Privacy Policy
Version 4.0 · Effective 4 October 2026. Replaces version 3.0 (27 November 2024).
This policy covers the Eco Heroes mobile app (package org.ecoheroes.app) and the website
eco-heroes.org.
1. Who we are
Eco Heroes International SL, a Spanish company (CIF B44915940) with its registered office in the province of Girona, Catalonia, Spain, is the data controller for the personal data described here, under Article 4(7) of the EU General Data Protection Regulation (GDPR).
Data protection contact: info@eco-heroes.org
2. The Eco Heroes app
If a child just plays
Nothing leaves the device. The daily games, the questions and progress through the seventeen goals are stored in a database on the device itself. No account is needed and none is created. Uninstalling the app removes that data; the app does not use cloud backup.
If a parent signs in
Signing in is optional and sits behind a grown-up check (a typed arithmetic question). A parent signs in with their Google account (or with Apple, where the app is offered on Apple devices). We receive and store:
- the parent's email address, as verified by Google or Apple (with Apple this may be a relay address);
- the sign-in identifier Google or Apple issues for that account, and the Eco Heroes account id we create from it;
- learning progress saved to the account, so it can follow the family to another device.
We do not receive the password, the name, the profile picture or the contacts of that account. The sign-in is always a parent's: a child cannot reach it without passing the grown-up check.
If a parent subscribes
Family subscriptions are sold through Google Play, which takes the payment. We never see or store card or payment details. To know that a subscription is active, we and our subscription service provider RevenueCat process the purchase history for the account: which plan was bought, when, and until when. RevenueCat receives the Eco Heroes account id only — no email address, no name, and nothing about the child.
If a school has joined the device to a class
Schools with a licence give pupils a class code. Only on a device where a class code has been entered, the app sends the school's class dashboard:
- activity: which daily game was played, on which date and in which language, the points earned, whether it was completed and how long it took; which goals have been reached and which badges earned;
- a random installation identifier generated by the app itself, used only to recognise a repeated upload. It is not the advertising ID, the Android ID or any identifier assigned by the device or its operating system, and our server keeps only a one-way hash of it.
Pupils appear to their teacher under a generated alias, never a name, and the dashboard shows nothing at all for a class of fewer than five active pupils. The school decides to use the class code and is responsible for that use; we process this data on the school's behalf.
What the app never does
- No advertising, no advertising SDK, and the advertising ID permission is removed from the app.
- No third-party analytics or tracking SDK.
- No access to location, contacts, photos, camera or microphone.
- No free-text chat or public profile. Leaderboards in the app show schools and countries; an individual worldwide ranking exists only if a parent opts in, and then shows a generated alias.
- No links that take a child out of the app to the open web.
3. The website eco-heroes.org
If you only read the site
We do not ask who you are. The site uses Google Analytics to count visits; see our Cookie Notice for the choices available to you. Our server and our network provider keep technical logs (such as IP address and the page requested) for security and fault-finding.
If you have a website account
Accounts exist for teachers, schools and school administrators. We hold the email address, the name and the password (stored hashed, never in readable form) needed to run the account, and the school it belongs to. School access codes carry no personal data.
If you answer a survey
Surveys are optional. We store the answers, the language, a broad respondent category and a keyed one-way hash of the network address, used only to limit abuse. No name and no email address is attached to a response. Please do not write names or contact details in free-text answers.
If you ask for parental consent for a child
A parent's email address is used once to send a confirmation link. Consent is recorded only when the parent opens that link and confirms. The address itself is not stored — only a keyed one-way hash, so that a repeated request can be recognised.
If you post a score on a website leaderboard
We store the nickname you choose, the avatar picked from a fixed set, the score, the language and the goal it relates to, plus a one-way hash of the network address to stop one person flooding the board. Choose a nickname that is not your real name: it is shown publicly.
Payments on the website
Where the website offers card payments, they are handled by Stripe. Card numbers never reach our servers.
