Privacy policy

Atlaroo is a geography app for kids aged 8 to 12, made by GeoTales. We built it to collect as little as possible: kids never type personal details, there are no ads, and nothing is used to track anyone. This page explains exactly what the app stores, where, and how you stay in control.

1. The short version

Without sign-in, kids' profiles and progress stay on your device. The only thing the app sends is a subscription check to RevenueCat, our subscription service.
Signing in is optional and only a grown-up can do it, behind the parental gate. Once you sign in, your kids' nicknames, avatars and game progress sync to our servers so all your family's devices match.
We never ask kids for their real name, email, photo, voice or location.
No ads, no third-party analytics, no advertising ID and no tracking.
You can delete everything from inside the app, or by emailing hello@atlaroo.app.

2. What stays on your device

These things are stored only on the device and never leave it, whether or not you sign in:

Reminder settings: whether reminders are on, their time and weekend mode. Reminders are local notifications scheduled on the device. There's no push server, and the app never requests a push token.
Downloaded expeditions: the story clips and games you downloaded, kept in the app's storage so they play offline.
Spoken instructions: the app reads instructions aloud with your device's own text-to-speech.

While nobody is signed in, the kid profiles (nickname and avatar), each kid's game progress, stamps, streak and settings (time zone, weekend mode and weekly goal) are also stored only on the device. The device time zone is read locally so streak days start at the right midnight.

When a grown-up signs in, the app keeps a session token in the device's secure storage (the iOS Keychain or Android Keystore) so it stays signed in.

3. What we store when a grown-up signs in

Signing in with Apple or Google is optional. It happens in the grown-ups area, behind the parental gate, and it lets a family keep progress in sync across devices, get the weekly email and download expeditions. When you sign in, we store the following on our servers:

Data stored on Atlaroo's servers for a signed-in family
What	Details	Why
The parent's account	Which provider you used (Apple or Google), that provider's account id for you, your email address if the provider shares one (including an Apple "Hide My Email" relay address), whether it's a relay address, and when you created the account and last signed in.	To recognise you when you sign in and to send the weekly email.
Sessions	A fingerprint (SHA-256 hash) of each session token, never the token itself, with its start and expiry time. Sessions last 90 days.	To keep you signed in securely.
Kid profiles	Each kid's nickname, the avatar they picked, and when the profile was created and last changed. Up to six profiles per family.	So every device shows the same explorers.
Progress events	One entry for each thing a kid does in a game: the game, the country, whether the answer was right, the number of attempts, how long the round took, and when it happened.	To rebuild the same progress, stamps and streaks on every device, and for the parent dashboard and weekly email.
Profile settings	Each kid's time zone, weekend mode and weekly goal.	Streaks and weekly goals depend on them. The time zone also sets when the weekly email goes out.
Subscription status	Whether the family is subscribed, in a trial, cancelled or expired, the product, the store, and the expiry and grace-period dates. We also log each notification RevenueCat sends us (its id, type and time).	To unlock the app and expeditions for subscribed families.
Email preferences	Whether the weekly email is on, and a record of which weeks' emails were sent.	So you get at most one email a week, and none after you unsubscribe.

We don't store your name, your profile photo, your IP address or your device's identifiers in our database. Google's sign-in token can include your name and photo; we don't keep them. Downloading an expedition sends only your session token.

We ask for a nickname rather than a real name. A kid's nickname can appear in the weekly email and in the parent dashboard.

4. Services that help us run Atlaroo

We use a small number of service providers. They process data for us, and we don't sell or share data with anyone for their own purposes.

Cloudflare hosts our servers (Cloudflare Workers), our database (Cloudflare D1), the expedition downloads (Cloudflare R2) and sends the weekly email. Like any web host, Cloudflare sees the IP address of the device making each request. Our server keeps short-lived operational logs of requests and errors (for example, the time, the address requested and the result) to find and fix problems.
RevenueCat manages subscriptions for us. When the paywall opens or the app checks the subscription, RevenueCat receives an app user id (your Atlaroo account id when you're signed in, otherwise an anonymous RevenueCat id), your store receipts and purchase history, the app version, the platform and your store's country. We don't give RevenueCat any kid data, and we've turned off its device-identifier collection and its attribution integrations. See RevenueCat's privacy policy.
Apple and Google handle sign-in. When you tap Sign in with Apple or Sign in with Google, the sign-in runs in Apple's or Google's own screen, and we receive only an identity token that confirms who you are. Apple and Google also process payments through the App Store and Google Play under their own privacy policies, and may share crash reports with us if you've allowed that in your device settings.

5. The weekly email

If you sign in and your account has an email address, we send one email a week, on Sunday evening in your family's time zone. It sums up each kid's week: rounds finished, countries met, new stamps, the weekly goal and the streak. It never sells anything. The weekly email is on by default for signed-in accounts.

To stop it:

use the unsubscribe link at the bottom of any weekly email (it works without signing in), or your email app's unsubscribe button; or
switch it off in the app under Grown-ups → Account → Weekly email.

If you used Apple's "Hide My Email", the email goes to your relay address and Apple forwards it to you.

