Privacy Policy

Last updated: November 5, 2026

        The short version: You can play as a guest with no account, and guest progress stays on your device. If a parent signs in with their email, we store that email plus each player profile (name, age if given, avatar, settings and progress) so it can be backed up and synced across devices. There are no ads and no analytics inside the game. If a parent buys coins, the card payment is handled by our payment partner, and we never see card numbers. We never sell data. Small Universe is operated by CloudForge Ltd in Cyprus, under the EU and UK GDPR.
      

Data Controller

CloudForge Ltd (registered in Cyprus, company number ΗΕ490441), trading as Small Universe, is the data controller for personal data processed through smalluni.com and the Small Universe game. Registered address: Cavo Greco Avenue, Building 475, 007, Protaras, Paralimni, Cyprus. For privacy questions, email hello@smalluni.com or use our contact page.

What We Store, and Where

When	What	Where
Everyone, including guests	Player profiles (the name typed in, an optional age, an avatar), lesson progress, stars, hearts, streaks, coins, word statistics, the alien crew, the spaceship, saved words and settings	Only in your browser's storage on this device (localStorage and IndexedDB)
A parent signs in	The parent's email address. For each profile: name, age (if entered), avatar, accessibility settings, stats (including coins, streaks and word statistics) and lesson progress. Also the alien crew collection, achievements, companion and family data (weekly stats, challenges, the family mission), and a record of coins earned in lessons and spent in the Shop, linked to a profile ID	Our database at Supabase, on servers in the EU (Ireland)
A parent signs in	Sign-in records kept by our sign-in provider for security: time of sign-in, IP address and browser type	Supabase (EU)
A parent buys coins	An order record: account ID, the child profile that receives the coins, the pack or amount, the price, the currency, the time, the payment status and the payment partner's invoice ID. Also the receipt sent to the parent's account email	Our database at Supabase, on servers in the EU (Ireland)
A parent opens Buy coins or pays	The internet (IP) address of that request, looked up in an IP-to-country table to choose the currency prices are shown and charged in. The address and the country are not stored and not sent to anyone	Inside our own server function at Supabase, in the EU (Ireland)
A parent pays	Card details and the other payment details asked for on the payment page	Only our payment partner. Card numbers never reach us
You visit the website	Standard server logs (IP address, page requested, browser) kept by our hosting provider for security and troubleshooting, and Google Analytics on the marketing pages (see Cookies)	Our host (Hostinger) and Google

We do not collect phone numbers, home addresses, precise location or photos, and we never receive card numbers. We never receive voice recordings (see Pronunciation Practice below).

Children's Privacy (COPPA)

Small Universe is used by children, teens and adult learners. Children do not create accounts and are never asked for an email address. Player profiles are created on the device; we suggest using a first name or a nickname, and the age is optional.

A child's profile stays on the device unless a parent signs in. Signing in is done by an adult with their own email address, confirmed with a one-time code sent to that address; we treat the person who confirms the email as the child's parent or guardian, and signing in is the step where they agree to the storage described here. When a parent signs in, the profiles on that device are uploaded to our database so progress can be backed up and synced. We use this information only to run the service: we do not show ads, build marketing profiles, sell it, or share it except with the service providers listed below that run the service for us.

Parents can review a child's progress in the Family Dashboard (open the ••• menu on the map, then Settings; it sits behind a parent PIN), change or remove profiles, and delete the account and all synced data at any time (see Your Rights).

Inside the game there are no ads, no chat, and no links to other websites. Children cannot buy anything: only a signed-in parent can buy coins, in the Family Dashboard behind the parental gate (a grown-up check, then the parent's own PIN), and the payment page opens from there.

UK ICO Children's Code

As a service likely to be used by children in the UK, we follow the ICO Age Appropriate Design Code: high-privacy defaults (guest play with nothing leaving the device), no profiling of children, no advertising, and no nudges to weaken privacy settings.

Pronunciation Practice and the Microphone

The optional Pronunciation Practice uses the speech recognition built into your browser. The browser asks for microphone permission first. Depending on the browser, the recording may be processed by the browser maker (for example Google for Chrome, or Apple for Safari) under their own privacy terms. Small Universe never receives, stores or listens to the audio; we only receive the recognised word. You can decline the microphone and use the "I said it" button instead.

Coins

Players earn coins by finishing lessons and spend them in the in-game Shop. Coins have no cash value. A signed-in parent can also buy coins for a chosen profile; bought coins expire 60 days after payment, while earned coins do not expire. For signed-in families, each coin earned, bought or spent is recorded in a ledger on our servers linked to a profile ID (not a name), so balances stay correct across devices. For guests, the same record stays on the device.

Payments

When a parent buys coins, the card details are entered on and processed by our payment partner, on its own secure payment page. The partner handles the payment as an independent controller or, where it acts for us, as our processor. We do not receive card numbers.

We keep an order record (account ID, the child profile that receives the coins, the pack or amount, the price, the currency, the time, the payment status and the payment partner's invoice ID) and the receipt. The payment notifications we receive from the partner exclude the payer's personal details. We keep these records for as long as accounting law requires.

Prices in your currency. When a signed-in parent opens Buy coins, and again at checkout, our server function looks up the internet (IP) address of the request in an IP-to-country table it holds itself, to show and charge prices in the currency for that region: EUR in Europe, AED in the United Arab Emirates, SAR in Saudi Arabia, KWD in Kuwait, USD elsewhere. The address is not stored, and neither the address nor the country is sent to anyone else. The table is the free IP to Country Lite data from DB-IP (IP geolocation by DB-IP, licensed CC BY 4.0). It gives a country, not a precise location.

