Your family’s privacy
Version 2026-09-29-v1 · Read the child-friendly version
Draft for review before family registration opens. The operator must complete their details, lawful-basis assessment and provider information.
Who looks after the information?
is responsible for the personal information used by Kitty Quest. Privacy contact details will be provided before registration opens.
What we keep and why
- Your parent email, email-confirmation record, a protected parent PIN, session records and dated choices: to provide and protect your family account.
- Each child’s private nickname, chosen background, cat collection, game progress, answers, hint use and practice dates: to run their adventure and show you useful learning insights.
- Feedback and data requests you send: to improve the beta, resolve problems and answer your requests.
- A short-lived protected record derived from an IP address or email: to limit repeated sign-in requests. The app does not retain raw IP addresses in its database.
We do not ask for children’s email addresses, full names, dates of birth, photos, school names or location. Please avoid adding them to nicknames or feedback. Parent dashboards show learning activity; children are told this in the child-friendly notice. The app does not include advertising, chat between players, advertising trackers or purchases for real money.
Why we are allowed to use information
Optional public scores and optional testimonials require a separate permission choice. Declining these does not affect access, learning rewards or prize eligibility. You can withdraw permission in the parent area. Where processing relies on consent for a child under 13, it must be authorised by a person with parental responsibility. Email confirmation confirms control of the inbox, not parental responsibility; the operator must assess whether its verification measures are sufficient for this service.
Who can see it?
Your family’s private records are available to your parent account and to the operator when needed to maintain the service or handle a request. Child profiles are private by default. If you enable public scores, anyone can see the generated cat nickname, identifier badge, scores, rank, lifetime XP, best recorded table time and learning cat. This is pseudonymous information, not anonymous information to us. Turning sharing off removes the entry from our public pages; it cannot remove a copy someone else has already made.
Reviews only appear on the landing page when you permit publication and the operator approves the exact text. They are attributed to “A Kitty Quest parent”. You can withdraw permission from the parent area.
Hosting and email providers
Hosting: . Data location and international-transfer arrangements: .
Access emails are delivered through Resend when connected. It receives the parent email and the access email contents; it is not sent child progress. The VPS provider processes network traffic and storage. Provider processing agreements, transfer arrangements and any provider log retention must be assessed by the operator before launch.
How long we keep it
Single-use access links expire after 15 minutes. Browser sessions expire after 30 days. Expired token, session and rate-limit records are removed by the daily maintenance job. Detailed question and hint events are kept for 90 days; the dashboard displays the latest 28 days. Saved cats, aggregate game progress and the reward ledger remain until the profile is deleted. We retain action identifiers to prevent duplicate rewards, but remove detailed results from those receipts after 90 days. Feedback is retained for up to 180 days, except a review you have permitted and which is currently published.
Family accounts inactive for 12 months are deleted by the daily maintenance job. You can delete profiles or the whole family account at any time. Active-database deletion happens immediately; daily backup copies expire within 30 days. The operator must apply the separate deletion record before restoring an older backup, so deleted profiles do not return. The minimal deletion record contains internal IDs and is retained for 35 days.
Cookies and browser storage
An essential session cookie keeps your parent account and selected child signed in for up to 30 days. The game stores a sound preference in your browser. There are no analytics or marketing cookies in this version. Sign out on shared devices when finished.
Your rights and choices
You can download family data, change sharing choices, withdraw review permission and delete data in the parent area. Contact us to request access, correction, restriction or objection where applicable, or to ask for help with your child’s rights. You can also complain to the UK Information Commissioner’s Office. Requesting help or withdrawing optional permission does not take away game rewards.
Changes
We will update this notice when the way the service uses information changes, and request a new choice where needed. Registration and sharing decisions are recorded with their wording, version and time.