.
6. Who we share information with
We run our own servers for the app's data and files. We share only what each service provider needs, under contracts that limit their use of the data:
| Provider | Purpose | Data |
|---|---|---|
| Google Firebase (Authentication, Cloud Messaging) | Parent sign-in; push notifications | Parent email and sign-in identifiers; device push tokens and notification text |
| Apple / Google sign-in | Optional parent sign-in | As chosen by the parent |
| OpenAI | Generating lesson content | Lesson topic, subject, age group and language only — never the child's name, photos or account details |
| Gift card provider (Reloadly) | Delivering approved gift cards | Product, amount, currency and country |
| Payment provider (Stripe) | Parent subscriptions and payments | Parent billing details |
| Hosting provider [NAME, REGION] | Server infrastructure | All Service data, encrypted in transit |
We do not sell or rent personal information. We may disclose information if required by law, or to protect the safety of a child.
7. No ads, no tracking
The Service shows no advertising and contains no third-party advertising or analytics SDKs. This website uses no cookies and no tracking scripts. [Fonts are loaded from Google Fonts; legal review: consider self-hosting.]
8. How long we keep information
- Account and child data: while the account is active.
- Deleted child profile: removed from active use immediately; permanently erased, together with its photos, within [30] days.
- Deleted account: all family data erased within [30] days, except records we must keep by law (e.g. payment and gift card transaction records, kept for [X] years without children's activity data).
- Backups: overwritten on a rolling basis within [14] days of deletion.
9. Your rights and deletion requests
Parents (and, where the law provides, children) can:
- See their child's information in the parent app, or request a copy (data portability).
- Correct it in the app.
- Delete a child profile in the parent app (Settings → child → Delete), which also disconnects the child's devices.
- Delete the whole account in the app or by emailing privacy@earn2play.net from the account email. We will confirm within [30] days.
- Withdraw consent at any time by unlinking devices or deleting the profile; this does not affect processing that already happened.
- Object or restrict processing, and complain to a data protection authority (in the EU, your local supervisory authority; in the UK, the ICO; in the U.S., the FTC).
To protect children, we verify that a request comes from the parent who owns the account before acting on it.
10. Security
All connections use HTTPS. Uploaded photos are stored in private storage and are only reachable through short-lived signed links. Access is checked on the server for every request so one family can never see another family's data. Gift card codes are stored encrypted. No security measure is perfect; if a breach affects your data we will notify you and the authorities as the law requires.
11. International transfers
Our servers are located in [COUNTRY/REGION]. Some providers listed above process data in other countries, including the United States. Where required, transfers are protected by Standard Contractual Clauses or equivalent safeguards.
12. Changes and contact
If we make material changes, especially to how we handle children's data, we will notify parents in the app and, where required, ask for consent again before the change takes effect.
Questions or requests: privacy@earn2play.net · [POSTAL ADDRESS] · [PHONE, required by COPPA].