Children's Privacy Notice

Version 2.2 · Effective 23 October 2026. Replaces version 2.1 of 21 October 2026. New: the opt-in trivia leaderboard with generated nicknames, named teacher accounts, and the same deletion periods as our Privacy Policy and data processing agreement.

This notice has two parts. Part A is for children. Part B is for parents, guardians and schools. It explains our Privacy Policy as it applies to children. If anything here seems to differ from the Privacy Policy, the Privacy Policy applies.

Part A: For children

Hello, Eco Hero! Here is how we look after your information.

You can just play. If you play in the Eco Heroes app on your own, nothing about you is sent to us. Your games and points stay on your device.
We do not need to know who you are. We never ask for your address, phone number, e-mail, photo or where you are.
No ads and no chat. There are no adverts. Nobody can send you messages through Eco Heroes.
Signing in and buying are for grown-ups. If the app or the website asks a grown-up question, ask your parent or carer to help.
If your school gave you a class code, your teacher can see your progress, such as your points, badges and the goals you finished, so they can help you learn. Your school decides how this works.
The trivia leaderboard is your choice. You only appear on it if you want to. You pick a funny nickname from our list, so nobody sees your real name or your school. Only your nickname and your score are shown, and they disappear after 30 days.
See something wrong on the leaderboard? Press "Report" next to it and tell a grown-up.
Surveys are your choice. You do not have to answer. Please do not write names or contact details in your answers.
Class questionnaires. Sometimes your school asks your class to answer a short questionnaire before and after the Eco Heroes lessons, to see what the class learned. You can skip any question. There are no marks, and your teacher never sees your own answers, only the result for the whole class. If you write something that makes us worried about your safety, we tell the person at your school who looks after children, so they can help. If your class is not part of a school, we tell the person at Eco Heroes who looks after children's safety.
You are in charge. Your parent, carer or teacher can ask us to show or delete your information at any time.
Worried about something? Tell a parent, carer or teacher. They can write to us at info@eco-heroes.org.

Part B: For parents, guardians and schools

1. Who we are

Eco Heroes International SL (CIF B44915940, Girona (Spain); see our Legal notice) is the data controller for the data described in our Privacy Policy, except data processed for a school, company or hotel (see section 5). Contact: info@eco-heroes.org.

2. What we collect, and when

Eco Heroes is built so that a child can use it without giving us personal data.

A child playing in the app as a guest: nothing is sent to us. Progress is stored on the device. Uninstalling the app removes it.
A parent signing in to the app: sign-in sits behind a grown-up check (a typed arithmetic question). A parent signs in with Google (or Apple, where offered). We store the parent's e-mail address, the sign-in identifier and the learning progress saved to the account. We store no data that identifies the child.
A family subscription: payment is taken by Google Play, Apple or Stripe. We never see card details. On the website, the buyer confirms at checkout that they are an adult. Our subscription provider receives only the account identifier and the purchase history, nothing about the child.
A device joined to a school class: the app sends the class dashboard the child's activity (games played, points, goals and badges) and a random installation identifier generated by the app. See section 5.
A pupil playing on the website with a class code: the pupil plays under the class code with a first name or nickname, an age group and an avatar, and the teacher sees the pupil's progress. No e-mail address, photo or date of birth is asked. See section 5. Children of a company's employees or of a hotel's guests play the same way, with the organisation's group code.
The trivia leaderboard: optional. After each game the player can choose to post the score, under a nickname we generate (an adjective and an animal; no free text, no school name). We store the nickname, the score, the language, the goal and a keyed hash of the network address to stop abuse. The public board shows only the nickname and the score (top 10 of the last 30 days), and entries are deleted after 30 days. Each entry has a Report link; an entry reported three times is hidden until we review it. A class board is visible only to the class's teacher and the school's administrators. We run the public board on the basis of our legitimate interests; posting is always the player's choice.
Surveys: optional. We store the answers, the language and a broad respondent category, with no name or e-mail address.
School impact studies: when a school enrols a class in an Eco Heroes impact study, pupils answer a short questionnaire in class, up to three times. We store the answers, the language, the age band and the time taken, linked between the questionnaires by a keyed one-way code made from the pupil's place in the class. No name, e-mail address or date of birth is collected, and e-mail addresses or phone numbers typed into an answer are removed. An answer that may show a child is at risk is passed to the school's designated safeguarding contact; free-text answers are never used in our statistics. See section 5. A possible disclosure reaches the school's designated contact within one school day. If the school has not named one, or that person's account is closed, it goes to the school's administrators; for a class not linked to a school (for example one used only through a learning platform), to Eco Heroes' safeguarding lead. Only these people see it. Names are not removed automatically, but the researchers who read answers flag them and never report them.
Parental consent requests: see section 4.

Children do not open website accounts. Website accounts are named accounts for adults: teachers, school administrators and parents who subscribe.

