Privacy Policy
Last updated: August 19, 2026
The short version
- We collect one parent email and kid nicknames. That is it.
- No cookies, no analytics, no tracking pixels, no ads.
- We never sell, rent, or share your data with advertisers.
- Kids never provide personal information.
- Parents control everything and can delete all data at any time.
Numbercade ("we," "us," or "our") is operated by Dara Lee Luca, doing business as Numbercade, located at 6530 Heather Brook Ct, McLean, VA 22101, United States. This Privacy Policy explains how we collect, use, and protect information when you use our website at numbercade.com and associated services (the "Service").
We built Numbercade for children, and we take that responsibility seriously. This policy is designed to be clear, honest, and thorough.
1. Information We Collect
Information you provide directly
| Data | Who provides it | Purpose |
|---|---|---|
| Parent email address | Parent/guardian | Account creation, magic-link sign-in, account recovery |
| Kid profile nickname (max 20 characters) | Parent/guardian | Identify the child's profile within the family account |
| Kid profile emoji avatar | Parent/guardian | Visual identifier for the child's profile |
That is the complete list. We do not collect real names, birthdates, physical addresses, phone numbers, photos, or any other personal information from children.
Information generated through use
- Game progress data: scores, stars, coins, and world/level completion status. This data is stored in the browser's localStorage and, if a parent creates an account, optionally synced to our database.
Information we do NOT collect
- No IP address logging for user profiles
- No device fingerprinting
- No location data
- No browsing history or cross-site tracking
- No behavioral analytics or usage patterns
- No photos, videos, or audio
- No social media identifiers
2. How We Use Your Information
We use the limited information we collect for the following purposes only:
- Account authentication: your parent email is used to send magic-link sign-in emails and to facilitate Google OAuth sign-in.
- Game progress: saving and syncing game progress across sessions so kids can pick up where they left off.
- Profile management: nicknames and emoji avatars let families with multiple children keep their progress separate.
- Service communication: if we ever need to notify you about important changes to the Service (for example, a security issue), we will use your parent email. We do not send marketing emails.
We do not use your information for advertising, profiling, behavioral targeting, or any purpose beyond operating the Service.
3. Legal Bases for Processing
We process personal information on the following legal bases:
- Consent: you provide your email address voluntarily when you create an account. You may withdraw consent at any time by requesting account deletion.
- Legitimate interest: we process game progress data to provide the core functionality of the Service (saving and syncing progress).
- Legal obligation: we may retain limited data if required by law.
4. Third-Party Service Providers
We use a small number of third-party services to operate Numbercade. These providers process data only as necessary to deliver the Service and are contractually prohibited from using it for their own purposes.
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase | Authentication and database | Parent email, kid nicknames, emoji avatars, game progress |
| Resend | Transactional email (magic-link delivery) | Parent email (for sending sign-in links only) |
| OAuth sign-in (optional) | Parent email (if parent chooses Google sign-in) | |
| Netlify | Website hosting | Standard server logs (IP addresses in hosting logs, not linked to user accounts) |
We do not use any advertising networks, analytics platforms, social media plugins, or tracking services. There are no other third parties with access to your data.
5. Cookies and Tracking Technologies
We do not use cookies.
We do not use tracking pixels, web beacons, or any similar technologies. We do not use any analytics services (no Google Analytics, no Mixpanel, no Hotjar, nothing).
The only client-side storage we use is your browser's localStorage, which stores game progress data locally on your device. This data never leaves your browser unless you create an account and choose to sync it. localStorage is not a cookie and cannot be used for cross-site tracking.
6. Children's Privacy and COPPA Compliance
Our commitment to children's privacy
Numbercade is designed for children under 13 as primary users. We comply fully with the Children's Online Privacy Protection Act (COPPA) and take the following measures to protect children:
- Children cannot create accounts. Only a parent or guardian can create an account by providing their own email address.
