Last updated 1 October 2026
Privacy policy
Atlaroo is a geography app for kids aged 8 to 12, made by Shankhadeep Dey, an individual developer in India who publishes as GeoTales ("we", "us"). He is responsible for the personal data described here. We built it to collect as little as possible: kids never type personal details, there are no ads, and nothing is used to track anyone. This page explains exactly what the app stores, where, and how you stay in control.
1. The short version
- Without sign-in, kids' profiles and progress stay on your device. The only thing the app sends is a subscription check to RevenueCat, our subscription service, under an anonymous id. The subscription unlocks expeditions without an account.
- Signing in is optional and only a grown-up can do it, behind the parental gate, with Sign in with Apple (iPhone and iPad) or an emailed 6-digit code. Before signing in, the grown-up reads a short notice and ticks a box to confirm they're the family's parent or guardian and agree. Then your kids' nicknames, avatars and game progress sync to our servers so all your family's devices match.
- The weekly progress email is off unless you choose it.
- We never ask kids for their real name, email, photo, voice or location.
- No ads, no third-party analytics, no advertising ID and no tracking.
- You can delete everything from inside the app, or by emailing hello@atlaroo.app.
2. What stays on your device
These things are stored only on the device and never leave it, whether or not you sign in:
- Reminder settings: whether reminders are on, their time and weekend mode. Reminders are local notifications scheduled on the device. There's no push server, and the app never requests a push token.
- Downloaded expeditions: the story clips and games you downloaded, kept in the app's storage so they play offline.
- Spoken instructions: the app reads instructions aloud with your device's own text-to-speech.
While nobody is signed in, the kid profiles (nickname and avatar), each kid's game progress, stamps, streak and settings (time zone, weekend mode and weekly goal) are also stored only on the device. The device time zone is read locally so streak days start at the right midnight.
When a grown-up signs in, the app keeps a session token in the device's secure storage (the iOS Keychain or Android Keystore) so it stays signed in.
3. What we store when a grown-up signs in
Signing in is optional: expeditions unlock with the store subscription alone, without an account. A grown-up signs in in the grown-ups area, behind the parental gate, with Sign in with Apple (iPhone and iPad) or an emailed 6-digit code. Signing in lets a family keep progress in sync across devices and, if they choose, get the weekly email.
Before signing in, the grown-up sees a short notice: "We store your kids' nicknames, avatars and game progress to sync them across your devices. No ads, no tracking. Delete anytime in Grown-ups → Account." It links to this policy. To continue, they tick "I'm this family's parent or guardian and I agree". A second box, "Send me a weekly email about my kids' progress", is unticked unless they tick it. Nothing is synced until the box is ticked. If we change the notice, a signed-in family sees it again and agrees before their devices sync again.
When you sign in, we store the following on our servers:
| What | Details | Why |
|---|---|---|
| The parent's account | How you signed in (Apple or email code), Apple's account id for you or the email address you signed in with, your email address if Apple shares one (including an Apple "Hide My Email" relay address), whether it's a relay address, and when you created the account, last signed in and last used it. | To recognise you when you sign in, to send the weekly email if you chose it, and to delete the account once it hasn't been used for 24 months. |
| Your consent | When you ticked "I'm this family's parent or guardian and I agree", and which version of the notice and this policy you agreed to. | To record the parent's agreement before any of the kids' data is synced, and to ask again if the notice changes. |
| Email sign-in codes | While a code is waiting to be used: a fingerprint (SHA-256 hash) of your email address, a salted hash of the 6-digit code (never the code itself), how many tries were made and when it expires (10 minutes). Codes are deleted once used or expired. Counters that limit how many codes an address or network can ask for are kept for at most 24 hours. | To sign you in by email and to stop abuse. |
| Sessions | A fingerprint (SHA-256 hash) of each session token, never the token itself, with its start and expiry time. Sessions last 90 days. | To keep you signed in securely. |
| Kid profiles | Each kid's nickname, the avatar they picked, and when the profile was created and last changed. Up to six profiles per family. | So every device shows the same explorers. |
| Progress events | One entry for each thing a kid does in a game: the game, the country, whether the answer was right, the number of attempts, how long the round took, and when it happened. | To rebuild the same progress, stamps and streaks on every device, and for the parent dashboard and weekly email. |
| Profile settings | Each kid's time zone, weekend mode and weekly goal. | Streaks and weekly goals depend on them. The time zone also sets when the weekly email goes out. |
| Subscription status | Whether the family is subscribed, in a trial, cancelled or expired, the product, the store, and the expiry and grace-period dates. We also log each notification RevenueCat sends us (its id, type and time). For subscribers who never sign in, we keep the same status under a fingerprint (SHA-256 hash) of the anonymous RevenueCat id, never the id itself. | To unlock the app and expeditions for subscribed families. |
| Email preferences | Whether you chose the weekly email, a record of which weeks' emails were sent, and a record of any inactive-account warnings sent. | So you get at most one email a week, none after you unsubscribe, and each warning only once. |
We don't store your name, your profile photo, your IP address or your device's identifiers in our database. Downloading an expedition sends only your session token or, if you haven't signed in, the anonymous RevenueCat id, which we use only to check the subscription and never log or store as it is.
We ask for a nickname rather than a real name. A kid's nickname can appear in the weekly email and in the parent dashboard.
4. Services that help us run Atlaroo
We use a small number of service providers. They process data for us, and we don't sell or share data with anyone for their own purposes.
- Cloudflare hosts our servers (Cloudflare Workers), our database (Cloudflare D1), the expedition downloads (Cloudflare R2) and sends our emails (sign-in codes, the weekly email and account warnings). Like any web host, Cloudflare sees the IP address of the device making each request. Our server keeps short-lived operational logs of requests and errors (for example, the time, the address requested and the result) to find and fix problems, for at most 30 days.
- RevenueCat manages subscriptions for us. When the paywall opens or the app checks the subscription, RevenueCat receives an app user id (your Atlaroo account id when you're signed in, otherwise an anonymous id that RevenueCat creates on the device and that isn't linked to your name or email), your store receipts and purchase history, the app version, the platform and your store's country. We don't give RevenueCat any kid data, and we've turned off its device-identifier collection and its attribution integrations. See RevenueCat's privacy policy.
- Apple handles Sign in with Apple. It runs in Apple's own screen, and we receive only an identity token that confirms who you are. If you sign in with an emailed code instead, only we and Cloudflare, which sends the email, are involved.
- Apple and Google process payments through the App Store and Google Play under their own privacy policies, and may share crash reports with us if you've allowed that in your device settings.
5. The weekly email
The weekly email is opt-in. If you tick "Send me a weekly email about my kids' progress" when you sign in, or switch it on later under Grown-ups → Account → Weekly email, we send one email a week, on Sunday evening in your family's time zone. It sums up each kid's week: rounds finished, countries met, new stamps, the weekly goal and the streak. It never sells anything. It's off unless you choose it.
Families who signed in before 2026-09-29 had the weekly email on by default. We kept their setting as it was: if you never switched it off, it's still on, and you can stop it the same way.
To stop it:
- use the unsubscribe link at the bottom of any weekly email (it works without signing in), or your email app's unsubscribe button; or
- switch it off in the app under Grown-ups → Account → Weekly email.
If you used Apple's "Hide My Email", the email goes to your relay address and Apple forwards it to you.
6. What we don't do
- No ads and no advertising SDKs.
- No third-party analytics or attribution tools. We don't use the advertising ID (IDFA or AAID); it's blocked in the Android app.
- No tracking across apps or websites, and we don't sell or rent personal data.
- No location, contacts, camera, microphone or photo access. The app doesn't ask for those permissions.
- No chat, social features, public profiles or leaderboards. Kids can't contact anyone or share anything.
- Kids never type an email, a password or personal details. Profiles are created by a grown-up behind the parental gate.
- No push notification server. Reminders are scheduled on the device.
7. How we use data
We use the data above only to run Atlaroo for your family:
- to sign you in and keep your family's profiles and progress in sync;
- to record your consent as a parent or guardian;
- to show progress in the parent dashboard and, if you chose it, the weekly email;
- to check your subscription and unlock content;
- to keep the service secure and fix problems.
We don't use kids' data for advertising, profiling or marketing, and we don't use it to train AI models.
8. How long we keep data
We keep your family's data only while the account is being used:
- Account data, profiles and progress are kept while your account is in use. If nobody uses the account for 24 months (no sign-in, no use of the app while signed in and no syncing of profiles or progress), we delete it and everything we store for it, exactly as if you had deleted it yourself. If we have your email address, we email you first, 21 months and again 23 months after the last activity. To keep the account, sign in to Atlaroo or use the "Keep my account" link in the email. Without an email address, the account is deleted at 24 months without a warning. You can also delete it yourself at any time (see below).
- Sessions expire after 90 days.
- When you delete a single kid profile, that kid's nickname, avatar, progress and settings are deleted from our servers straight away. A small record without the name or avatar (the profile's id and when it was deleted) stays so another device can't bring the profile back by accident. It's removed when the account is deleted.
- Operational server logs are kept for at most 30 days.
- If your subscription ends, we keep your kids' progress, so you can pick up where you left off if you subscribe again.
9. Deleting your data
In the app
Go to Grown-ups → Account → Delete account and data. If you're signed in, this deletes your family's account and everything we store for it on our servers: every kid profile, all progress and settings, your subscription status, email preferences and sessions. It also wipes the app on that device, including downloaded expeditions and scheduled reminders. If a device was signed in before, the app asks you to sign in again first, so the server copy can't be left behind.
If you never signed in, the same screen deletes everything from the device. Deleting the app from your device also removes its profiles, progress and downloads from that device, but not anything stored on our servers.
By email
Email hello@atlaroo.app from the address on your account, or tell us how you signed in, and we'll delete your account. We may ask you to confirm the request so we don't delete someone else's data.
What deleting doesn't cover
- Your subscription. Apple or Google bills it, so deleting your Atlaroo account doesn't cancel it. Cancel it in your store account (see how to cancel).
- RevenueCat's purchase records. RevenueCat keeps its own record of the store subscription. If you want that removed as well, email us and we'll ask RevenueCat to delete it.
10. Children's privacy (COPPA)
Atlaroo is made for children, so we follow the US Children's Online Privacy Protection Act (COPPA) and design the app so kids don't hand over personal information.
- What we collect from children. Nothing leaves the device about a child unless a parent signs in. After that, we store the child's nickname, avatar, game progress and profile settings, as listed in section 3. A nickname a parent types counts as personal information, so please use a nickname rather than a full name.
- Parental consent. Only a grown-up can sign in, and only after passing the parental gate. Before signing in, the parent reads a notice of what we store and why, with a link to this policy, and ticks "I'm this family's parent or guardian and I agree" (see section 3). Our servers won't create an account without it, and we record when the parent agreed and to which version. The parent signs in with Sign in with Apple or with a 6-digit code sent to their email address, which confirms that address, and creates each kid's profile. If you don't sign in, no child data reaches our servers.
- Disclosure. We don't disclose children's information to third parties, except to Cloudflare, which hosts our servers and database for us. RevenueCat never receives children's data.
- Your rights as a parent. You can review your children's information in the parent dashboard, or ask us for a copy of everything we store. You can correct a nickname or avatar in the grown-ups area. You can delete a single child's profile, or your whole account, in the app or by email. You can stop further collection at any time by signing out or deleting your account; the app keeps working on the device without sign-in.
If you believe a child's information reached us without a parent's permission, email hello@atlaroo.app and we'll delete it.
11. Families in the EU and UK
If you live in the European Economic Area or the UK, GeoTales is the controller of the personal data described here. The account holder is always the parent; children don't sign in or give consent themselves.
- Why we process it. We process account, profile and progress data to provide the service you asked for (syncing, the dashboard, subscriptions). We send the weekly summary email only if you chose it; you can switch it off at any time.
- Your rights. You can ask to access, correct, delete or export your family's data, and object to or restrict how we use it. Email hello@atlaroo.app. You can also complain to your data protection authority (in the UK, the Information Commissioner's Office).
- Designed for children (GDPR-K and the UK Age Appropriate Design Code). Settings are private by default. There's no profiling, no geolocation, no advertising, no social features and no in-app purchases aimed at kids. Streaks never pressure kids to pay, and reminders are set by a parent and never mention losing a streak. Grown-up controls sit behind a parental gate.
12. Where data is stored
Our database is Cloudflare D1, located in Cloudflare's Western North America (WNAM) region, in the United States. Expedition downloads are stored in the same region. Requests reach our servers through Cloudflare's global network, so they may pass through a Cloudflare data centre near you. If you're outside the United States, your family's data is transferred to and stored in the United States.
13. Security
- All traffic between the app and our servers uses HTTPS.
- We store only a hash of each session token, and the app keeps its token in the device's secure storage.
- We verify every Sign in with Apple token before creating a session. Email sign-in codes work once, for 10 minutes, with a limited number of tries, and we store only a salted hash of each code. Kids never have credentials.
No system is perfectly secure. If we learn of a breach that affects your data, we'll tell you as the law requires.
14. This website
atlaroo.app sets no cookies and runs no analytics or tracking scripts. Fonts and images are served from this site. Cloudflare, which hosts the site, processes requests (including IP addresses) to deliver pages and protect the site.
15. Changes to this policy
We'll update this page when the app or this policy changes, and change the date at the top. If a change affects how we use children's data, we'll tell parents first, in the app or by email.
16. Contact us
GeoTales, maker of Atlaroo
Email: hello@atlaroo.app