How We Use Your Data

We use the data above only to:

Let a parent sign in with a one-time code sent by email
Back up and sync progress across devices
Keep coin balances correct
Process coin purchases, send receipts, handle refunds and keep accounting records
Keep the service secure and fix problems
Answer support requests
Understand, in aggregate, how visitors use the marketing website (Google Analytics)

We do not use your data for advertising, profiling, or sale to third parties.

Legal Basis for Processing (GDPR)

For users in the UK and the European Economic Area, we rely on the following legal bases:

Processing activity	Legal basis (Art. 6 UK/EU GDPR)
Parent sign-in, backup and sync of profiles and progress	Contract performance (Art. 6(1)(b))
Coin ledger for signed-in families	Contract performance (Art. 6(1)(b))
Coin purchases, receipts and refunds	Contract performance (Art. 6(1)(b))
Showing coin prices in the currency for your region	Legitimate interest (Art. 6(1)(f))
Keeping order records for accounting	Legal obligation (Art. 6(1)(c))
Sign-in records, server logs, security	Legitimate interest (Art. 6(1)(f))
Responding to support requests	Legitimate interest (Art. 6(1)(f))
Website analytics (Google Analytics 4)	Legitimate interest, with opt-out available (Art. 6(1)(f))

Data Retention

On the device: kept until you clear your browser's site data for smalluni.com or reset progress in the app.
Account data: kept while the account exists. When you delete the account in the Family Dashboard, your sign-in and all synced profiles, progress, collection, achievements and family data are deleted straight away. If you ask by email, we do it within 30 days.
Coin records: after deletion, the amounts, reasons and dates of past coin entries are kept with no link to you, so ledger totals stay consistent.
Order records and receipts: kept for as long as accounting law requires, even if the account is deleted.
Sign-in records and server logs: kept for a limited period for security, then deleted by our providers.

Offline Play (PWA)

When you play or install the app, your browser saves the game and its lesson audio on your device so it can play offline. This cache holds only game files, pictures and audio, never personal data.

Service Providers and Third Parties

Supabase: our database and sign-in provider, including the emails that carry sign-in codes. Data is stored on EU servers (Ireland). See Supabase's privacy policy.
Our payment partner: it runs the secure payment page where a parent enters card details, and it processes the payment. We do not receive card numbers.
Hostinger: hosts smalluni.com and the game files, and keeps standard server logs.
Google Analytics 4: on the marketing pages only, never inside the game. It records pages visited, how you arrived, device and browser type and approximate location. Google says GA4 does not store IP addresses. You can opt out with Google's opt-out add-on. See Google's privacy policy.
jsDelivr: a public content network. For words that have no photo of their own, the game loads a small emoji picture from cdn.jsdelivr.net. Like any web request, this tells jsDelivr your IP address and browser; nothing else is sent.
Your browser's speech recognition: only if you use Pronunciation Practice (see above).

All fonts, including the reading font, and all narration and word audio are served from our own server. The game contains no advertising or analytics code that runs.

International Data Transfers

CloudForge Ltd is established in Cyprus, an EU member state, and our database is in the EU. Transfers from the UK to the EU rely on the UK's adequacy regulations. Google and jsDelivr may process data outside the European Economic Area; they do so under their own safeguards, such as Standard Contractual Clauses or the EU-US Data Privacy Framework.

EU and UK Representation

As a company established in the EU, we do not need a separate EU representative under Article 27 EU GDPR. For all data protection questions, email hello@smalluni.com.

Cookies and Browser Storage

Marketing website: Google Analytics sets first-party cookies (_ga and _ga_*) that last up to two years, to tell visits apart. To opt out, use Google's opt-out add-on.
Game: the game sets no cookies. It saves progress in your browser's storage (localStorage and IndexedDB). When a parent signs in, a sign-in token is kept in the same storage so you stay signed in.

Data Breach Notification

If a personal data breach puts your rights at risk, we will notify the Cyprus Commissioner for Personal Data Protection within 72 hours of becoming aware of it (and the UK ICO where UK law requires it), and tell affected account holders without undue delay where required.

Your Rights

Under the UK GDPR and EU GDPR you have the right to:

Access: a copy of the data we hold about you
Rectification: correct inaccurate data (most of it you can edit in the app)
Erasure: delete your account and data, in the Family Dashboard ("Delete Account & Data") or by email
Restriction: ask us to pause processing in certain circumstances
Portability: receive your data in a structured format (the Family Dashboard can export progress as a CSV file; email us for everything else)
Object: object to processing based on legitimate interest
Withdraw consent: where processing is based on consent, withdraw it at any time
Complain: to the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy), the UK ICO (ico.org.uk), or your national data protection authority

To exercise any right, email hello@smalluni.com. We reply within 30 days. Guest data never reaches us, so you can delete it yourself by clearing the browser's site data.

California Residents (CCPA/CPRA)

If you live in California, you have the right to know what personal information we collect, to ask for it to be deleted, and to opt out of its sale or sharing. We do not sell or share personal information. To exercise these rights, email hello@smalluni.com.

Security

There are no passwords: parents sign in with a one-time code sent to their email. All traffic between your device and our servers is encrypted with HTTPS, and each family can read only its own records in our database (row-level security). Card details are entered only on our payment partner's page and never reach our servers.

Changes to This Policy

If we change this policy in a material way, we will update the date above and, where appropriate, email signed-in parents.

Contact

Questions about this policy or your data? Email hello@smalluni.com or get in touch.