Privacy policy

Mellowmoor is made by Benjamin Jacob McGill, a sole trader in Victoria, Australia, trading as Mellowmoor ("we", "us", "our"). This policy explains what information the Mellowmoor app and this website collect, why, who it is shared with, how long it is kept and the choices you have. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and this policy also explains the rights people have under the GDPR and UK GDPR, the US Children's Online Privacy Protection Act (COPPA) and Californian law.

Mellowmoor is used by children, but it is set up and controlled by adults: a parent or carer (a family account) or a school, therapy centre or similar organisation (an organisation account). Children do not have accounts or email addresses of their own. Parents can read a shorter children's privacy notice.

The short version

We keep only what Mellowmoor needs: the adult's email address, and for each child a nickname, age, avatar, group (for organisations) and game progress.
The detailed record of how a child plays (including Calm Cove check-ins), their pictures, stickers, Star Cadets progress, settings, session plans, homeschool plans and records, goals and notes, and your PIN stay on your device. Nothing from them is sent to us. The one exception is opt-in: a school or centre can switch on sharing between its own tablets, after confirming it holds each family's consent (see section 7).
No advertising, no advertising identifiers, no analytics or tracking tools, no location, contacts, photos, camera or microphone.
If you subscribe on the website's Android app, payment goes through Stripe, using a checkout run by our billing provider RevenueCat. Your card details are held by Stripe, never by us.
We never sell personal information or use it for marketing.
You can delete a child's profile, their play details or your whole account from inside the app at any time.

1. What we collect

Your account (the adult)

Email address and password. Used to sign in and to bring your profiles and progress to another device. The password is handled by our account provider, Supabase, and is stored only in a scrambled (hashed) form that no one can read back.
When you gave consent. We record the date and time you agreed, during setup, to Mellowmoor storing your child's information.
Sign-in records. Like any sign-in service, Supabase records technical details such as when you signed in and the internet (IP) address used, to keep accounts secure.
For organisation accounts: the organisation's name, its kind (for example school or therapy centre), its plan size, and which accounts belong to it.

About each child

A nickname of up to 16 characters. Please use a first name or a made-up name, not a full name.
Age (a whole number from 2 to 9) and the matching age band, so the right games and stories are shown.
Avatar: the character picture chosen for the profile.
Group name (organisation accounts only), such as a class or room, up to 24 characters.
When the profile was created and last changed.

Game progress

For each finished game: which game, the level, how many answers were right and wrong, hints used, how long it took, whether it was finished and when it was played.
The level each child has reached in each game, and a skill score between 0 and 1 for each skill. These scores describe play in Mellowmoor games only; they are not IQ scores or assessments.

Organisations that share play between their tablets (only if switched on)

An organisation can choose to switch on Share learners' play across our tablets. Only then, and only for that organisation's learners, we also store in its account the information that otherwise stays on each device (section 2): the play details used by the Insights tab (including breaks and Calm Cove use and check-ins), stickers, outfits, Today's adventure, Star Cadets progress, homeschool records, session plans, each learner's own sensory and play settings, goals and notes written by staff, and hours entries. We also record who switched sharing on or off, when, and that they confirmed the organisation holds each child's parent or guardian's consent. Pictures made in Play Studio, the story log, the Language Lighthouse language choice and PINs are never shared. Section 7 explains who can see this and how long it is kept.

If you contact us

Your email address, your message and our reply.

Subscriptions

Subscriptions are bought in one of two ways, and only by an adult.

In the App Store or Google Play. Our subscription service, RevenueCat, checks the store's receipt and tells the app whether a subscription is active. It receives an app user ID (your account's ID when you are signed in, otherwise a random ID), your purchase and subscription history from the store, and ordinary technical details of each request, such as the app version, the device's operating system, the store country and the internet (IP) address. We do not receive your name, card or payment details from the store.

