Privacy Policy

WizzKids (“we”, “us”) runs wizzkids.co — a play-first learning adventure where kids ages 6–12 explore the town of Timberon and build life skills like saving, sharing, and understanding big feelings. Because our players are children, we hold ourselves to a higher bar on privacy: accounts belong to parents, we collect as little as possible, and we never sell personal information — anyone’s, and especially not children’s.

When you create a family account we collect your email address, first name, and your answers to our short signup survey (your child’s age range and the skills you care about). If you sign in with Google or Facebook, we receive your name and email address from that provider — nothing else, and we never post on your behalf.

If you donate or buy merchandise, payment is processed by Stripe and orders are fulfilled by Printful; we receive order details (like your name, email, and shipping address) but never your card number. Donations do not unlock gameplay and are not tax-deductible.

Kids don’t create their own accounts. A parent creates each child profile and chooses what it contains: a first name or nickname, an avatar, and — if the parent enables kid login — a username and PIN. As kids play, we store game progress (coins earned, goals reached, lessons completed) so their adventure picks up where it left off.

Inside the game there are no ads, no chat with strangers, no public profiles, and no links out to social media. We do not knowingly collect personal information from children beyond what a parent sets up, and we use children’s information only to run the game. Parents can review or delete their child’s profile and progress at any time from the parent dashboard, or by contacting us.

Across our public pages and family onboarding flow, we use first-party measurements to count homepage visits and understand whether visitors continue through signup, create their first kid profile, and start their first game. A random browser identifier resets each day; campaign labels and referral domains can be kept in your browser for up to 30 days to remember your first visit. We do not copy child profiles, account names, email addresses, child identifiers, full referral URLs, advertising click identifiers, game choices, or provider error messages into these measurements. Signup source information is associated with the parent account; deleting the account removes that association while retaining anonymous signup counts. We honor browser Do Not Track and Global Privacy Control signals, and do not run marketing measurement inside gameplay or admin pages.

Our marketing pages (not the game itself) use cookies and similar technologies through Google Tag Manager — including Google Analytics and the Meta pixel — to understand how visitors find us and to measure our outreach. You can limit these through your browser settings or standard opt-out tools. We don’t use advertising trackers inside the kids’ game experience.

Only service providers that make WizzKids work: Supabase (accounts and game data), Netlify (website hosting), Stripe (payments), Printful (merchandise fulfillment), and the analytics providers above. Each receives only what it needs to do its job. We never sell personal information, and we would only disclose it beyond these providers if the law required it.

We publish our own WizzKids lesson videos to our own WizzKids YouTube channel using an internal admin tool, the WizzKids Content Studio. That tool uses YouTube API Services. By using it we are bound by the YouTube Terms of Service, and Google’s handling of any data it receives is governed by the Google Privacy Policy.

This never involves players. The WizzKids game and website do not embed the YouTube player, do not load YouTube scripts or cookies, and never send any child or parent information to YouTube. Only a WizzKids staff account can reach the Content Studio; there is no public sign-up for it.

What we access and store. When a WizzKids administrator connects our YouTube channel, Google gives us an access token and a refresh token for that one account, limited to two permissions: uploading videos and reading basic channel information. We store those tokens encrypted, and we store the channel name and id so we know which channel was authorised. After an upload we keep the video id, its link, and its privacy status. That is the entire set of YouTube data we hold.

Keeping it current. At least every 30 days we confirm with YouTube that our access is still authorised, refresh the stored channel name and each video’s privacy status, and delete the record of any video that no longer exists. If access has been revoked or has expired, we delete all stored YouTube data for that channel.

What we never collect. We do not collect, store, analyse, sell or display viewer data, watch history, comments, subscriber information, analytics, or any data about other people’s channels or videos. We do not allow third parties to serve advertisements on or alongside YouTube content, and we do not store or read anything on your device through YouTube.

Revoking access. The Google account owner can revoke our access at any time from Google’s security settings page. You can also disconnect the account inside the Content Studio, which revokes our access with Google and deletes the stored tokens and video records immediately.

Deletion. Stored YouTube tokens are deleted as soon as the account is disconnected or access is revoked. Any remaining YouTube records — the id and link of videos we ourselves uploaded — are deleted within 7 days of a request. To ask a question, raise a complaint, or request deletion, email shannonamcgill@gmail.com.

Account data is protected with industry-standard encryption in transit and at rest, and payment details never touch our servers. We keep your information while your account is active; when it’s deleted, associated profiles and progress are removed from our systems within 30 days, except records we must keep for legal or accounting reasons.

You can delete your family account — including all child profiles, game progress, and personal information — at any time. Email shannonamcgill@gmail.com from your account email with the subject “Delete my account” and we’ll confirm and complete the deletion within 30 days. If you signed in with Google or Facebook, this also removes the data we received from those providers.

If we make meaningful changes to this policy we’ll update the date above and, for significant changes affecting children’s data, email account holders. Questions? Reach us any time at shannonamcgill@gmail.com.