Privacy

Who can join

The Family Plan is for families in the United States, set up by a parent or legal guardian. A payment with a billing address outside the US is refunded in full and the plan is cancelled.

Who we are

SOEngineered LLC, operator of Kids Game Builder.

Mail: SOEngineered LLC, 22 Rocky Hill Road, Rehoboth, MA 02769, USA
Email: privacy@kidsgamebuilder.com
Phone: 508-322-1737
Or send us a message.

What we collect

• From you: your email address and payment details (handled by Stripe; we never see your full card number), and any problem reports you send us from your family page, with your browser type so we can fix the problem. We remove emails, phone numbers and addresses from reports, and delete them with your family or after about a year.
• About your child, from you: a nickname you choose (please not their full name) and an optional age range.
• From your child: the text they type into the game builder, the games they make, and any AI answer they report to you with the builder's /report command. We automatically remove email addresses, phone numbers and street addresses before a prompt is sent to the AI or saved. We don't collect your child's name, photos, voice, location, contacts or device identifiers, and we don't use cookies for tracking or advertising. The only cookie on your child's device keeps them signed in to the builder.

How we use it

Only to run the game builder: to turn your child's ideas into games, to show you everything they typed and what the AI answered, to count their monthly sparks, and to keep the service safe. We don't use it for advertising, we don't sell it, and we don't build profiles.

Who processes it for us

We use service providers in these categories. Each may use the information only to provide its service to us, under a contract that limits it to that purpose. None may use it for advertising, sell it, or train AI models on it.

• AI model providers receive your child's prompts and game files to generate each answer.
• Hosting and infrastructure providers run the service and store the data.
• Payment processors handle your payment (you only, never your child).
• Email providers send your sign-in links, receipts and renewal notices (Stripe sends receipts and renewal notices), and alerts when something on your child's account needs a look, such as a reported AI answer (you only; you can turn alerts off under Moderation, and they never repeat what your child typed).

Today these are Anthropic (AI models), Cloudflare (hosting), Stripe (payments) and Resend (email). We may change providers within these categories; we'll update this list when we do, and ask for your consent again before adding a new category.

Your consent

Your child can't use the builder until you've read this notice, ticked the consent box on the Family Plan page, and completed the card payment, which confirms you're an adult and completes your consent. No child can be added, and nothing is collected from a child, before that. If we give your family a free plan (no card payment), we verify your consent with a signed consent form instead, and building stays off until we have it. You can withdraw consent at any time by deleting your family.

Keeping and deleting it

• Prompts and AI answers are deleted automatically after 90 days.
• Games are kept until you delete them or your family, or until 6 months after your plan ends.
• If your plan ends (cancelled, not renewed, or a free plan that ran out), we delete your children's profiles, games (including any sent to the arcade) and history 6 months later. We email you 30 days before. Your own account stays so you can come back; delete your family any time to remove it too.
• Spark usage records (counts, no text) are kept for about 13 months for billing.

Two copies outside our control expire on their own: our AI provider (Anthropic) keeps each request for up to 30 days for safety and abuse checks, and our host (Cloudflare) keeps up to 30 days of restore history of our database, so anything deleted, by you or automatically, is fully gone within 30 days after that. Neither is used for anything else.

On your family page you can read everything your child typed, delete their history, remove a child (deleting their prompts and games), or delete your whole family, which also cancels the plan.

Your rights under COPPA

The Children's Online Privacy Protection Act (COPPA) gives you, as the parent, these rights. You can use all of them on your family page, or by writing to us:

• Review everything your child has typed and the games they made.
• Delete your child's information: their history, a game, the child, or your whole family.
• Refuse further collection: pause your child, or withdraw your consent by deleting your family. We then stop collecting and delete what we hold.
• Consent to collection without consenting to disclosure beyond the service providers that run the builder. We don't disclose children's information to anyone else.

We won't make your child give more information than the builder needs. The FTC explains COPPA for parents at Protecting your child's privacy online. If you think we've broken these rules, please tell us first; you can also report it to the FTC at reportfraud.ftc.gov or (877) FTC-HELP.

If our business changes hands

If SOEngineered LLC or the Family Plan is sold, merged, or transferred (including in a reorganization or bankruptcy), the information we hold may be transferred to the new owner as part of the business. The new owner must handle the information we collected under this notice as this notice says, unless you consent to something different. We'll tell you before your family's information becomes subject to a different privacy notice.

Changes to this notice

We may update this notice. We'll post the new version here with its date, and email you about material changes before they take effect. If a change would let us collect, use or disclose your child's information in a materially different way, we'll ask for your consent again first, as COPPA requires; until you consent, we'll keep handling it as this version says.

Security

Sign-in links, sessions and pairing codes are stored only in hashed form. Data is encrypted in transit. Only the account owner and the SOEngineered staff who run the service can access it.

We keep a written information security program for children's information: who can access it and why, how it's protected and deleted, how we choose and check our service providers, and what we do if something goes wrong. We review it at least once a year. If a security incident affects your child's information, we'll tell you promptly and as the law requires.