4. Why we use data, and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Parent's email and sign-in identifier | Running the account; restoring a subscription and progress on another device | Contract (b) |
| Purchase history | Unlocking what was paid for; measuring subscriptions in aggregate | Contract (b); legitimate interests (f) |
| Class activity and installation identifier | The class progress view a school licence includes | Processed for the school, which determines its own basis |
| Website account data | Running the account | Contract (b) |
| Survey answers; children's website data requiring consent | Research into the programme; the feature consented to | Consent (a), a parent's where the child is below the age of digital consent |
| Website analytics | Understanding how the site is used | Consent (a) |
| Technical logs, abuse-prevention hashes | Security and keeping the service running | Legitimate interests (f) |
We do not use personal data for advertising or profiling, and we make no automated decisions with legal or similarly significant effects.
5. Who processes data for us
| Recipient | What for | Where |
|---|---|---|
| OVH SAS, through our hosting company Internet Girona | Hosting the servers and databases | France (EU) |
| Cloudflare | Delivering the website and API securely, and protecting them from attack | Global network |
| RevenueCat, Inc. | Managing app subscriptions (account id and purchase history only) | United States |
| Parent sign-in; selling subscriptions through Google Play; website analytics | EU and United States | |
| Apple | Parent sign-in and subscriptions, where the app is offered on Apple devices | EU and United States |
| Stripe | Card payments on the website, where offered | EU and United States |
Google and Apple act as independent controllers when they sign you in to your own account with them and when they sell you a subscription; their own privacy policies apply to that. Email we send is sent by our own server. We do not sell personal data and we do not share it for advertising.
6. International transfers
Our own servers are in the European Union (France). Where a provider listed above processes data outside the European Economic Area, the transfer relies on a European Commission adequacy decision (including the EU–US Data Privacy Framework where the provider is certified under it) or on the Commission's Standard Contractual Clauses.
7. Children
Eco Heroes is made for children and young people, and is built so that using it does not require giving us personal data. In the app:
- a child who plays as a guest sends us nothing;
- sign-in and every purchase are for parents and sit behind a grown-up check;
- school class activity is recorded under an alias, for the school.
We do not knowingly collect a child's name, email address, contact details, photos, voice or location. If you believe a child has given us personal data without the consent of a parent or guardian, write to info@eco-heroes.org and we will delete it.
On the website, where the law requires consent for a child below the age of digital consent in their country (14 in Spain; between 13 and 16 elsewhere in the EU; 13 in the United States), we ask a parent and record nothing until they confirm. Parents and guardians may ask to see, correct or delete data relating to their child at any time, and may withdraw consent; withdrawing consent erases the data collected under it.
8. How long we keep data
| Data | Kept for |
|---|---|
| App account (email, sign-in identifier, saved progress, subscription record) | Until you delete the account |
| Purchase record held by RevenueCat | Deleted when you delete the account |
| School class activity | While the class is in use; a teacher can erase one pupil or the whole class at any time |
| Website account data | While the account is active, then 12 months |
| Survey answers | 24 months, or until consent is withdrawn |
| Parental consent records | While relied upon; unanswered requests 30 days; refusals 12 months |
| Website leaderboard entries | 12 months |
| Abuse-prevention hashes | 30 days |
| Encrypted backups | Up to 12 months, then overwritten |
| Technical server logs | Up to 90 days |
| Payment records held by Google, Apple or Stripe | Set by them, as the seller or payment provider |
9. Your rights
You can ask to see the data we hold about you, have it corrected or deleted, receive it in a portable form, restrict or object to its processing, and withdraw any consent you gave. There is no charge and we answer within 30 days.
- Delete an app account: in the app, Profile → Delete account; or follow eco-heroes.org/legal/delete/, which also works without the app.
- School class activity: ask the child's teacher or school, who can erase it directly.
- Anything else: write to info@eco-heroes.org.
You also have the right to complain to a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es); elsewhere in the EU, the authority of the country where you live.
10. Security
The app and the website communicate with our servers only over encrypted connections (HTTPS). Passwords for website accounts are stored hashed. Access to the servers is restricted to the people who operate the service. No system is perfectly secure; if a breach affecting your data occurs we will tell you and the supervisory authority as the law requires.
11. Changes to this policy
We publish every change on this page with a new version number and date. If a change materially affects how we use data already collected, we will tell account holders by email before it takes effect.