Privacy Policy

Version 4.2 · Effective 23 October 2026. Replaces version 4.1 (13 October 2026).
This policy covers the Eco Heroes mobile app (package org.ecoheroes.app) and the website eco-heroes.org. The Eco Heroes Academy (learn.eco-heroes.org) and the VSME assessment (assessment.eco-heroes.org) are separate services with their own privacy notices.

1. Who we are

Eco Heroes International SL (CIF B44915940), registered office in Girona (Spain), registered in the Registro Mercantil de Girona, is the data controller for the personal data described here, under Article 4(7) of the EU General Data Protection Regulation (GDPR). Our full company details are in the Legal notice.

Data protection contact: info@eco-heroes.org. We have not appointed a data protection officer, because the law does not require one for what we do. Our founder, Karim Zouhdi, is responsible for data protection.

When a school, company or hotel uses Eco Heroes with its pupils, staff or guests, that organisation is the controller of that data and we process it on its behalf (see section 3 and our Trust Centre).

2. The Eco Heroes app

If a child just plays

Nothing leaves the device. The daily games, the questions and progress through the seventeen goals are stored in a database on the device itself. No account is needed and none is created. Uninstalling the app removes that data; the app does not use cloud backup.

If a parent signs in

Signing in is optional and sits behind a grown-up check (a typed arithmetic question). A parent signs in with their Google account (or with Apple, where the app is offered on Apple devices). We receive and store:

• the parent's e-mail address, as verified by Google or Apple (with Apple this may be a relay address);
• the sign-in identifier Google or Apple issues for that account, and the Eco Heroes account identifier we create from it;
• learning progress saved to the account, so that it can follow the family to another device.

We do not receive the password, the name, the profile picture or the contacts of that account.

If a parent subscribes in the app

In-app subscriptions are sold by Google Play (or Apple), which takes the payment. We never see card details. To know that a subscription is active, we and our subscription service RevenueCat process the purchase history of the account: which plan, when and until when. RevenueCat receives the Eco Heroes account identifier only, with no e-mail address, no name and nothing about the child.

If a school has joined the device to a class

Only on a device where a school's class code has been entered, the app sends the school's class dashboard:

• activity: which daily game was played, on which date and in which language, the points earned, whether it was completed and how long it took; which goals were reached and which badges earned;
• a random installation identifier generated by the app itself, used only to recognise a repeated upload. It is not the advertising ID or any identifier of the device or its operating system, and our server keeps only a one-way hash of it.

Pupils appear to their teacher under a generated alias, never a name, and the dashboard shows nothing for a class of fewer than five active pupils. We process this data for the school.

What the app never does

• No advertising, no advertising SDK; the advertising ID permission is removed.
• No third-party analytics or tracking SDK.
• No access to location, contacts, photos, camera or microphone.
• No chat and no public profile. Leaderboards in the app show schools and countries; an individual worldwide ranking exists only if a parent opts in, and then shows a generated alias.
• No links that take a child out of the app to the open web.

3. The website eco-heroes.org

If you only read the site

We do not ask who you are. The site stores only what it needs to work on your device: your language, your cookie choice, your sign-in session and, in the web games, your progress, which stays on the device. Google Analytics, which counts visits, runs only on pages for adults and only if you allow it in the cookie banner. Our typefaces are hosted on our own server, so showing them sends nothing to Google. Some educational videos play from YouTube in its privacy-enhanced mode, and the player loads only when you press play. Sign-in and registration forms use Cloudflare Turnstile, a check against automated abuse. Our servers and our network provider keep technical logs (such as the IP address and the page requested) for security and fault-finding. Details: Cookie Notice.

Pupils in a school class

A teacher creates a class and gives the pupils a class code. Only when a pupil joins with that code, our server stores, for the school:

• the first name or nickname the pupil types, or that the teacher entered (2 to 24 characters);
• the age group chosen in the game (9–12 or 13–17), an avatar from a fixed set and the language;
• progress: points, goals and missions completed, trivia stars, how many questions on each topic were answered and how many correctly, and which homework was completed;
• when the pupil joined and was last active, and a random class token kept on the pupil's device so that progress can be saved.

