Privacy Policy

Effective 12 August 2026 · Last reviewed 12 August 2026

Applies to mypettopia.org, www.mypettopia.org, mypettopia.web.app and mypettopia.firebaseapp.com — one application on several addresses.

← Back to PetTopia

PetTopia is a browser game that teaches financial literacy and school subjects to preschool and elementary learners. Because our players are children, this policy is written to be checked rather than trusted: everything below was verified against the application's source code on the date above, and the "known gaps" section exists specifically so this document does not quietly overstate our protections.

1. Who we are

PetTopia is operated jointly by its co-owners as an independent educational project. It is not owned by, affiliated with, or endorsed by any school, district or publisher. Mail to admin@mypettopia.org reaches the owners directly.

We are the data controller for independent players who sign up on their own. For children enrolled through a class code, we act as a service provider on behalf of the teacher and their school — see section 4.

2. The short version

• We collect the least identifying information we could make the game work with: a username, a pet name, and game progress.
• We never ask a child for their real name, email address, phone number, home address, date of birth, photograph or location.
• We run no analytics, no advertising and no tracking of any kind. No Google Analytics, no pixels, no ad network.
• We never sell or share personal information for advertising, and never will.
• Teachers can see their own pupils' progress. That is the point of the class feature, and it is the only cross-user visibility that exists by design.
• A public leaderboard shows the username, pet name and level of the top ten independent players. Children in a class are ranked only within their class and never appear on the public board.

3. What we collect, exactly

Described by where the data actually lives, because that is the only description that can be audited.

3.1 Account credentials

Pre-K children use no password. They tap their name on a class list, then tap a sequence of three pictures. That sequence is turned into a password on the child's own device; the pictures themselves are stored where only that child's own teacher can read them (3.5).

3.2 The player's game record

Written whenever the game saves: pet name, species and avatar, coins, savings, a spending log (most recent 100 entries), pet care stats, savings goal, difficulty, evolution level, total earned, XP, level, badges, equipped accessory, islands unlocked, cities visited, flights taken, tour progress, play streak, last play day, per-subject mastery, quiz topic statistics, assignment progress, the read-aloud preference, the pre-K flag, the account role, the class code if any, and creation and last-saved timestamps.

All of it is game progress. None of it is a real-world identifier — with one honest exception: a child may type their own real first name as their username or pet name, and nothing stops them. We advise teachers to issue usernames that are not full names, but we cannot enforce what a child types. See section 9.

3.3 Class data

Created by a teacher: class name, the teacher's username, a roster of pupils (username, the display name the teacher chose — usually a first name — and a muted flag), class settings, teacher-authored quiz sets, teacher-added tutor video links, and assignments.

3.4 Class messages

A simple class chat. Each message stores its text (240 characters maximum), the sender's username and a timestamp. Only members of that class and their teacher can read them. The teacher can read and delete every message in their class — this is intended oversight, not surveillance by stealth, and children should be told about it.

3.5 Pre-K sign-in secrets

The picture sequence for one child, plus sign-in counters. The most tightly restricted data in the application: no pupil can read it, including the child it belongs to. Only the owning teacher can read it (to print sign-in cards) or write it (to enrol a child or reset their pictures).

3.6 The leaderboard

Username, pet name, evolution level, total earned, and quiz correct/total counts. The leaderboard is publicly readable. The game displays only the top ten independent players; class members are filtered out and ranked within their class instead. Treat a leaderboard entry as public information.

3.7 Stored on the device only

Never transmitted to us: the signed-in username, the chosen work grade and subject, the sound-muted flag, the read-aloud flag, the pre-K flag, and a "tutorial already seen" flag. Clearing your browser's site data removes all of it. Firebase also stores a session token in the browser so the child stays signed in.

3.8 What our host records automatically

Firebase Hosting and Google Cloud keep standard server logs (IP address, user agent, requested URL, timestamp), as any web server does. We do not analyse these, build profiles from them, or connect them to a player account. They are retained under Google's operational schedule, not ours.

4. Children's privacy — COPPA, FERPA, and the two ways in

PetTopia is knowingly directed at children under 13, so the US Children's Online Privacy Protection Act applies to us directly. There are two ways an account comes to exist, and the consent basis differs.

4.1 Classroom accounts — school consent

When a teacher creates a class and enrols pupils, we rely on the school consent exception recognised by the FTC: the teacher, acting for the school, consents on parents' behalf for the educational use of the service. Our obligations under that exception, which we accept:

• We use classroom children's information only to provide the educational service — no advertising, no profiling, no secondary use, ever.
• We collect no more than the activity requires.
• The school or teacher may request access to, correction of, or deletion of their pupils' data at any time by writing to admin@mypettopia.org, and we will act on it.
• We do not condition a child's participation on disclosing more than is reasonably necessary.

