Privacy Policy

When a grown-up finishes a player's sign-up

Players under 16 sign up by asking a parent or guardian to finish their account. The player enters a nickname, an age range and the grown-up's email address. We send one email to that address (through Resend, see below) with a link to finish the account and a link to stop these emails. So we use a grown-up's email address before they have agreed to anything, and we got it from the player, not from them. While the request waits, we store in our database at Supabase in Ireland: the nickname, the age range, the language, the page to return to afterwards, the email address in clear text (to send the email and show it on the finish page), a coded version of the address (keyed hash), a coded version of the player's IP address (keyed hash, never the IP address itself), the two links only as hashes, when the request was made, and when and how often the email was sent. Legal basis: our legitimate interest in letting children under 16 sign up only through a parent or guardian, and in stopping anyone from using this to send many emails to someone (Art. 6(1)(f) GDPR).

Nothing is created until the grown-up opens the link, ticks the box and presses the button. The account is then created with the grown-up's email address as the account's email, so sign-in links go to them. We store when they confirmed, which version of the confirmation text they saw and which version of the Terms of Service applied. Legal basis: the contract for the account, which the grown-up agrees to for the player (Art. 6(1)(b) GDPR; § 107 German Civil Code). On the same page they can, separately, allow the player to make games from photos of their book pages (see “Parent approval”). The player's browser then signs in by itself with the device cookie gp_signup (see “Advertising and tracking”).

To stop misuse, one request sends at most 5 emails, at least 2 minutes apart; one address gets at most 3 of these emails a day and 6 in 30 days, from any device; and one IP address can make at most 5 requests a day. We delete the email address in clear text at once when the player replaces the request with a newer one, at once when the grown-up finishes (it is then the account's email), and otherwise at the first daily clean-up after the link expires: the link works for 7 days, so we keep the address for 8 days at most. An unfinished request, by then holding only the coded address, is deleted 30 days after it was made; until then we need it for the 30-day limit. For a finished account we keep the record of the request and the confirmation until the account is deleted, and delete the links' hashes once the links can no longer be used.

The grown-up can object to this at any time (Art. 21 GDPR). The easiest way is the “Stop these emails” link in the email. Opening that page changes nothing; only its button does. The button deletes every unfinished request to that address and puts a coded version of the address (keyed hash), never the address itself, on our list of addresses that asked us to stop, so later requests send nothing. It stays on that list until the grown-up asks us to remove it. To remove it, or to object without the link, write to privacy@genioplay.com; we handle objections sent there the same way. All the rights under “Your data” apply too.

Advertising and tracking

GenioPlay does not show third-party ads and does not use advertising or cross-site tracking cookies. We only use cookies the site needs to work: the sign-in cookie if you have an account; a language cookie (NEXT_LOCALE) that remembers your language until you close the browser; if you use photos of your pages to make a game or report a game made by a player, a device cookie (gp_device) holding a random code, kept for up to a year; and, while a player waits for a grown-up to finish their sign-up, a device cookie (gp_signup) holding a random single-use code that lets this browser sign in once the account is finished, kept for up to 7 days and deleted as soon as the browser signs in. These cookies are strictly necessary, so they need no consent (§ 25(2) no. 2 TDDDG). Game progress without an account, the last game and level you played (so the home page can offer “Continue”), your chosen home country and your sound and calm-mode settings are saved only in your browser (local storage).

Usage statistics

To see which games children enjoy and where they get stuck, we count anonymous events — for example "a level was started" or "a level was completed", with the page language. We use PostHog, hosted in the EU, without cookies and without storing anything on your device, so each visit is counted separately and we cannot follow a person from one visit to the next. We never send names, nicknames or email addresses, never record the screen, and never use this data for advertising.

Making a game from your book

This section applies when you use photos of your pages to make a game. You upload photos of the pages you are learning from; your browser re-saves each photo before upload, which removes hidden location data. We use the photos only to make your game: an AI model reads the pages and writes new questions about them, and a second AI check compares every question with the pages. Please photograph only the page, without names, faces or school details: if a photo still shows personal details, we delete it at once and ask you to take that page again. Photos are kept in a private storage area at our database provider Supabase in Ireland. We delete them as soon as your game is ready or the pages can't be used, and otherwise at the latest 2 days after upload. We never keep the photos or the book's text: we keep the game, a short summary of the topic and the key facts the AI found, which we use to check the questions. If the game is deleted, we delete these too: if you deleted it, after 3 days without activity if you have no account, 30 days with a free account or 90 days with a subscription or trial, but not before the end of the month the game was made; if we removed it, 6 months after we removed it, so you can still see our reason and appeal. If a game is never finished, we delete what was saved for it after 3 days without activity if you have no account, 30 days with a free account, or 90 days with a subscription or trial. If the AI declines the pages or finds them unsuitable, we keep a record of that, without photos or text, for 3 months to prevent misuse. Legal basis: providing the service you asked for (Art. 6(1)(b) GDPR).

