Privacy policy

1. Who we are

Sachiri Quest is run by Carl Abarintos, Melbourne, Victoria, Australia (“we”, “us”). We are responsible for the personal information described here. Contact us about privacy at carl_abarintos@yahoo.com.

This policy covers the Sachiri Quest website, the parent portal and the game. It is written for parents and guardians, because only a parent or guardian can create an account.

2. How we treat children's information

Sachiri Quest is made for children in Years 1 to 6 (about ages 5 to 11), so we designed it to know as little about them as possible.

• A parent sets everything up. Children can't sign up. A parent or guardian creates the account, agrees to this policy on their child's behalf, and adds each child.
• No real names, emails, photos, birthdays or locations for children. A child is a nickname you choose (it doesn't need to be their real name), a school year and a hero. They log in with a hero code, not an email or password.
• Children can't talk to anyone. There is no chat, no messaging, no friends list and nothing children can post for others to see.
• No ads, no tracking, no selling. We don't show ads, use advertising or analytics trackers, build marketing profiles, or sell or rent anyone's information.
• No real-money purchases in the game. Tokens are earned by learning and by duties you approve. They can't be bought and have no money value.
• You stay in control. You can see your child's progress, sign them out, turn off their code, or delete their profile at any time.

3. What we collect and why

About you (the parent or guardian)

About each child you add

Choosing questions from topics a child finds hard is automated, but it only decides which learning questions come next. It is never used for marketing or to make any decision about your child outside the game.

Security and technical information

• When someone types a hero code, we keep a scrambled (hashed) version of their internet address with each wrong try, so we can slow down anyone guessing codes. These records are deleted after one day.
• Our hosting providers keep short-lived server logs (such as internet address, browser and time of request) to keep the service running and secure.

4. Cookies and local storage

We only use cookies that the service needs to work. There are no advertising or analytics cookies, so there is no cookie banner.

• Parent sign-in cookies keep you signed in to the portal.
• The hero cookie (sq_hero) keeps your child signed in on their device. It holds a random token, not their name or code, and stops working after 14 days without play or when you sign them out.
• The free demo on the home page saves its practice hero in the browser's own storage on that device. It is never sent to us, and the real game saves nothing there.

5. Read-aloud

If read-aloud is on, questions are spoken by the voice built into your child's device or browser. Some browsers use an online voice from the browser maker (for example Google or Apple); in that case the question text, but nothing about your child, is sent to them to be spoken. You can turn read-aloud off in your child's settings.

6. Who can see it

• You. Only the parent account a child belongs to can see that child's information. Other families can't see it, and children can't see each other.
• Our service providers, who store and process data only on our instructions and only to run Sachiri Quest: Supabase (database, sign-in and account emails) and Vercel (website hosting). Your data is stored in Australia. If a provider processes data in another country, we rely on their contractual safeguards for that transfer.
• If the law requires it, for example a valid court order, or to protect a child's safety.

We never share children's information with advertisers or data brokers, and never sell it.

7. How long we keep it

• We keep your account and your children's profiles until you delete them.
• When you delete a child's profile or your account, it is removed from our live systems straight away.
• Copies in our encrypted backups are overwritten within 30 days.
• Wrong hero-code tries are deleted after one day.

8. Your choices and rights

In the parent portal you can, at any time:

• see your child's progress, tokens, duties and the devices they're signed in on;
• change their nickname, year, hero and settings;
• sign them out everywhere or turn off their hero code;
• delete a child's profile (in that child's Settings), or delete your whole account (in Account). This deletes everything linked to it, and stops us collecting anything more.

You can also email carl_abarintos@yahoo.com to ask for a copy of your family's information, to correct it, or to ask us to stop using it. We'll reply within 30 days, and may ask you to confirm it's really you.

Depending on where you live, you may have more rights under laws such as the Australian Privacy Act, the UK and EU GDPR (including the UK Children's Code) and the US Children's Online Privacy Protection Act (COPPA). Where the GDPR applies, we use your information to provide the service you asked for (a contract with you), to keep it secure (our legitimate interests), and, for your children, with your consent as their parent or guardian. You can complain to your local privacy regulator, such as the OAIC in Australia, the ICO in the UK or the FTC in the US, but please contact us first so we can try to help.

9. How we keep it safe

• Everything is sent over encrypted connections (HTTPS).
• Passwords and hero codes are stored only as secure hashes.
• Database rules mean each parent can reach only their own family's data.
• Hero-code guessing is rate-limited.
• If a data breach is likely to put your family at risk, we'll tell you, and the regulator where the law requires, as quickly as we can.

10. Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects how we use children's information, we'll email you and ask for your agreement before it applies. See also our terms of use.