4.2 Independent accounts — parental consent

A child can also sign up without a class code. If your child is under 13 and signed up independently, we are relying on you, the parent or guardian, having permitted it. We do not currently operate a verifiable parental-consent flow — this is a real gap, stated plainly in section 9 — and in the meantime we deliberately keep independent accounts to the smallest data set the game can run on: a username, a pet name and progress.

A parent may at any time review what we hold about their child, ask us to correct it, ask us to delete it, or refuse further collection, by writing to admin@mypettopia.org. Refusing further collection means the account is closed; we will not retaliate by degrading a child's other access.

5. Who can see what

"Us, on request" means the owners can read the database when investigating a support issue or a safety report. We do not browse it routinely.

6. Third parties

We use very few, and none of them are marketing companies.

• Google Firebase (Authentication, Cloud Firestore, Hosting) — our entire backend. Google receives your IP address as an unavoidable consequence of serving the app.
• Google Fonts — the app's typeface. Requesting a font discloses your IP address to Google.
• jsDelivr — serves the 3D background library. Same IP disclosure.
• YouTube — teachers may add tutor video links, which appear as embedded players. A YouTube embed is a Google service with its own cookies and its own privacy policy, and watching one is a disclosure to Google that we do not control. Teachers should weigh this before adding videos. As of this date the embed is additionally blocked by our Content Security Policy; we are deciding whether to allow it deliberately or remove the feature, and this section will be corrected either way.

We use no analytics or advertising service. Firebase Analytics was removed from the code on 12 August 2026, and every Google Analytics and Tag Manager origin was removed from our Content Security Policy at the same time, so one cannot be re-added without that change being visible.

7. Security

What is in place, honestly scoped:

• All traffic is HTTPS.
• Passwords are hashed by Firebase Authentication; we never hold them.
• Database rules enforce that a player can read and write only their own record — tested against an emulator rather than assumed.
• Pre-K picture sequences are readable only by the owning teacher — not even by the child.
• A Content Security Policy without inline scripts limits the damage an injected script could do.
• Sessions end when the browser closes, and the app signs a child out after 25 minutes of inactivity, because classroom devices are shared.
• Class messages are length-limited and attributable to their sender.

No system is perfectly secure, and a project this size should not claim otherwise. We are currently conducting a second, wider security review precisely because we judged our first one insufficient. If we ever discover a breach affecting children's data, we will notify affected teachers and parents at the addresses we have, and post a notice here.

To report a vulnerability, write to admin@mypettopia.org. We will not pursue anyone who reports a genuine issue in good faith and does not access other people's data in the process.

8. Retention and deletion

• Game records persist while the account exists, so a child does not lose their pet between sessions.
• Removing a pupil from a class does not currently delete their game record — the teacher dashboard says so at the moment it asks for confirmation.
• There is no self-service "delete my account" button yet. Until there is, deletion is by request: write to admin@mypettopia.org from the parent's or teacher's address with the username, and we will delete the account record, the leaderboard entry, the class roster entry and any pre-K secret, and confirm when it is done. We aim to complete this within 30 days.
• Guest play saves nothing to our servers at all.

9. Known gaps — what this policy is not claiming

Stated deliberately, because a children's privacy policy that hides its own weaknesses is worse than none.

1. No verifiable parental consent flow for independent sign-ups (4.2).
2. The class record is world-readable, exposing class name, teacher username and pupils' display names to anyone with the code (3.3). Being fixed.
3. No self-service deletion (section 8).
4. We cannot stop a child typing their real name into a username or pet name field, and we do not currently screen for it.
5. Leaderboard writes are trusted from the client within bounds; a determined player can post inaccurate scores about themselves.
6. No age gate. We do not ask a date of birth — deliberately, since asking would collect more personal data than it protects — but the consequence is that we cannot distinguish a 7-year-old from a 15-year-old at sign-up.

Each of these is tracked as open work, not filed away.

10. Your rights

Wherever you live, you may ask us to show you what we hold, correct it, delete it, or stop collecting it. Parents may exercise these on behalf of their child; teachers and schools may exercise them for their pupils. Write to admin@mypettopia.org. We do not require a special form and we do not charge.

UK / EU: our lawful basis is consent (obtained via the school or the parent); data is processed in Google's infrastructure, which may involve transfers outside your country under Google's own safeguards; and you have the right to complain to your national data protection authority.

California: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not use personal information for cross-context behavioural advertising.

11. Changes to this policy

If we change how we handle information in a way that materially affects children — collecting something new, or sharing with someone new — we will ask for consent again rather than rely on a quiet update. Lesser changes will be posted here with a new "last reviewed" date. Material changes will also be sent to the class teachers we can reach.

12. Contact