Privacy policy
Summary
WizPlayo is a learning app for children aged 4 to 10. It has no accounts, no ads, no analytics or tracking tools, and no chat or social features. While a child learns and plays, progress stays on this device.
Optional features that send information to WizPlayo's server are Feedback and bug reports, Sync across devices (encrypted on the device before sending), Premium through Google Play, and review access codes when enabled. These are in the parent area. Feedback, sync and review-code entry run only when an adult presses the button; an existing purchase may be checked automatically when the app opens. See the separate sections below.
Data stored on the device
To remember how far a child has got, the app stores the following in its own private storage on the device. It is not sent to the developer or anyone else unless a parent turns on Sync across devices:
- The child's profile: a display name entered by a parent (a nickname works), an avatar and an age group (4-5, 6-7 or 8-10). The app does not ask for a date of birth or exact age.
- Learning progress: stars, lessons completed, day streaks, quests, rewards and stickers.
- What a child creates or collects: the companion (including a nickname the child gives it), the room, drawings and builds in the Studio, animals met, dishes cooked and stories read.
- Results of two-player rounds, and flash-card decks written by a parent or teacher.
- Settings: sound, question read-aloud, motion, language.
- Voice and sound files downloaded for offline use.
- If Premium is used: the Premium licence (signed, short-lived) and a random installation code. These are exchanged with the server as described in “Premium plan”.
Optional features in the parent area
These two features are in the parent area (behind the adult gate) and never run on their own. Premium and review access are described in their own sections below:
- Feedback and bug reports: the text a parent types; contact details if the parent wants a reply; and, if the parent leaves the switch on, technical details: app version, language, device or browser type, screen size, the screen that was open and the number of child profiles. A child's name and progress are not sent. The message is stored on WizPlayo's server, can be read only by the people who make the app, and is kept for up to about 13 months.
- Sync across devices: when a parent creates or enters a code, the profiles and progress (names, avatars, age groups, stars, completed lessons, companion, decks) are encrypted on the device with a key derived from the code before being sent. The server stores only the encrypted text, a revision number, the update time and a hash of the sync code; the developer cannot read the contents. Anyone who has the code can open the data, so keep it like a password. Data that is not updated is deleted automatically after about 13 months.
Premium plan (optional)
Premium is an optional subscription that only an adult buys, in the parent area, through Google Play. Children have no buy button. Google Play processes the payment: WizPlayo does not receive or store your card number, payment account or Google email address.
When you buy, restore a purchase, or open the app after subscribing, the app sends the information below to WizPlayo's server. The server asks Google Play whether the plan is still valid and returns a signed “licence” that works for up to 7 days; the app refreshes it when online and keeps working for up to 3 more days without a connection. Without a connection, or without Premium, the free content plays normally.
What the server holds is one-way hashes and a few plan details; no name, email, phone number, card details, or a child's name or progress. Premium content and a child's learning progress are not sent.
- The transaction code (purchase token) Google Play issues for the subscription. The server does not store this code, only its hash.
- A random installation code the app creates the first time you use Premium. It is not tied to the hardware, is not an advertising ID, does not identify you, and is lost when the app is uninstalled. It limits how many devices share one plan (currently 5 active devices within 30 days) and is passed to Google Play as the purchase's anonymous account code.
- The server stores: hashes of the transaction code, the installation code and the anonymous account code; the plan (monthly or yearly); the status; the expiry date; whether it auto-renews; the update time; and a flag for test purchases.
- Google sends notifications (refund, cancellation, renewal) to WizPlayo's server through Google Cloud Pub/Sub. A notification contains the transaction code; the server always asks Google for the real status before updating anything.
Review access codes
When enabled, this feature lets an adult enter a reusable review access code in the parent area to inspect all content without buying a plan. The app sends the code to the server over HTTPS for checking. The server configures only a hash of the accepted code; the app does not save the entered code and the server does not add it to logs or purchase records. This does not create a Google Play transaction, account or separate device identifier.
The server returns a signed licence containing a reference derived from the code hash and issue/expiry times. It is stored separately on the device, does not replace a purchased licence, and lasts up to 24 hours without additional offline grace. After expiry, enter the code again online. Removing review access deletes this licence from the device; a storage failure is reported rather than saying removal succeeded. Rotating or disabling the server code prevents new licences; an issued licence may remain usable until its 24-hour expiry.
