Privacy Policy

1. Introduction

This privacy policy (“Privacy Policy”) applies to the collection, use, disclosure and processing of personal data (“Personal Data”) by Alpha World (“we”, “us”, “our” or the “Studio”) in connection with our website, the “Alpha World” applications, the “Parent App” and any related online or offline services (collectively, the “Services”).

Alpha World is a digital platform designed for children of the Gen Alpha generation (typically ages 5 to 15) and their parents or legal guardians. Privacy and child safety are central to our product design. This Privacy Policy will help you understand what data we collect, how we use it and the choices and rights you have.

By accessing or using the Services, or by allowing your child to do so, you confirm that you have read, understood and agreed to this Privacy Policy. If you do not agree, please do not use the Services.

2. Personal Data we collect

Personal Data includes any information about an identified or identifiable individual. It does not include anonymous or aggregated data from which an individual cannot reasonably be identified.

2.1 Information you provide to us

• Contact data — first and last name, email address, phone number, where required to respond to a request.
• Profile data— the display name, username, avatar, age or stated date of birth, password (always stored as a salted, one-way hash), 4-digit child PIN (hashed) and optional profile preferences you set on your or your child's account.
• Parental / guardian data— for child accounts, the parent's name, email, 6-digit parent PIN (hashed) and parental approval records.
• Communications — messages exchanged with us through the website, app, email, support tickets or help channels.
• Transactional data — order numbers, energy-pack upgrades, payment confirmation tokens and transaction history. We do not receive or store complete card numbers, CVV or expiry dates.
• User-generated content — drawings, safe chat messages, gallery posts, comments and AI prompts that you or your child voluntarily submit through the Services.

2.2 Information collected automatically

• Device and log data — device type, operating system, browser, app version, language, time-zone, anonymized IP address (truncated for child accounts), access timestamps and crash diagnostics.
• Service usage data — features used, time spent in each mini-app, energy earned and spent, streaks, achievements and similar engagement signals required to operate parental controls and time-limit enforcement.
• Safety and moderation signals — reports submitted, automated content-moderation flags, ban or mute history. These are used solely to keep the Services safe.

We do not use cross-app or cross-site tracking technologies for advertising purposes within Alpha World. We do not allow third-party advertising SDKs inside the Services.

2.3 Permissions we may request

• Notifications — for time-limit alerts, parent approval requests and important account messages.
• Camera / Photos — only if the user actively chooses to upload a study photo or change their avatar; we never access the camera in the background.
• Microphone — only when the user explicitly activates an audio feature; the microphone is never opened in the background.

You can revoke any of these permissions at any time through your device settings.

3. How we use your Personal Data

We process Personal Data only where we have a lawful basis to do so, including to:

• Provide, operate, maintain and personalize the Services that you or your child request.
• Authenticate users, manage accounts and enforce parental controls and maturity-level settings.
• Process parent requests for energy packs and respond to parent purchase-approval requests.
• Communicate with you about your account, security notices, service updates and answers to your questions or feedback.
• Operate safety, moderation and anti-fraud systems, including detecting harmful behaviour and managing reports and bans.
• Improve content, user-experience, performance and reliability of the Services through aggregated, de-identified analytics.
• Send service updates and, with your explicit opt-in, occasional newsletters (you may unsubscribe at any time).
• Comply with our regulatory, accounting, and other legal obligations.
• Resolve disputes, enforce our Terms and Conditions and protect our or others' rights, property or safety.

We do notuse children's Personal Data for any form of behavioral, contextual or personalized advertising, and we do not profile children for advertising or any other commercial purpose unrelated to operating the Services.

4. Children's privacy & verifiable parental consent

Alpha World is directed to children. We are committed to complying with the United States Children's Online Privacy Protection Act (“COPPA”), Google Play's Families Policy Requirements, and the EU/UK General Data Protection Regulation (GDPR — including Article 8 on children's consent and the UK Age-Appropriate Design Code).

4.1 Age gate and consent

• An age-screening (“neutral age gate”) is presented before any account collecting Personal Data is created.
• For any user under 13 (or under 16 in jurisdictions that require it), the account is created in a restricted state, marked consentVerified = false, and login-required features are disabled until verifiable parental consent is obtained.
• Parental consent is obtained through either (a) approval inside the dedicated Parent App, or (b) a signed parental-consent email containing a one-time secure token, valid for 7 days. Both methods produce an auditable record stored against the child's account.
• Where required, the parent must confirm they are the parent or legal guardian and consent to the limited collection described in this Privacy Policy.
• Parental consent can be withdrawn at any time by emailing admin.alphaworld@gmail.com.

