Data controller: CodeQuest Ltd · privacy@codequest.app · DPO: dpo@codequest.app
Address: 2389 Edward Leaver Trail, Oakville, Canada
We do not create accounts for children without verifiable parental consent. Before your child can use CodeQuest: a parent (18+) creates and verifies a parent account, reads and agrees to this policy, and creates the child's profile. Children never register directly and never provide personal information to us.
| Data | Why we collect it | Stored |
|---|---|---|
| Display nickname | Personalise the app | Yes |
| Age group (7–9 or 10–13) | Age-appropriate content | Yes |
| Chosen avatar (emoji) | Display in the app | Yes |
| Mission progress, XP, badges | Track learning, parent dashboard | Yes |
| Session activity | Parent activity log | Yes, 90 days |
We use your child's data only to personalise their learning experience, display progress in your parent dashboard, show a leaderboard (nickname and XP only — no personal details), and improve our educational content using aggregated, anonymised data.
We never sell data, use it for advertising, share with third parties for their own purposes, use it to build commercial profiles, or contact your child directly.
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting and infrastructure | USA (us-east-1) |
| Anthropic | AI hint generation (no child data stored) | USA |
| Stripe / Paystack | Parent billing only | USA / Nigeria |
| AWS SES | Parent email communications only | USA |
UK users: Transfer is covered by UK Standard Contractual Clauses. Nigerian users: Covered under NDPA adequacy provisions. Canadian users: Complies with PIPEDA cross-border requirements.
| Data type | Retention period |
|---|---|
| Child profile and progress | Until you delete the account |
| Activity logs | 90 days rolling |
| Consent records | 7 years (legal requirement) |
| Anonymised analytics | Indefinitely (no personal data) |
Review: Request a copy of all data we hold about your child via the parent dashboard ("Download my data") or by emailing privacy@codequest.app. We respond within 30 days.
Delete: Use "Delete Child Account" in the parent dashboard or email privacy@codequest.app. We complete deletion within 30 days and confirm by email.
Correct: Update your child's nickname, avatar, or age group in the parent dashboard at any time.
Withdraw consent: Delete your child's account to withdraw consent and end their access.
Nigeria: Lodge a complaint with the NDPC at ndpc.gov.ng. UK: Contact the ICO at ico.org.uk. Canada: Contact the OPC at priv.gc.ca. USA: Contact the FTC at ftc.gov.
We use TLS 1.3 encryption in transit, AES-256 encryption at rest (AWS RDS), private database subnets, role-based access control, and regular security audits. We will notify you within 72 hours of any breach affecting your child's data.
On pages accessible to children, we use only essential session cookies required for login. No advertising cookies, no third-party tracking pixels, no individual analytics.
When a child requests a hint, we send the mission name, description, and current code/blocks to Anthropic's Claude. No name, location, or identifying information is included. Anthropic does not store these requests beyond the immediate response.
The leaderboard shows only: display nickname, XP total, level, and badges. No real names, location, school, or personal details. You can opt your child out at any time in Parent Dashboard → Privacy Settings.
We will notify you by email at least 30 days before making material changes. Continued use after the effective date constitutes acceptance.
Email: privacy@codequest.app (response within 5 business days for general queries; 30 days for formal data requests)
Data Protection Officer: dpo@codequest.app