In a live class quiz we store the nickname the pupil enters, the answers, how long each took and the score. We never ask pupils for an e-mail address, a surname, a photo or a date of birth. Each teacher sees only their own classes; school administrators see all classes of their school. A teacher can rename, reset or remove a pupil, or delete the whole class, at any time. The school is the controller of this data and we process it for the school under our data processing agreement.

If a school runs an impact study

A school can enrol classes in an Eco Heroes impact study, a short questionnaire that pupils answer in class before and after the programme. We store the answers, language, age band and time taken, linked between rounds by a keyed code derived from the pupil's place in the class, never by a name. Free-text answers are filtered automatically when submitted: e-mail addresses and phone numbers are removed, and answers matching a short list of words that may show a child at risk are taken out of the study data and passed only to the person the school has named as its safeguarding contact, within one school day. If the school has not named anyone, or that person's account is closed, they go to the school's administrators; for a class that is not linked to a school (for example one used only through a learning platform), they go to Eco Heroes' safeguarding lead. Only these people see them. Names are not removed automatically; the researchers who read answers flag possible names and never report them. Free-text answers are never used in our statistics. Teachers see only class results. The school is the controller and tells parents, who can object to their child taking part.

Teacher accounts

Each teacher has their own named account. A school code is used only once, to enrol: it creates a named account with a verified e-mail address, or attaches the school to the teacher's existing account. After that the teacher signs in with their own e-mail address and password, or with Google or Microsoft if the school allows it. A device that has only entered a school code can play, but has no teacher tools. We keep the name, work e-mail address, school and role, language, the password (stored as a hash, never readable) or the sign-in identifier, and sign-in logs. Two-factor sign-in with an authenticator app is optional for teachers, required for the school's safeguarding contact to read safeguarding flags, and required for school administrators wherever pupil data is visible; after 10 wrong codes within 24 hours it is locked for 15 minutes and we e-mail the account holder; it is checked before a session is opened, and its backup codes are stored only as hashes. Registration and licence codes are stored only as keyed hashes; a code is shown once, when it is created. A teacher can also open a free account with a verified e-mail address; it gives the handbook lessons and the teacher guide only, without classes or members' content. We are the controller of the account itself; what a teacher does in a school's classes is processed for that school.

Family subscription on the website

A parent or guardian buys the family plan through Stripe. Before paying, you see a summary of the plan, the price with VAT included and the renewal date, and you confirm that you are an adult. Card details go directly to Stripe and never reach our servers. We keep your e-mail address (stored partly masked, plus a keyed hash of it so that we can find your plan when you cancel or withdraw), the Stripe payment and subscription references and a personal access code (stored only as a keyed hash). We also keep a record of your acceptance at checkout (time, version of the terms, the three boxes ticked and a keyed hash of the IP address) and of any cancellation or withdrawal request, as proof of the contract. We use them to unlock the plan, to send you the confirmation e-mail, to remind you 30 days before each renewal and to handle cancellation, withdrawal and refunds. When you sign in with the access code, a signed "remember me" cookie keeps you signed in on that device for up to 180 days; signing out removes it. If you ask to cancel or withdraw, we keep the e-mail address you give for up to 7 days to send you a link to confirm the request for any plan your access code does not identify, and delete it once the request is confirmed or the link expires.

Company and hotel licences

Companies offer Eco Heroes to their employees' children, and hotels to the children of their guests. The company or hotel is the controller. Its coordinator has an account with a name and a work e-mail address, opens groups and gives each group a join code. A child joins with that code and a hero name (a nickname) on their own or a family device, without an account and without an e-mail address. For the organisation we store the same data as for a pupil in a class: the hero name, age band, avatar, language and progress. The coordinator sees goals completed and quiz results per group, and can download them as a CSV file. We hold no contact details for the children. The children's data is deleted on the same rule as pupils' data: 90 days after the licence ends, unless it is renewed. Coordinators can turn on two-factor sign-in in their account.

For the organisation report, we also record for each hero profile in a company or hotel group the days it was active and the day each goal or mission was first completed (the date, not the time). School classes are not tracked this way. The organisation's administrators, signed in with two-factor sign-in, see only totals: never a child's name, a nickname or a row per child, and any figure based on fewer than 5 families is hidden. The organisation can put its groups into teams with labels it chooses, such as a department or a property, and can switch on a team leaderboard, which shows a team only when at least 5 of its families took part. These dates are kept with the hero profile and deleted with it.

