Children's Privacy Notice

Version 2.0 · Effective 13 October 2026. Replaces the previous version.

This notice has two parts. Part A is for children. Part B is for parents, guardians and schools. It explains our Privacy Policy as it applies to children. If anything here seems to differ from the Privacy Policy, the Privacy Policy applies.

Part A: For children

Hello, Eco Hero! Here is how we look after your information.

You can just play. If you play in the Eco Heroes app on your own, nothing about you is sent to us. Your games and points stay on your device.
We do not need to know who you are. We never ask for your address, phone number, email, photo or where you are.
No ads and no chat. There are no adverts. Nobody can send you messages through Eco Heroes.
Signing in and buying are for grown-ups. If the app asks a grown-up question, ask your parent or carer to help.
If your school gave you a class code, your teacher can see your progress, such as your points, badges and the goals you finished, so they can help you learn. Your school decides how this works.
Leaderboards are public. If you put your score on a website leaderboard, choose a nickname that is not your real name.
Surveys are your choice. You do not have to answer. Please do not write names or contact details in your answers.
You are in charge. Your parent, carer or teacher can ask us to show or delete your information at any time.
Worried about something? Tell a parent, carer or teacher. They can write to us at info@eco-heroes.org.

Part B: For parents, guardians and schools

1. Who we are

Eco Heroes International SL (CIF B44915940, Girona, Spain) is the data controller for the data described in our Privacy Policy, except class data processed for a school (see section 5). Contact: info@eco-heroes.org.

2. What we collect, and when

Eco Heroes is built so that a child can use it without giving us personal data.

A child playing in the app as a guest: nothing is sent to us. Progress is stored on the device. Uninstalling the app removes it.
A parent signing in to the app: sign-in sits behind a grown-up check (a typed arithmetic question). A parent signs in with Google (or Apple, where offered). We store the parent's email address, the sign-in identifier and the learning progress saved to the account. We store no data that identifies the child.
A family subscription: payment is taken by Google Play, Apple or Stripe. We never see card details. Our subscription provider receives only the account id and the purchase history, nothing about the child.
A device joined to a school class: the app sends the class dashboard the child's activity (games played, points, goals and badges) and a random installation identifier generated by the app. See section 5.
A pupil playing on the website with a school code: the pupil plays under the class code with a first name or nickname, an age and an avatar, and the teacher sees the pupil's progress. No email address, photo or date of birth is asked. See section 5.
Website leaderboards: we store the chosen nickname, an avatar from a fixed set, the score, the language and the goal, plus a one-way hash of the network address to stop abuse. The nickname is shown publicly.
Surveys: optional. We store the answers, the language and a broad respondent category, with no name or email address.
Parental consent requests: see section 4.

Children do not open website accounts. Website accounts are for teachers, schools and school administrators.

3. What we never do

No advertising, no advertising identifier and no third-party analytics or tracking in the app.
No access to location, contacts, photos, camera or microphone.
No free-text chat, messaging or public profiles. In-app leaderboards show schools and countries. An individual worldwide ranking appears only if a parent opts in, and then shows a generated alias.
No links in the app that take a child to the open web.
We do not knowingly collect a child's email address, contact details, photos, voice or location, and we never require a child's full name.
We do not sell personal data, share it for advertising, or use it for profiling.

On the website, Google Analytics and other optional cookies load only if the visitor allows them. See our Cookie Notice.

In the app, sign-in and every purchase are for parents and sit behind the grown-up check. The grown-up check keeps young children away from these steps. It is not an identity or age verification.
On the website, where the law requires consent and the child is below the age of digital consent in their country, we ask a parent first and record nothing until the parent confirms. That age is 14 in Spain, between 13 and 16 elsewhere in the EU, and 13 in the United States.
The parent's email address is used once, to send a confirmation link. Consent is recorded only when the parent opens the link and confirms. We do not store the address itself, only a keyed one-way hash, so that a repeated request can be recognised.
A parent may withdraw consent at any time by writing to info@eco-heroes.org. Withdrawing consent erases the data collected under it.

5. Schools

When a school uses Eco Heroes with its pupils, the school is the data controller for the class data and decides how it is used. We process that data on the school's behalf under our data processing agreement (Article 28 GDPR), available from our Trust Centre.
The school is responsible for its legal basis, for informing pupils and parents, and for obtaining any consent that its national law requires.
In the app, pupils appear to their teacher under a generated alias, never a name. The dashboard shows nothing for a class of fewer than five active pupils. Our server keeps only a one-way hash of the installation identifier.
A teacher can erase one pupil or the whole class at any time. Parents should send requests about class data to the school.
When a licence ends, we delete the school's data as the data processing agreement sets out.

6. How long we keep data

App account (parent's email, sign-in identifier, saved progress, subscription record): until the account is deleted.
School class activity: while the class is in use. A teacher can erase it at any time.
Survey answers: 24 months, or until consent is withdrawn.
Parental consent records: while relied upon. Unanswered requests: 30 days. Refusals: 12 months.
Website leaderboard entries: 12 months.
Abuse-prevention hashes: 30 days.

The full schedule, including backups and server logs, is in section 8 of our Privacy Policy.

7. Your rights

Parents and guardians may ask to see, correct or delete data relating to their child, and may withdraw consent, at any time. There is no charge and we answer within 30 days.

Delete an app account: in the app, Profile → Delete account, or follow eco-heroes.org/legal/delete/, which also works without the app.
School class activity: ask the child's teacher or school, who can erase it directly.
Anything else, or if you think a child has given us personal data without a parent's consent: write to info@eco-heroes.org and we will delete it.

You may also complain to a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es). Elsewhere in the EU, it is the authority of the country where you live.

8. Changes and contact

We publish every change on this page with a new version number and date. If a change materially affects how we use data already collected, we will tell account holders by email before it takes effect. Questions: info@eco-heroes.org.