- Children never provide personal information. Kid profiles consist only of a nickname (max 20 characters) and an emoji avatar, both chosen by the parent. We do not collect real names, birthdates, or any other identifying information from children.
- Verifiable parental consent. Account creation requires a parent to sign in with their own email address via magic link or Google OAuth. Children cannot independently sign up.
- No behavioral tracking of children. We do not track, profile, or monitor children's behavior. Game progress data (scores and completion status) is functional, not behavioral.
- No targeted advertising. We display no ads of any kind.
- No data sales. We never sell, rent, or share any user data, including children's data, with third parties for commercial purposes.
- Parental control. Parents can review, modify, or delete all data associated with their child's profile at any time.
Parental rights under COPPA
As a parent or guardian, you have the right to:
- Review all personal information we have collected from or about your child
- Request that we delete your child's information
- Refuse to allow further collection of your child's information
- Modify your child's profile nickname and avatar at any time through the app
To exercise any of these rights, contact us at info@numbercade.com. We will respond within 30 days.
7. Data Retention
We retain your data only as long as your account is active:
- Account data (parent email, kid profiles, game progress): retained until you request deletion or delete your account.
- Transactional email logs (via Resend): magic-link emails are transient and not stored long-term by us.
- Hosting logs (via Netlify): standard server access logs are retained per Netlify's policies and are not linked to user accounts.
When you request account deletion, we delete all associated data (parent email, kid profiles, and game progress) from our database within 30 days. Backups containing deleted data are purged within 90 days.
8. Data Security
We implement reasonable and appropriate security measures to protect your information:
- All data in transit is encrypted via HTTPS/TLS
- Authentication is handled through Supabase's secure infrastructure (magic links and OAuth), so we never store passwords
- Database access is restricted through row-level security policies
- We do not store sensitive financial or health information
No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
9. Your Privacy Rights
All users
Regardless of where you live, you can:
- Request access to the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your account and all associated data
- Withdraw consent for data processing at any time
Virginia residents (VCDPA)
Under the Virginia Consumer Data Protection Act, Virginia residents have additional rights including:
- The right to confirm whether we are processing your personal data
- The right to access your personal data
- The right to correct inaccuracies in your personal data
- The right to delete your personal data
- The right to obtain a copy of your personal data in a portable format
- The right to opt out of the processing of your data for targeted advertising, the sale of personal data, or profiling. (We do none of these things.)
To exercise your rights, contact us at info@numbercade.com. We will respond within 45 days as required by law. If we deny your request, you may appeal by contacting us at the same address.
California residents (CCPA/CPRA)
Under the California Consumer Privacy Act and California Privacy Rights Act, California residents have the right to:
- Know what personal information we collect and how it is used
- Request deletion of personal information
- Opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of.
- Non-discrimination for exercising your privacy rights
In the preceding 12 months, we have collected the categories of information described in Section 1 of this policy. We have not sold any personal information. We have not shared personal information for cross-context behavioral advertising.
10. Do Not Track Signals
Our Service does not track users across third-party websites, and we do not use any tracking technologies. Because we do not track you in the first place, Do Not Track browser signals do not change the behavior of our Service.
11. International Data Transfers
Our Service is hosted in the United States. If you are accessing the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer. We process minimal data as described in this policy.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the "Last updated" date at the top of this page. For significant changes that affect how we handle children's data, we will seek renewed parental consent where required by law.
We encourage you to review this Privacy Policy periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.
13. Contact Us
If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or need to reach us about your child's data, please contact us:
- Dara Lee Luca, doing business as Numbercade
- 6530 Heather Brook Ct
- McLean, VA 22101
- United States
- Phone: (+1) 646-831-5196
- Email: info@numbercade.com
- Website: numbercade.com
14. Governing Law
This Privacy Policy is governed by and construed in accordance with the laws of the Commonwealth of Virginia, United States, without regard to its conflict of law provisions.