For rate limiting, the server retains a hashed network address and request count for a few hours under the infrastructure and retention mechanisms described below. The feature sends no child profiles, stars, learning progress or creations, and does not change or erase purchased Premium rights.
Microphone
The app asks for microphone permission only in the Studio (Voice changer and Sing-along), when a child taps the speak or sing button. Audio is processed temporarily in the device's memory so it can be played back with an effect. It is not saved as a file, not sent anywhere and is discarded when the child leaves that screen. If the button is not tapped, the app does not use the microphone. A parent can withdraw the permission at any time in the device settings.
Reading questions aloud
Questions are read aloud using voice files that come with the app, or the device's built-in voice when a file is missing. The app only picks voices that run on the device itself, so the text of a question is not sent over the internet to be read.
Data we do not collect
The app does not ask for or collect: real names, a child's email address, phone numbers, photos, camera images, location, contacts, advertising identifiers or hardware device identifiers (such as IMEI, MAC address or serial number). Only when Premium is used, the app creates a random installation code as described above. It contains no ads and uses no third-party tracking tools.
The contact field in Feedback is an optional field for parents; please do not enter a child's details there.
Children
WizPlayo is for children aged 4 to 10 and is designed so that learning and playing do not require personal information. Anything that sends data off the device, and other sensitive actions, are in the parent area behind the adult gate. The app has no ads and no chat or social features. Buying Premium is done only by an adult in the parent area. It does not receive or store payment card or bank account details.
Servers and infrastructure providers
The website and the server features described above run on the Cloudflare platform (Pages, Functions, Workers KV and the D1 database). As with most web services, the infrastructure provider may keep ordinary technical logs when a device connects, such as the IP address and time of access. The app adds nothing to those logs and WizPlayo does not use them to identify a child. To limit abuse, the server briefly (a few hours) keeps a one-way hash of the sender's network address; the raw IP address is not stored in feedback, sync or Premium data. Premium also uses Google Play (payment and plan verification) and Google Cloud Pub/Sub (notifications from Google to the server); Google handles payment information under Google's own policies.
How long the server keeps data
Each kind of data has its own retention period; when it ends the server will delete it and you do not need to do anything. The dates below are target retention periods, not a promise to delete on the exact day (see the note at the end of the list):
- Feedback and bug reports: up to about 13 months.
- Sync across devices: deleted automatically after about 13 months without an update, or immediately when a parent chooses to delete it.
- Premium, plan record (hashes, plan, status, expiry date): kept while the plan is valid and deleted about 90 days after the expiry date or the last update, whichever is later.
- Premium, the mark for a refunded transaction or one replaced by another plan: kept about 400 days after the expiry date or the last update (whichever is later), then deleted. Its only purpose is to make sure a refunded or replaced transaction cannot be used again; it is just a hash and a status, with no information about you.
- Premium, device record (hash of the installation code, first and last use): deleted after 30 days without use.
- Google notification IDs already handled: 14 days. Abuse-prevention counters: a few hours.
- Note on when deletion happens: the server clears expired data at random whenever it handles a write, not at a fixed time. A record can therefore stay longer than the period above (longer still when the app has few users), and we do not guarantee deletion on the exact day it expires. Data past its period is not used for any other purpose; the mark for a refunded or replaced transaction is used only to stop that transaction being reused, as described above.
- On your device: the Premium licence and the installation code stay in the app's private storage until you uninstall the app or clear its data.
Your choices and deleting data
WizPlayo has no accounts, so there is no account to delete. A parent can:
- Edit a profile, reset progress or delete a child's profile entirely in Settings (behind the adult gate).
- Uninstall the app to remove all data stored on that device.
- Delete synced data from the server on the Sync across devices page (the button that stops syncing and deletes the data on the server).
- Ask for a submitted feedback message to be deleted by contacting us at the address under Contact.
- Cancel the Premium plan in Google Play (Play Store, Payments and subscriptions). Google Play handles cancellations and refunds. Premium data on our server has no name or email, so we cannot find your own record by ourselves; it is deleted automatically after the periods in the section above. Uninstalling the app deletes the installation code and licence on the device, and the matching device record on the server is deleted after 30 days.
Scope of this policy
This policy describes how the app actually handles data as of the date above. We design the app to collect as little data as possible and take data-protection and children's privacy rules into account. This policy is not a certification or a claim of compliance with any specific law.
Changes to this policy
If this policy changes, we will update it here with a new date. Last updated: 22 Oct 2026.
Contact
Privacy questions: WizPlayo, [email protected].