6. What we don't do

No ads and no advertising SDKs.
No third-party analytics or attribution tools. We don't use the advertising ID (IDFA or AAID); it's blocked in the Android app.
No tracking across apps or websites, and we don't sell or rent personal data.
No location, contacts, camera, microphone or photo access. The app doesn't ask for those permissions.
No chat, social features, public profiles or leaderboards. Kids can't contact anyone or share anything.
Kids never type an email, a password or personal details. Profiles are created by a grown-up behind the parental gate.
No push notification server. Reminders are scheduled on the device.

7. How we use data

We use the data above only to run Atlaroo for your family:

to sign you in and keep your family's profiles and progress in sync;
to show progress in the parent dashboard and the weekly email;
to check your subscription and unlock content;
to keep the service secure and fix problems.

We don't use kids' data for advertising, profiling or marketing, and we don't use it to train AI models.

8. How long we keep data

We haven't set a fixed retention period yet. Today, this is what happens:

Account data, profiles and progress are kept while your account exists, until you delete the account. We don't yet delete inactive accounts automatically.
Sessions expire after 90 days.
When you delete a single kid profile, that kid's progress and settings are deleted from our servers straight away. A small record of the profile (its id, nickname and avatar, marked as deleted) stays so another device can't bring the profile back by accident. It's removed when you delete your account.
Operational server logs are kept for a few days.
If your subscription ends, we keep your kids' progress, so you can pick up where you left off if you subscribe again.

9. Deleting your data

In the app

Go to Grown-ups → Account → Delete account and data. If you're signed in, this deletes your family's account and everything we store for it on our servers: every kid profile, all progress and settings, your subscription status, email preferences and sessions. It also wipes the app on that device, including downloaded expeditions and scheduled reminders. If a device was signed in before, the app asks you to sign in again first, so the server copy can't be left behind.

If you never signed in, the same screen deletes everything from the device. Deleting the app from your device also removes its profiles, progress and downloads from that device, but not anything stored on our servers.

By email

Email hello@atlaroo.app from the address on your account, or tell us how you signed in, and we'll delete your account. We may ask you to confirm the request so we don't delete someone else's data.

What deleting doesn't cover

Your subscription. Apple or Google bills it, so deleting your Atlaroo account doesn't cancel it. Cancel it in your store account (see how to cancel).
RevenueCat's purchase records. RevenueCat keeps its own record of the store subscription. If you want that removed as well, email us and we'll ask RevenueCat to delete it.

10. Children's privacy (COPPA)

Atlaroo is made for children, so we follow the US Children's Online Privacy Protection Act (COPPA) and design the app so kids don't hand over personal information.

What we collect from children. Nothing leaves the device about a child unless a parent signs in. After that, we store the child's nickname, avatar, game progress and profile settings, as listed in section 3. A nickname a parent types counts as personal information, so please use a nickname rather than a full name.
Parental consent. Only a grown-up can sign in, and only after passing the parental gate. The parent signs in with their own Apple or Google account and creates each kid's profile. Today, signing in is how a parent chooses to sync their kids' data; the app doesn't yet show a separate consent checkbox. If you don't sign in, no child data reaches our servers.
Disclosure. We don't disclose children's information to third parties, except to Cloudflare, which hosts our servers and database for us. RevenueCat never receives children's data.
Your rights as a parent. You can review your children's information in the parent dashboard, or ask us for a copy of everything we store. You can correct a nickname or avatar in the grown-ups area. You can delete a single child's profile, or your whole account, in the app or by email. You can stop further collection at any time by signing out or deleting your account; the app keeps working on the device without sign-in.

If you believe a child's information reached us without a parent's permission, email hello@atlaroo.app and we'll delete it.

If you live in the European Economic Area or the UK, GeoTales is the controller of the personal data described here. The account holder is always the parent; children don't sign in or give consent themselves.

Why we process it. We process account, profile and progress data to provide the service you asked for (syncing, the dashboard, subscriptions). We send the weekly summary email as part of the service; you can switch it off at any time.
Your rights. You can ask to access, correct, delete or export your family's data, and object to or restrict how we use it. Email hello@atlaroo.app. You can also complain to your data protection authority (in the UK, the Information Commissioner's Office).
Designed for children (GDPR-K and the UK Age Appropriate Design Code). Settings are private by default. There's no profiling, no geolocation, no advertising, no social features and no in-app purchases aimed at kids. Streaks never pressure kids to pay, and reminders are set by a parent and never mention losing a streak. Grown-up controls sit behind a parental gate.

12. Where data is stored

Our database is Cloudflare D1, located in Cloudflare's Western North America (WNAM) region, in the United States. Expedition downloads are stored in the same region. Requests reach our servers through Cloudflare's global network, so they may pass through a Cloudflare data centre near you. If you're outside the United States, your family's data is transferred to and stored in the United States.

13. Security

All traffic between the app and our servers uses HTTPS.
We store only a hash of each session token, and the app keeps its token in the device's secure storage.
We verify every Apple and Google sign-in token before creating a session. Kids never have credentials.

No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you as the law requires.

14. This website

atlaroo.app sets no cookies and runs no analytics or tracking scripts. Fonts and images are served from this site. Cloudflare, which hosts the site, processes requests (including IP addresses) to deliver pages and protect the site.

15. Changes to this policy

We'll update this page when the app or this policy changes, and change the date at the top. If a change affects how we use children's data, we'll tell parents first, in the app or by email.

16. Contact us

GeoTales, maker of Atlaroo
Email: hello@atlaroo.app