A company or hotel can also have its name and logo shown on the children's certificates. The organisation gives us the name and logo, and we share nothing about the children with it. If the organisation opts in, a parent or guardian can choose, in the family area, to share a badge on LinkedIn. Only the adult can start this, and we send nothing to LinkedIn: the badge link holds only a number of goals, the organisation's name and a language, never information about your child, and the badge page sets no cookies. LinkedIn's own privacy policy applies to what you post there.

If an organisation asks us to set it up, its coordinators and staff can sign in through the organisation's own identity provider (for example Microsoft Entra ID, Okta or Google Workspace). We then receive only the sign-in result: the person's name, work e-mail address and a technical identifier, which we store only as a keyed hash. We never see the password. The identity provider is the organisation's own system, under its own contract with that provider; it is not a processor of ours. Children never sign in this way.

Trivia leaderboard

Posting a trivia score to the public leaderboard is optional: after each game, the player can choose to post it. The player posts under a nickname that we generate (an adjective and an animal); no free text or school name can be entered. The public board shows only the nickname and the score, for the top 10 of the last 30 days. We also store the language, the goal and a keyed hash of the network address, to stop one person flooding the board. Entries are deleted after 30 days. Every public entry has a Report link; an entry reported three times is hidden until we have reviewed it. A class board is visible only to that class's teacher and the school's administrators, who can remove entries; it is part of the school's class data. We run the public board on the basis of our legitimate interests (Article 6(1)(f) GDPR): it uses no real names, posting is always the player's choice, and entries last 30 days.

Programme surveys and parental consent

Some of our own surveys are open outside a class. They are optional. We store the answers, the language, a broad respondent category and a keyed hash of the network address, used only to limit abuse; no name or e-mail address is attached. Where the law requires a parent's consent, we send the parent a confirmation link. The parent's e-mail address is used once for that and not stored; we keep only a keyed hash, the decision and the time.

If you write to us, ask for a quote or apply as an ambassador

The contact form is delivered to us by Formspree, which receives your name, e-mail address and message. Quote requests and ambassador applications are sent by our own server. Our mailbox is hosted by Proton in Switzerland. We use what you send only to reply and, for quotes, to prepare and manage the contract. An ambassador application holds your name, e-mail address, country (optional), the ways you would like to help and your message. You must be 14 or older to apply; if you are under 18, you need the agreement of a parent or guardian. We use an application to answer it and, if you become an ambassador, to work with you on the programme: the legal basis is steps before an agreement and our legitimate interest in running the programme (see section 4).

Dinner Questions e-mails

If you ask for the free Dinner Questions PDF, your e-mail address goes to our e-mail provider Brevo, which asks you to confirm it and then sends you the PDF and a weekly family mission. Every e-mail has an unsubscribe link.

Separate services

The Eco Heroes Academy (learn.eco-heroes.org), the VSME assessment (assessment.eco-heroes.org) and our MoodleCloud course site (eco-heroes.moodlecloud.com) have their own sign-in and their own privacy information.

4. Why we use data, and on what legal basis

Our legitimate interests are: keeping the service secure and preventing abuse; answering people who write to us; offering an optional score board without real names; counting subscriptions in total. We weigh them against your interests, in particular where children are involved, which is why the leaderboard uses generated nicknames only.

Do you have to give us data? Only what a feature needs: an e-mail address for an account or a subscription, a nickname to join a class. Without it, that feature cannot work. Everything else is optional. We make no automated decisions with legal or similarly significant effects, and we do not use personal data for advertising or profiling.

5. Who processes data for us

The Trust Centre lists the same providers, in the same order as Annex III of our data processing agreement.

Google, Apple and the app stores act as independent controllers when they sign you in to your own account with them or sell you a subscription; their own privacy policies apply to that. A school's own learning platform (such as Moodle or Canvas) and its own Google or Microsoft tenant are chosen and controlled by the school. Account and service e-mails are sent by our own server. We do not sell personal data and we do not share it for advertising.

6. International transfers

Our own servers are in the European Union: the web servers in France, the database in Germany, and the standby server and the encrypted backups in Finland. Our e-mail is hosted in Switzerland, which the European Commission recognises as giving adequate protection. Where a provider above processes data outside the European Economic Area, the transfer relies on an adequacy decision (including the EU–US Data Privacy Framework where the provider is certified) or on the Commission's Standard Contractual Clauses. We have assessed each of these transfers in writing.