Directly from us (the Android app from our website). The app opens a secure checkout page run by RevenueCat ("RevenueCat Web Billing"), and the payment is processed by Stripe. To take payment and manage the subscription:

RevenueCat receives your account's app user ID, the email address you give at checkout, the plan you chose, your billing country (and, where tax requires it, postcode), the subscription's history (trial, renewals, cancellations, failed payments) and technical details of the checkout request such as the internet (IP) address. It sends your receipts and the link for managing your subscription.
Stripe receives your card or other payment details, the name on the card, your billing country and postcode, the email address and the amount, and uses them to take payment, prevent fraud and meet its legal obligations, under its own privacy policy.
We receive from them the email address, the plan, the amounts charged and the tax, dates, the billing country and the subscription's status, and the card's brand and last four digits as shown in receipts. We never receive or store your full card number or security code.

The checkout and billing pages are run by RevenueCat and Stripe at their own web addresses, not on this website, and may use cookies or similar technology needed for payment and fraud prevention under their policies.

2. What stays on your device

These are kept only on the phone or tablet where they were made. They are not uploaded to your account and we cannot see them, unless an organisation has switched on sharing between its tablets (section 7). Pictures, the story log, the Language Lighthouse language choice and the PIN stay on the device even then.

Play details used by the Insights tab: for each play, the time of each answer, where taps land on the screen, fast-tap bursts, pauses, use of hints and replays, what followed a wrong answer and whether the game was finished, plus time spent in stories and Play Studio, and when a child asked for a break. Calm Cove use is kept the same way: which activity, for how long and whether it reached its own end, and for the feelings check-in, the feeling chosen before and after and the "What helps me?" idea picked. Nothing in Calm Cove is scored. You can switch this recording off, and delete it for any child, in Parents > Settings > Play details.
Pictures made in Play Studio, and the story log.
Rewards: each child's sticker book, the outfits chosen for the characters and Today's adventure, and Star Cadets stars, rocket colours and stickers.
Homeschool mode (if you switch it on): the curriculum and year level chosen for each child, assigned learning paths and progress through them, the weekly planner, day notes and the records behind the learning log. A portfolio PDF is made on the device, like the reports below. These are not synced, so they are only on the device where you made them.
Goals and notes that adults write about a child in the Insights tab, and hours entries added by hand in the Homeschool hours log. Progress toward a goal is worked out on the device from the play above.
Your PIN, which is stored only as a salted, scrambled value in the device's secure storage. It is not your account password.
Settings such as language, voice, music and session length; each child's own sensory and play settings and Calm Cove "What helps me?" ideas; each child's session plan; the language each child last chose in the Language Lighthouse; and a list of changes waiting to be synced.
Reports you create, including the Play Observation Report and the homeschool portfolio. They are made on the device. If you share one, you choose where it goes using your device's share menu; we do not receive a copy.

Signing out, or using Erase all data on this device, removes all of this from the device.

3. What we never collect

No advertising of any kind, and no advertising identifiers.
No analytics, tracking or crash-reporting tools from other companies, in the app or on this website.
No location, contacts, photos, camera, microphone or voice recordings.
No chat, messaging, social features or public profiles. Children cannot share anything from the children's area.

4. How we use information

To provide Mellowmoor: your account, child profiles, progress, reports and syncing between your devices.
To choose levels and suggest games for each child, based on their own progress.
To reply when you contact us.
To keep Mellowmoor secure, prevent misuse, and meet our legal obligations.

We do not sell personal information, use it for advertising or marketing, or build profiles of children for any purpose other than running the app for you. We do not make decisions about anyone by automated means that have legal or similarly significant effects.

We share information only with services that help run Mellowmoor, and only what each one needs:

