Koko's World privacy policy
Draft: this policy is being reviewed before launch. The version published at launch is the one that applies.
Koko's World is a story game where children aged 4 to 12 practise everyday social skills, and parents follow how they grow. It is meant to be set up and used with a parent. This page explains what we keep, why, and how you can see or delete it.
In short
- We keep only what the game needs: a nickname, an avatar, an age band and what happens in the stories.
- No ads, no third-party analytics or tracking, and we never sell data.
- The parent area and the child's age band sit behind a grown-up check.
- Data stays in our own database; you can ask us to export or delete it at any time.
Who we are
Koko's World (ScenarioPlay) is made by runupbiz. If you have a question about this policy or your data, write to us at the address at the end of this page.
For parents, and children aged 4 to 12
A parent sets the app up. The child's age band (4–6, 7–9 or 10–12) decides which stories are offered, and it can only be chosen or changed after a simple grown-up check, the same check that guards the parent area.
A parent account (email and password) is optional; it lets you keep progress across devices. When you create one we record the time you agreed to this use, as Malaysia's Personal Data Protection Act 2010 expects for children's data.
What we store about your child
The nickname you enter (please don't use the child's full real name), the chosen avatar and the age band.
What happens in the game: which stories were played and when, the choice made at each step, points, level, badges and strengths earned, the parent tip shown after a story, the daily challenge, which story versions have been seen, and the game's own estimates (such as how well a story has been practised, or a focus and mood score) that it uses to pick the next story.
Connection data
When a profile is created and each time a story is finished, we save the internet (IP) address the request came from and the country it maps to, as reported by our network provider. We keep it with that record for security and to understand where the app is used. It is never used for advertising or to build a profile of the child.
The parent account
Your email address, your password stored only as a one-way hash (never in readable form), when the account was created and updated, and when you gave consent. If weekly reports are switched on, we send a short weekly progress email to that address.
On your device
The app keeps the child profiles and their progress in your browser's storage, together with a random device code that links this device to its profiles on our server. Clearing the site data in your browser removes them from the device.
Feedback you send
If you use the feedback form, we store your message, its type and rating, and the platform and app version, so we can answer and fix problems.
How we use it
Only to run the game: to show the stories, choose the next one for the child's age band, keep progress, and show you the parent area (strengths, social-rule areas, activity and tips). We do not use children's data for advertising or marketing, and we never sell it.
No ads, no trackers, and the services we rely on
Koko's World has no advertising and no third-party analytics, crash-reporting or tracking code. The progress you see in the parent area is worked out on our server from the records above; there is no separate event tracking.
Two services see technical information when the app is used: Cloudflare, which delivers the site and so sees the IP address of each request, and Google Fonts, from which the app loads its typeface, so Google receives the device's IP address and browser details when the font loads. If you create a share picture of your child's progress, the app loads a drawing library from unpkg.com, and the picture is made on your device and shared only where you choose.
Story narration uses your device's built-in speech voices. Nothing your child says or does is recorded as audio or video.
Where it is kept
Accounts, profiles and game records are stored in our own database on a server we run ourselves, not in a third-party cloud storage service.
How long we keep it
As long as the profile or account exists. When you delete an account, its profiles and every record linked to them are removed from the live database at once; copies in backups are removed within 30 days.
Seeing, correcting and deleting
You can change a child's age band in the parent area. To get a copy of your account's data, to correct it, to delete an account and everything linked to it, or to withdraw consent, write to us from the account's email address and we will do it within 30 days.
Children's safety
Children cannot chat with other people, there are no public profiles, and the only text a child can type is the nickname. The stories teach children to keep personal details private and to tell a trusted adult.
Changes
If we change this policy, we will publish the new version here with a new date before it applies.
Contact
Questions, requests to see or delete data, or concerns: [email protected]