BookyPlayPrivacy Policy
The short version
- You can play the free stages without an account. If you sign in, we get your name, email and photo from Google.
- Children don't have accounts. A grown-up signs in and adds nickname profiles with an age band.
- We store learning progress so it syncs across devices and powers parent reports.
- No ads, no advertising trackers, and we never sell or share personal information for advertising.
- Some features use trusted providers (payments, email, AI). We list every one of them below.
- You can ask us to see, correct or delete your data at any time: contact@workcmd.com.
1. Who we are
BookyPlay ("we", "us") is operated by [legal name of the business or person running BookyPlay], [postal address]. We are the data controller for the personal information described here. For anything about privacy, email contact@workcmd.com.
2. What we collect
| What | When | Why |
|---|---|---|
| Google account details: name, email address, profile photo and Google account ID | When a grown-up signs in with Google | To create your account, keep you signed in, link purchases and send account emails |
| Learner profiles: nickname, avatar, colour, age band (for example 7–11), learning goal, and a scrambled (hashed) parent PIN | When you add profiles | To keep each child's progress separate and show age-appropriate content. We never see the PIN itself. |
| Learning progress: answers right and wrong per topic, time played, stages, scores, coins and streaks | While playing. It is kept on the device and synced to your account when you're signed in. | To save progress, bring back missed questions and build parent and teacher reports |
| Play analytics: a random device ID, active play time, answer counts per subject, coins earned and which locked stages were tapped | While playing, whether signed in or not | To understand which games work and to fix problems. It contains no names or emails, and it is linked to your account only if you sign in. |
| Subscription details: plan, status, renewal date and the email used at checkout | When you buy a plan | To unlock paid features. Card details go to Lemon Squeezy and never reach us. |
| Custom subjects: the topic and notes you type | When you create an AI subject | To generate questions for you |
| Voice answers (optional, School Quest only, signed-in users) | Only when you tap the microphone and allow access | To turn a spoken answer into text. We don't keep the recording. |
| Challenge and class data: the nickname or first name a player types, and their results on that challenge | When someone joins a challenge or class with a code | To show the sender or teacher how the player did |
| Settings stored on your device: theme, sound, text size and similar | When you change them | To remember your choices. These stay in your browser. |
We don't ask for or knowingly collect a child's real full name, email, phone number, address, school, photo or location. Please use nicknames in profiles and challenges.
3. Children's privacy
BookyPlay is made for children, so we hold ourselves to the standards of the US Children's Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code and the GDPR's rules for children.
- Accounts belong to adults. Only a parent, guardian or teacher signs in. By signing in and adding a child's profile, you confirm you are that child's parent or guardian, or have the school's permission, and you consent to the processing described here.
- Free play needs no personal information. Unsigned play only creates a random device ID.
- Children's data is used only to run the service: saving progress, adapting questions and reporting to the grown-up. It is never used for advertising or profiling, and never sold.
- No public chat, profiles or friend lists. Challenges and classes are joined by private link and passcode, and only the sender or teacher sees results.
- The parent PIN keeps billing and grown-up profiles out of a child's reach.
- Parents are in control. You can review, export or delete your child's data, or withdraw consent, by emailing us. We'll stop collecting it and delete it.
Teachers using teacher mode act on behalf of their school. They should only invite students with the school's permission and ask students to use first names only.
4. How we use information, and our legal bases
- To provide BookyPlay: accounts, progress, reports, AI subjects, challenges and classes. Legal basis: contract.
- To take payments and manage subscriptions. Legal basis: contract and legal obligation (tax records).
- To keep the service secure, prevent abuse and enforce limits. Legal basis: legitimate interests.
- To improve the games using play analytics. Legal basis: legitimate interests. We use the minimum data, with no names.
- To send emails: a welcome email, receipts, and weekly progress reports on paid plans. You can turn reports off with one click in any report. Legal basis: contract and legitimate interests.
- Voice answers. Legal basis: consent, given through your browser's microphone permission. You can withdraw it at any time.
We don't use automated decision-making that has legal or similarly significant effects on anyone.
5. Who we share it with
We share personal information only with these service providers, only for the purposes above, and under contracts that limit how they use it:
| Provider | What they do | What they receive |
|---|---|---|
| Cloudflare | Hosting, our database and our API | All account and progress data, stored on our behalf |
| Google (Firebase Authentication) | Sign in with Google | Your Google sign-in |
| Lemon Squeezy | Checkout, billing and tax. They are the merchant of record. | Email, payment details and billing country. See their privacy policy. |
| Resend | Sending emails | Email address and the email content (such as a weekly report) |
| OpenAI | Turning spoken answers into text, and generating the coach's voice | The voice clip you choose to record, and lesson text. No names or emails. |
| DeepSeek | Generating questions for custom AI subjects | Only the topic and notes you type. No names or emails. |
We may also disclose information if the law requires it, to protect someone's safety, or as part of a sale or reorganisation of the business. In a sale, this policy would continue to apply to your data. We do not sell personal information, or share it for cross-context behavioural advertising, as those terms are used in US state privacy laws.
6. International transfers
Our providers may process data in the United States, the European Union and other countries, including China in DeepSeek's case. Where data leaves the UK, EU or Nigeria, we rely on adequacy decisions, standard contractual clauses or other safeguards required by law. Please don't put personal information in custom subject prompts.
7. How long we keep it
- Account, profiles and progress: while your account is open. When you ask us to delete your account, we delete them within 30 days.
- Play analytics: kept in aggregate, and deleted or anonymised after 24 months.
- Challenge results: access ends after 48 hours, and results stay with the sender until they delete them or close their account.
- Payment and tax records: for as long as tax law requires, usually 6 to 7 years. These are held mainly by Lemon Squeezy.
- Voice clips: not stored by us.
8. Your rights and choices
Wherever you live, you can ask us to:
- see a copy of your data, or your child's data;
- correct it, delete it, or export it in a portable format;
- stop or limit some processing, or object to it;
- withdraw consent, such as for the microphone, at any time.
Email contact@workcmd.com from the address on your account. We'll reply within 30 days, and we may need to confirm it's you. We won't treat you differently for using these rights.
United Kingdom and European Union
You have the rights above under the UK GDPR and the EU GDPR. If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live. We'd appreciate the chance to fix it first.
Nigeria
We process personal data in line with the Nigeria Data Protection Act 2023. You have the rights it gives you, including access, correction, erasure, data portability and objection, and you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
United States
Parents have the rights COPPA gives them: to review their child's information, have it deleted, and refuse further collection. Residents of California and other states with privacy laws can request access, deletion and correction. We don't sell or "share" personal information.
9. Cookies and local storage
We don't use advertising or cross-site tracking cookies. BookyPlay saves your settings, progress and a random device ID in your browser's local storage so the games work and keep your progress. Google sign-in may set cookies it needs to sign you in. Clearing your browser data removes what's stored on that device.
10. Security
Data is encrypted in transit (HTTPS) and stored with our hosting provider under access controls. Parent PINs are hashed, and payment card details never touch our systems. No system is perfectly secure. If a breach affects you, we'll tell you and the regulators as the law requires.
11. Changes to this policy
If we change this policy, we'll update the date at the top. If we make a significant change, especially about children's data, we'll tell account holders by email or in the app before it takes effect and ask for fresh consent where the law requires it.
12. Contact us
Email contact@workcmd.com, or write to [postal address].