Service	What it does	Where
Supabase	Account sign-in, account emails (such as confirming your email address) and the database that holds the information in section 1.	Data stored in Sydney, Australia
RevenueCat	Checks store receipts and keeps track of whether a subscription is active, so it works across your devices. For subscriptions bought directly from us, it also runs the checkout page, sends receipts and the billing link, and manages renewals and cancellations. It receives the details in section 1 under "Subscriptions". Collection of device identifiers and diagnostics is switched off in the app.	United States
Stripe	Processes card payments for subscriptions bought directly from us (the Android app from our website). It holds your payment details; we never see them. It receives the details in section 1 under "Subscriptions".	United States and worldwide
Apple and Google	App distribution, and taking payment for subscriptions bought in their stores, under their own privacy policies.	Worldwide
Hugging Face	When you choose a Spanish, French, German or Portuguese voice, the voice file is downloaded once from Hugging Face. No personal information is sent; like any download, it sees your device's internet address.	United States and European Union
Your device's speech service	Italian and Chinese speech uses the text-to-speech built into your device, provided by Apple, Google or your device maker under their own terms.	On your device or as your device maker provides
Cloudflare	Hosts this website. It sees your internet address, as any website host does.	Worldwide

In an organisation account, people who use that organisation's account can see its learners' profiles and progress, and, if the organisation shares play between its tablets, the shared details in section 7. We may also disclose information if the law requires it, or to protect someone's safety.

6. Children's information

Mellowmoor is designed for children aged 2 to 9, but only an adult can set it up. Before any information about a child is stored, the adult confirms that they are the child's parent or legal guardian (or, for an organisation, that it has the consent of each child's parent or guardian) and agrees to Mellowmoor storing the information listed during setup. With an account, the adult's email address is verified before setup continues, and we record the time consent was given.

We collect only the information needed for a child to use Mellowmoor, never more as a condition of playing. A parent can review a child's information, have it deleted and refuse further collection at any time. The children's privacy notice explains how, in plain steps.

If you believe we hold information about a child without a parent's consent, contact us and we will delete it.

7. Organisation accounts

When a school, therapy centre, day care or other organisation uses Mellowmoor for the children in its care:

The organisation decides which children use Mellowmoor and what information is entered. It is responsible for having the consent of each child's parent or guardian, and the app asks it to confirm this during setup.
We handle learners' information on the organisation's behalf, as its service provider, only to provide Mellowmoor to it, and in line with this policy.
A parent who wants to see, correct or delete their child's information in an organisation's account should ask the organisation first. We will help the organisation respond, and if a parent contacts us directly we will pass the request on or act on it where the law requires.
The organisation can delete a learner, their play details or the whole organisation from the staff area. When the organisation's only owner deletes their account, the organisation and all its learners' information are deleted too.

Sharing play between an organisation's tablets

Children often move between tablets in a clinic or classroom. An organisation can switch on Share learners' play across our tablets in Staff > Safety & account. It stays off unless the organisation switches it on, and it is not available to family accounts.

Consent first. Before switching it on, the account owner must confirm that the organisation holds each child's parent or guardian's consent to store detailed play records online. We record who confirmed this and when.
What is stored: the items listed in section 1 under "Organisations that share play between their tablets", in the organisation's account, held by Supabase in Sydney, Australia.
Who can see it: only people signed in to that organisation's account, on any of its devices. The database enforces this with row-level security. We use it only to provide Mellowmoor to the organisation.
How long: play details older than 6 months are deleted automatically, and at most the latest 2,000 plays and 750 other activities (story, Play Studio and Calm Cove visits, and breaks) are kept for each learner. Removed goals, notes and hours entries are forgotten after 180 days.
Switching it off deletes all the shared details from the organisation's account straight away. Each tablet keeps the copy it already has.
Deleting a learner deletes their shared details from the account at once, and from the organisation's other tablets the next time each one connects. Deleting the organisation deletes all of it.

8. Where it is stored

Account information is stored by Supabase in its Sydney, Australia region. Supabase, Inc. is based in the United States, and its staff may access systems from other countries to maintain them. RevenueCat, Inc. is based in the United States. Stripe processes payments in the United States and other countries. Apple, Google, Hugging Face and Cloudflare operate worldwide. If you live outside Australia, your information is transferred to Australia, and may be processed in the other countries named above. We choose providers that protect information to a standard comparable to Australian law and, where they offer them, rely on safeguards such as the European Commission's standard contractual clauses.

