FOR OUR FAMILIES

Privacy Policy

Last updated September 7, 2026

Cosmic Quest is a free, ad-free math learning app for children, with family accounts managed by a parent or legal guardian. This policy explains the information used to run the app and the choices available to families.

What we collect and why

• Grown-up account: email address, account identifier, verification status, permission records, and account activity dates. We use these to authenticate you, contact you about your account, and record your permission.
• Private explorer profiles: a selected space avatar, profile identifier, math practice history, a rounded typical answer speed per puzzle type (a single figure each, never timestamps) that sets the pace of the racing games and how many coins a quick answer earns, difficulty and sound settings, Pip’s chosen outfits, the child’s pretend planet (buildings, inventions, creatures, and in-game coins and sparks), the calendar date of their most recent visit (used only so crops and eggs appear overnight), and the fictional worlds and short storybook from earlier story adventures. These let each learner continue and receive appropriately paced practice across devices. Each explorer is a space friend; a parent may optionally add a first name or nickname and a spelling of how to say it, shown on screen and used in a few spoken cheers, and may change or remove it at any time.
• Private usage statistics: daily completed puzzles and missions, approximate active play time, and return visits for each explorer. Play time is measured while the game is visible, focused, and recently used. We use these totals and selected practice grades to understand progress and improve the app. Authorized administrators see summary reports, not a public activity feed.
• Approximate signup country: we look up the parent’s signup connection IP address in a database on our server and save only a country code with the family account. This is an estimate and can be wrong, especially with VPNs. We do not save that IP address in analytics, obtain precise location, or send the IP to a lookup service. Anonymous signup totals by day and country contain no family identifiers and remain after account deletion.
• Authentication and security: temporary verification records, session cookies, rate-limit counters, and, if you choose passkeys, public cryptographic keys and related device-credential information. We do not receive fingerprints, face scans, or device PINs.

The app does not ask children for names, email addresses, birthdays, school details, precise location, photographs, or voice recordings. Only a verified parent can add an explorer’s optional name. There are no public profiles, chat, advertising trackers, or third-party analytics trackers. We do not sell personal information or use it for targeted advertising.

Parent permission

A parent or legal guardian verifies their email and separately gives permission before creating cloud-saved learner profiles. We send a follow-up confirmation of permission with withdrawal instructions. Email verification establishes control of an inbox; it does not independently verify someone’s age or guardianship. Passkeys also do not prove guardianship.

We collect only the information needed to provide the learning features. A verified family account and parent permission are required to play. Children use a private explorer profile and do not need their own email address.

Service providers

Amazon Web Services (AWS) hosts the app and its database. Amazon Simple Email Service (SES) delivers account verification, parent notices, and contact-form messages. These services process information needed to deliver, operate, and secure the service. Infrastructure services receive technical request information, such as IP addresses and browser details, and may maintain service or security logs. The app does not add IP addresses to learner profiles.

Optional fresh stories are generated through Microsoft Azure OpenAI. The request contains only a destination, a fictional brief (a goal, an opening spot, a friend, and a playful complication), and the titles and objects of adventures already written for that world. It contains no parent email, explorer identifier, answers, or learning history. Written adventures are kept in a shared storybook and served to other explorers; we record which storybook adventures each explorer has heard so none repeats for them. We request that generated responses are not stored through the response-storage feature. Provider service and abuse-monitoring practices still apply. We keep provider request dates, model names, token counts, and completion status to estimate operating costs, without account identifiers or prompt text. Ready-made stories remain available when generation is disabled or unavailable. When ending pictures are enabled, the finished adventure’s own text and the world’s scene illustration are sent to Google Gemini to draw one picture per adventure; the request contains no account, explorer, answers, or learning history, and the picture is cached by its content on AWS storage and shared by every explorer who hears that adventure.

Recorded math audio is delivered as app assets created in advance using ElevenLabs. New story narration sends the displayed story passage to ElevenLabs to create speech, without account or explorer identifiers or learning history. If a parent adds an explorer’s name, the short cheers that include it, such as “Great job, Aiden!”, are sent to ElevenLabs the same way. Generated audio is cached by its content on AWS storage so it can be reused. The app does not use the microphone or record a child’s voice.

Cookies and device storage

Essential, HttpOnly cookies keep the grown-up account logged in for up to 30 days and hold temporary verification challenges. Account cookies are not stored in browser local storage. The hosting platform may use its own essential cookies. Local preferences use browser storage. Older versions may have saved guest adventures in your browser; these are no longer used and are not automatically transferred into a family account. You can remove old guest data by clearing this site’s browser storage. Family progress is stored in the account database; signing out ends access from that session.

On a shared device, close grown-up settings or begin a child’s adventure to require another email or passkey verification for sensitive account actions. Anyone able to unlock a device or use its passkey may be able to sign in. Use a grown-up’s personal device for passkeys.

Review, download, delete, or withdraw permission

Visit Family space and verify your email or passkey to review profiles, download family information, delete an explorer, remove passkeys, or delete the entire family account. Deleting the family account withdraws parent permission, removes all profiles and credentials from the active database, and invalidates all its sessions. You may also contact the operator below for help. We may ask for reasonable evidence that you control the account before providing private information.

Deleting one explorer leaves other family profiles intact. Deleting family data does not erase any legacy guest save left by an older version on a device. Clear that site’s browser storage to remove it. Queued permission confirmations are canceled when you delete the account. A message already being sent may still arrive.

When you contact us

The Contact us form lets a grown-up send feedback, a bug report, a note, or an account question. We receive the topic and message you choose to send, plus a grown-up email address only if you provide one for a reply. The form does not automatically attach family account, explorer, page, or device details. Please avoid sending children’s personal information or verification codes. We use your correspondence to respond, resolve issues, and improve the app.

Form messages are delivered by email to the operator’s inbox. Message bodies and reply addresses are not saved in the app database. Anonymous hashes help limit abuse and prevent duplicate submissions. Email providers process these messages, and copies remain in the operator’s inbox under its retention settings. If you email our support address directly, your email includes your sender address; it is received through Amazon SES, stored in private, encrypted AWS storage with a 30-day expiration rule, and forwarded to the operator’s inbox. That expiration rule does not delete the inbox copy.

Retention

One-time codes expire after 10 minutes; passkey challenges expire after 5 minutes. Expired authentication records and rate-limit records are removed by daily maintenance. Unconsented accounts are removed after 7 days. Family accounts and their learner data are removed after 365 days without account login or saved learning activity. Daily activity totals and operating-cost records are kept for up to 365 days; temporary heartbeat records used to avoid counting retries expire after 30 days. You can delete earlier at any time. Consent evidence remains with the account for the duration of that account. Anonymous signup totals are retained separately and cannot be linked back to your family.

Account deletion removes active family, profile, session, and passkey records immediately. Short-lived security counters expire through daily maintenance. Infrastructure backups may retain deleted data until their configured expiry, up to 30 days for the app database. Email delivery records and hosting security logs are subject to the providers’ retention settings and applicable legal requirements. Restoring a backup must preserve deletion requests. We do not use backups to reactivate a deleted account.

Security and legal requests

We use encrypted network connections, restricted server access, one-time verification, and account ownership checks. No service can promise perfect security. We may disclose information if legally required, to respond to a valid legal process, or to protect the service and its users. We restrict service providers to the purposes needed to operate and secure the app.

Changes

We will update this notice when practices change. Material changes affecting the collection, use, or disclosure of children’s information require renewed parent notice and permission before those changed practices apply.

Contact the operator

Omer Liran, MD, MSHS
support@cosmicquest.me