3. What we never do

No advertising, no advertising identifier and no third-party analytics or tracking in the app.
No access to location, contacts, photos, camera or microphone.
No chat, messaging or public profiles. In-app leaderboards show schools and countries. An individual worldwide ranking appears only if a parent opts in, and then shows a generated alias. The website trivia leaderboard is opt-in and uses generated nicknames only.
No links in the app that take a child to the open web.
We do not knowingly collect a child's e-mail address, contact details, photos, voice or location, and we never require a child's full name.
We do not sell personal data, share it for advertising, or use it for profiling.

On the pages made for children (the games, the adventure game, trivia, the library, the goal pages, Wordle and the missions) we never load Google Analytics and never ask for analytics consent; only strictly necessary storage is used there. On other pages, Google Analytics loads only if the visitor allows it. See our Cookie Notice.

In the app, sign-in and every purchase are for parents and sit behind the grown-up check. The grown-up check keeps young children away from these steps. It is not an identity or age check.
On the website, where the law requires consent and the child is below the age of digital consent in their country, we ask a parent first and record nothing until the parent confirms. That age is 14 in Spain, between 13 and 16 elsewhere in the EU, and 13 in the United Kingdom and the United States.
The parent's e-mail address is used once, to send a confirmation link. Consent is recorded only when the parent opens the link and confirms. We do not store the address itself, only a keyed one-way hash, so that a repeated request can be recognised.
A parent may withdraw consent at any time by writing to info@eco-heroes.org. Withdrawing consent erases the data collected under it.

5. Schools, companies and hotels

When a school uses Eco Heroes with its pupils, the school is the data controller for the class data and decides how it is used. We process that data on the school's behalf under our data processing agreement (Article 28 GDPR), available from our Trust Centre. The same applies to a company that offers Eco Heroes to its employees' children, or a hotel that offers it to its guests' children.
The school is responsible for its legal basis, for informing pupils and parents, and for obtaining any consent that its law requires.
Each teacher has a named account and sees only their own classes. School administrators see all classes of their school and must use two-factor sign-in, as must the school's safeguarding contact to read safeguarding flags.
In the app, pupils appear to their teacher under a generated alias, never a name. The dashboard shows nothing for a class of fewer than five active pupils. Our server keeps only a one-way hash of the installation identifier.
A teacher can delete one pupil or the whole class at any time. Parents should send requests about class data to the school.
When a licence ends and is not renewed, we delete the school's class data 90 days later. If the school asks us in writing, we delete it within 30 days of the request.
Impact studies. Where a school runs an Eco Heroes impact study, the school is the data controller. It tells parents in advance and lets them opt their child out; where its law or policy requires written consent, only pupils with consent take part. Teachers see their class's results only when at least 10 pupils answered both before and after, and never an individual pupil's answers. The school names a safeguarding contact, who receives any answer that may show a child is at risk; until it does, or while that person's account is closed, these answers go to the school's administrators, and for a class not linked to a school, to Eco Heroes' safeguarding lead. Eco Heroes uses only pooled, anonymised results for its own reports, never free text.

6. How long we keep data

App account (parent's e-mail address, sign-in identifier, saved progress, subscription record): until the account is deleted.
School class data, and the data of children in a company or hotel group: while the class is in use; a teacher can delete it at any time. After the licence ends: 90 days. On the school's written request: within 30 days.
Live class quizzes: 30 days.
Trivia leaderboard entries: 30 days.
Survey answers: 24 months, or until consent is withdrawn.
Impact-study answers: 24 months after the study's last questionnaire round closes, then deleted.
Safeguarding flags (answers that may show a child at risk): the text is erased 30 days after the flag is handled; the flag is deleted 12 months after it was handled.
Parental consent records: while relied on. Unanswered requests: 30 days. Refusals: 12 months.
Abuse-prevention hashes: 30 days.
Backups: deleted data leaves them within 14 days.

The full schedule, including server logs and payment records, is in section 8 of our Privacy Policy.

7. Your rights

Parents and guardians may ask to see, correct or delete data relating to their child, and may withdraw consent, at any time. There is no charge and we answer within one month.

Delete an app account or a family plan's data: see Delete your account and data. It also works without the app.
School class data: ask the child's teacher or school, who can delete it directly.
A leaderboard entry: press "Report" next to it, or write to us; we remove it.
Anything else, or if you think a child has given us personal data without a parent's consent: write to info@eco-heroes.org and we will delete it.

You may also complain to a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es). Elsewhere in the EU, it is the authority of the country where you live; in the United Kingdom, the Information Commissioner's Office. Sections 11 and 12 of the Privacy Policy explain what applies in the United Kingdom and to schools in the United States.

8. Changes and contact

We publish every change on this page with a new version number and date. If a change materially affects how we use data already collected, we tell account holders by e-mail before it takes effect. Questions: info@eco-heroes.org.