4.2 Limited collection for children

• We collect only the minimum data necessary to operate the Services for children.
• We do not condition a child's participation in any activity on the disclosure of more Personal Data than is reasonably necessary.
• We do not knowingly collect precise geolocation data from children.
• IP addresses associated with child accounts are truncated and used solely for security and abuse prevention.

4.3 Parental rights and controls

• Parents may at any time review the categories of Personal Data we have collected about their child.
• Parents may request correction or deletion of their child's Personal Data and may revoke consent for any further collection or use.
• Parents have access to a Parent App dashboard to set mini-app toggles, daily time-limits, maturity level and purchase-approval requirements.
• All in-app purchases of energy packs require explicit parent approval; children cannot complete purchases on their own.

4.4 No advertising to children

We do not show third-party advertisements, behavioural ads or interest-based ads to any user, and we do notshare children's Personal Data with advertising networks, data brokers or analytics partners that use the data for advertising. This is a fundamental product commitment.

5. Who we share your Personal Data with

We do not sell, rent or trade Personal Data. To operate the Services, we share Personal Data only with carefully selected, contract-bound third parties, and only to the extent reasonably necessary:

• Cloud and infrastructure providers — including Google Firebase (Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Storage, Hosting) which provide the underlying secure infrastructure for the Services.
• Payment processors — certified third-party payment gateways and financial institutions that process payment transactions on our behalf. Card and wallet details are submitted directly to these processors and are not visible to or stored by us.
• Communications providers — email-delivery and push-notification services strictly used to send transactional and safety-related messages.
• Safety and moderation partners — automated content moderation and abuse detection tools, where used.
• Professional advisors — auditors and legal advisors bound by confidentiality.
• Authorised disclosures — regulators or law-enforcement authorities where required by valid legal process, or to protect the vital interests, rights or safety of a person.

6. International data transfers

Our infrastructure providers may store or process Personal Data on secure cloud servers located globally, including regions covered by Google Cloud / Firebase. We rely on legally recognised transfer mechanisms (such as the European Commission's Standard Contractual Clauses, where applicable) and contractual safeguards to ensure that your data continues to receive a level of protection consistent with this Privacy Policy.

7. How we protect your Personal Data

We make reasonable, industry-standard efforts to ensure a level of security appropriate to the risk associated with the processing of Personal Data, including:

• TLS encryption for data in transit and at-rest encryption for data stored on our managed cloud infrastructure.
• Tokenised payment processing — full card details are never transmitted to or stored on our servers.
• Salted, one-way password and PIN hashing.
• Server-side validation of consent, age, parent toggles, time-limits and ban status on every sensitive request.
• Granular access controls, least-privilege provisioning and audit logging for our internal team.
• Periodic security reviews, dependency updates and vulnerability scanning.

8. How long do we keep your information?

We retain Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.

• Active account data is retained while your account remains active.
• If an account is inactive for more than 24 consecutive months, we may delete or anonymize it after giving you reasonable notice.
• Where parental consent is withdrawn or an account-deletion request is received, we will delete the underlying child's Personal Data within a reasonable period.

9. Your rights and choices

Subject to applicable law, you (or, for child accounts, the parent or legal guardian) have the right to:

• Access — request a copy of the Personal Data we hold about you or your child.
• Rectification — request correction of inaccurate or incomplete Personal Data.
• Deletion (“right to be forgotten”) — request that we erase your or your child's Personal Data.
• Restriction or objection — restrict or object to certain processing.
• Withdrawal of consent — withdraw any consent you previously gave us.

To exercise any of these rights, please contact us at admin.alphaworld@gmail.com.

10. Cookies and similar technologies

Our website uses a minimal set of strictly-necessary cookies and local-storage entries to operate the site (for example, to remember your preferences and provide session security). We do not use advertising or cross-site tracking cookies.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. When we make material changes, we will post the updated Privacy Policy on this page and update the “Last Updated” date above.

12. Contact us

If you have any questions, concerns or requests regarding this Privacy Policy or our data practices, please contact us: