Privacy Policy

Last updated: July 11, 2026 (version privacy-2026-07-11)

🐉 For kids: what we know about you

Here is everything Dragon Academy knows: your made-up nickname, your password (all scrambled up so nobody can read it — not even us), and your dragons. That's it! No real name, no photo, no school, nothing else. Promise.

Who we are

Dragon Academy is an educational game for children roughly 7–13, where kids raise "knowledge dragons" by answering quiz questions. This policy explains, plainly, what data the game handles. The short version: as little as we can get away with.

What we collect

  • Account (optional): a made-up nickname and a password. The password is hashed with bcrypt by Supabase Auth — we never see or store it in readable form. No email address exists on the account; the nickname is the whole identity.
  • Game progress: the dragons, levels, badges, and quiz results that make up a save file, stored so it can be restored on another device. Child profiles are a display name (we ask for a made-up one) and a dragon avatar — nothing else.
  • Consent record: when a parent creates an account, we store the moment of the affirmation and which policy version was shown.
  • Anonymized product analytics: which game features are used (e.g. "a quiz was finished"), with no cookies, no persistent identifier across visits, no autocapture, and no session recording. We use this to make the game better, not to profile anyone.
  • Push reminders (optional, parent-enabled): if a parent turns reminders on, the browser's push subscription token is stored so we can send at most one gentle reminder a day. Turning it off deletes the token.

What we never collect

No real names, no email addresses, no photos, no location, no contacts, no free-text chat, no advertising identifiers. There are no ads, no third-party trackers, no selling or sharing of data — full stop.

Cookies & storage

The game keeps its save file in your browser's local storage so it works offline. We do not use tracking cookies. Analytics runs in memory only and forgets the visit when the tab closes.

How long we keep things

Cloud saves and account data are kept until you delete them. There is no shadow copy: deletion removes the account, every child profile, every save, and any push subscription, immediately and permanently.

Deleting everything

Parents can delete the account and all cloud data themselves at any time: Settings → Cloud Save Account → Delete account. The device's local copy is wiped in the same step. No email, no support ticket, no waiting.

Third parties we rely on

Supabase hosts the database and account system; PostHog processes the anonymized analytics described above. Both act as processors under data-processing agreements and receive only the minimal data described on this page.

Questions

This game collects so little on purpose. If anything here is unclear, or you want data removed and the self-service path doesn't work for you, contact the team via the in-game feedback button — it reaches us directly.