7. Children

Eco Heroes is made for children and young people, and you can use it without giving us a child's personal data. Our Children's Privacy Notice explains this in words for children and for adults.

• A child who plays the app as a guest sends us nothing.
• Sign-in and purchases are for adults: in the app behind a grown-up check, on the website with an adult confirmation at checkout. Neither checks identity or age.
• In a school class a pupil is known to the teacher only by a first name or nickname, for the school.
• The public trivia leaderboard is opt-in and uses generated nicknames only.

We do not knowingly collect a child's e-mail address, contact details, photos, voice or location. Where the law requires consent for a child below the age of digital consent in their country (14 in Spain; between 13 and 16 elsewhere in the EU; 13 in the United Kingdom and the United States), we ask a parent first and record nothing until they confirm. If you think a child has given us personal data without a parent's consent, write to info@eco-heroes.org and we will delete it.

8. How long we keep data

These periods are the same in our data processing agreement, our Children's Privacy Notice and our Trust Centre.

9. Your rights

You can ask to see the data we hold about you, have it corrected or deleted, receive it in a portable format, restrict or object to its processing, and withdraw any consent you gave. There is no charge, and we answer within one month.

• Delete an account or a subscription's data: see Delete your account and data, which covers app accounts, website family plans, teacher accounts and pupils' class data.
• Cancel or withdraw from a family plan bought on the website: use the cancellation and withdrawal page.
• Pupils' class data: ask the child's teacher or school, who can delete it at once.
• Anything else: write to info@eco-heroes.org.

You can also complain to a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es); elsewhere in the EU, the authority of the country where you live; in the United Kingdom, the Information Commissioner's Office (ico.org.uk).

10. Security

The app and the website talk to our servers only over encrypted connections (HTTPS), and our servers reach the database only over encrypted connections with certificate checks. Passwords are stored as hashes. Two-factor sign-in is available to every teacher and coordinator and required for school administrators, for a school's safeguarding contact and for our own administrators. Backups are encrypted (AES-256) and a restore is tested automatically every month. Only the people who run the service can reach the servers, and every administrative account uses two-factor sign-in. If a breach affects your data, we tell you and the supervisory authority as the law requires; we tell schools within 48 hours of becoming aware of a breach that affects their data.

11. Users in the United Kingdom

For users in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply alongside this policy, and you can complain to the Information Commissioner's Office. Data travels from the United Kingdom to our servers in the EU under the UK's adequacy regulations for the EEA.

We have checked Eco Heroes against the ICO's Age Appropriate Design Code. In short:

• Best interests of the child, and age-appropriate application: made for learning, with two age bands that only change content; sign-in and purchases are for adults.
• Transparency: a notice written for children (Children's Privacy Notice, Part A).
• Detrimental use, nudge techniques: no advertising, no endless feeds, no prompts to share data; the leaderboard is opt-in.
• Policies and community standards: we apply our terms and remove reported leaderboard entries.
• Default settings, data minimisation: guest play sends nothing; in a class, a nickname is enough.
• Data sharing: none for advertising; only the providers in section 5.
• Geolocation: none.
• Parental controls: no monitoring of a child by a parent through the service; a school's teachers see class progress, and the Children's Notice tells pupils so.
• Profiling: off; we do not profile.
• Connected toys and devices: not applicable.
• Online tools: children can ask a parent or teacher to write to us; the delete page explains each route.
• Data protection impact assessment: done and reviewed with each release; summary in the Trust Centre.

12. Schools in the United States

When a US school or district uses Eco Heroes, we act as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA). We use pupils' education records only to provide the service to the school, under the school's direct control, and we do not pass them on except to the providers in section 5 or where the law requires it. For pupils under 13, the school may consent on behalf of parents under the Children's Online Privacy Protection Act (COPPA), because we use the data only for the school's educational purposes. Parents can ask the school to review or delete their child's data, and the school can do this at once or ask us. We delete school data 90 days after the licence ends.

13. Changes to this policy

We publish every change on this page with a new version number and date. If a change materially affects how we use data already collected, we tell account holders and subscribers by e-mail before it takes effect.