9. How long we keep it

Account, profile and progress information is kept while your account exists.
When you delete a child's profile, it and all its progress are deleted from the account straight away.
For an organisation that shares play between its tablets: shared play details are deleted after 6 months (and beyond 2,000 plays and 750 other activities per learner), and all shared details are deleted when sharing is switched off. A short note that a learner was deleted, holding no name or play, is kept for up to 400 days so that every tablet removes the profile too.
When you delete your account, it is deleted from our database straight away, with every family profile and its progress (and, for an organisation's only owner, the organisation and its learners). Copies in our provider's backups expire on their own schedule, usually within 30 days.
Information kept only on your device stays there until you delete it, sign out, erase the device's data, or delete the app.
Records of subscriptions bought directly from us (email address, plan, amounts, tax and dates) are kept for as long as tax and accounting law requires, usually 5 years after the sale, even if you delete your account. Stripe and RevenueCat keep their own records under their policies.
Messages to us are kept as long as needed to deal with your request and keep a record of it.

10. Your choices and rights

See and change your children's profiles in Parents > Children, and their progress in the reports.
Stop or delete play details in Parents > Settings > Play details.
Organisations can stop sharing play between their tablets, which deletes what was shared, in Staff > Safety & account.
Delete a child's profile in Parents > Children. With an account, it is deleted from the account too.
Delete your account in Parents > Safety & account > Delete account, or ask us by email.
Ask for a copy of the information we hold, or for it to be corrected, by emailing hello@mellowmoor.com. We may need to check that the request comes from the account holder. We reply within 30 days.

If you have a privacy complaint, please contact us first. If you are not satisfied with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

11. Europe, the UK, the US and California

Europe and the UK (GDPR and UK GDPR)

For family accounts we are the controller. We use information to perform our contract with you (providing your account and the app), on the basis of the consent you give for your child's information, for our legitimate interests in keeping Mellowmoor secure and working, and to meet legal obligations. Where a child's information is used on the basis of consent, it is the consent of the holder of parental responsibility. For organisation accounts, the organisation is the controller and we are its processor.

You can ask us to give you a copy of your information, correct it, delete it, restrict or object to how we use it, or move it to another service, and you can withdraw consent at any time (by deleting the profile or the account). You can also complain to your data protection authority (in the UK, the Information Commissioner's Office).

United States (COPPA)

We collect personal information about children under 13 only with the consent of a parent or guardian, obtained as described in section 6 before any child information is stored, and we use it only to provide Mellowmoor. We do not disclose it to third parties except the service providers in section 5 that help run Mellowmoor, and we do not condition a child's play on collecting more than is needed. A parent can review the information, have it deleted, and refuse further collection or use at any time by contacting us or using the controls in the app.

California

We do not sell or share personal information (including for cross-context behavioural advertising), and we do not use or disclose sensitive personal information except to provide Mellowmoor. Californian residents can ask to know what we hold, to correct it and to delete it, and we will not treat you differently for doing so. The categories we collect are listed in section 1 and the sources are you and your use of the app.

12. Security

Information is sent over encrypted connections. Each account can reach only its own information: the database enforces this with row-level security for every table. Passwords and PINs are never stored in readable form, and the parents' area locks for a while after five wrong PINs. No system is perfectly secure, which is one more reason we keep what we collect to a minimum. If a data breach is likely to cause serious harm, we will tell you and the regulator as the law requires.

13. This website

This website sets no cookies and stores nothing in your browser. It has no analytics, advertising or tracking scripts, and its fonts and images are served from the site itself. Cloudflare, which hosts it, processes your internet address and basic request details to deliver pages and protect the site. If you email us using a link on this site, we receive what you send.

The Android app downloaded from this website is served from Cloudflare too, and checks this website for updates now and then by reading a small file listing the latest version. That check sends no personal information; Cloudflare sees the device's internet address, as with any request.

14. Changes to this policy

If we change how Mellowmoor uses information, we will update this policy and its date, and tell you in the app or by email before a significant change takes effect. If a change affects how we use children's information, we will ask for a parent's consent again where the law requires it.

15. Contact us

Benjamin Jacob McGill, a sole trader in Victoria, Australia, trading as Mellowmoor.
Email: hello@mellowmoor.com