Before the AI reads the pages, a tick box asks you to confirm that a parent or guardian said yes (or that you are an adult) and that you agree to our Terms of Service. We save when it was ticked and which version of the Terms applied. Without an account you can try a free preview, at most 3 per device and 10 per network in 24 hours: to count them, we store a coded version (keyed hash) of the device cookie and of your IP address with the preview, never the IP address itself.

Our AI provider: Anthropic

The AI model is Claude, run by Anthropic Ireland, Limited, as our processor under a data processing agreement. Anthropic processes the photos and our instructions on servers in the USA and possibly in other countries outside the EU. These transfers are protected by the EU Standard Contractual Clauses in Anthropic's agreement; you can ask us for a copy. We send Anthropic no name, nickname or email address. Anthropic deletes its copy within 30 days and does not use it to train its models. If its safety systems flag a request as possible misuse, it may keep it for up to 2 years.

Parent approval

Players under 18 can build a game only after a parent or guardian has approved it, once, by email. The player enters the parent's email address, and we send one email to it (through Resend, see below) with a link to approve and a link to withdraw. We don't keep the address in clear text. We store a coded version of it (keyed hash), to spot one address approving many accounts and to match a withdrawal; the two links, only as hashes, with their expiry; when the email was sent and how often; when it was approved or withdrawn; and which version of the approval text the parent saw. The approval link works once and expires after 7 days. A parent can withdraw at any time with the link in the email or by writing to privacy@genioplay.com; the player then can't build new games. A parent who finishes a player's account can instead allow it on that page, with a separate box: we then store the same things (the address is the account's email anyway), with that page's version of the approval text, keep the Terms version with the finished request, and send one email with the link to withdraw. All of this is deleted with the player's account. Legal basis: our legitimate interest in protecting children and in being able to show the approval (Art. 6(1)(f) GDPR).

Public games and reports

Games that players make from photos of their pages can be played by anyone with their link. If the creator chooses “Everyone”, a person on our team checks the game before it appears in our game lists. Anyone can play them, and they show the creator's nickname, also on a page listing that player's public games, which we ask search engines not to index. We count plays of every game, ours and players', per finished level: we store how many and the date of the last play, keyed to a coded version (keyed hash) of the account or, without an account, of the IP address, never the account id or IP address itself. Our team sees only totals per game, and we delete these entries 12 months after the last play (our legitimate interest in knowing which games are played, Art. 6(1)(f) GDPR). Signed-in players can give a thumbs up or down, saved with their account. Anyone can report a game, with or without an account, with a reason and an optional note. For a report from a signed-in player we store the account; without an account we store a coded version (keyed hash) of the device cookie and of the IP address, never the IP itself, so each person can report a game once and we accept at most 10 reports per IP address in 24 hours. Three reports from different people hide a game until we have checked it. We record each decision (what, when and why) and show the creator the reason when a game is removed. We delete reports, and our record of each decision, 12 months after the report has been dealt with, so we can still handle an appeal until then; reports are deleted earlier if the game is deleted, for example when its creator deletes their account. Legal basis: our legitimate interest in keeping games safe for children, and our duties as a platform to handle reports (Art. 6(1)(f) and (c) GDPR; Art. 16 and 17 DSA).

Safety counters

To spot problems early, we count safety events when games are made from photos of pages: for example a photo that showed personal details, pages that weren't learning material, a request the AI declined, or a question the check flagged as unsafe. We store only the kind of event, how many and when: no photo, no text and nothing about who it was.

Messages to us

When you write to us through our contact form, we store your email address (to answer), your name if you give it, the topic and your message. When you email an @genioplay.com address, such as hello@ or privacy@, we store the sender, the address it was sent to, the subject and the text; attachments stay only at Resend. Both land in our own inbox, in our database at Supabase in Ireland, and we forward a copy to our mailbox at Yahoo Mail. Yahoo EMEA Limited (Dublin, Ireland) provides that service as its own controller and may process data in the USA and other countries outside the EU, relying on adequacy decisions (including the EU-US Data Privacy Framework) and the EU Standard Contractual Clauses. To stop abuse of the form we store a coded version (keyed hash) of your IP address, never the address itself, and accept at most 5 messages an hour. We delete messages about legal or privacy matters 3 years after we have dealt with them, and all other messages after 1 year; the same applies to the copies in our mailbox. Legal basis: answering you (Art. 6(1)(b) and (f) GDPR); for a privacy request, our legal duty to answer it (Art. 6(1)(c) GDPR).

Emails we send and receive

We send and receive email through Resend (Plus Five Five, Inc., San Francisco, USA), our processor under a data processing agreement. This covers sign-in and sign-up emails (Supabase creates the link and hands the email to Resend), the email asking a parent to finish a player's account, the email asking a parent to approve their child making games from photos of their book pages, forwarding messages from our contact form to us, and receiving emails sent to an @genioplay.com address. Emails leave from servers in Ireland, but Resend stores their content and logs in the USA. Resend is certified under the EU-US Data Privacy Framework, and the EU Standard Contractual Clauses apply as well. Resend keeps email data for 30 days.