Privacy Policy

Kingdom of Ferrán ("we," "us," or "our") is an educational chess adventure platform designed primarily for children. We are committed to protecting the privacy of every child and family who uses our service. This Privacy Policy explains what information we collect, how we use it, and the rights you have as a user or parent.

This policy applies to the Kingdom of Ferrán web application available at kingdom-of-ferran.vercel.app and any related services we may offer.

Gameplay & Progress Data

When you play Kingdom of Ferrán, we automatically track the following to power your experience:

• XP points earned and level progression
• Chess game history (moves, outcomes, difficulty level selected)
• Quiz results (correct/incorrect answers, categories attempted)
• Worlds visited and creatures encountered
• Achievements and milestones unlocked
• Session timestamps (to calculate streaks and activity patterns)
• Preferred world and AI companion interactions

Voice Recordings (Local Only)

If voice missions are enabled (Family Crown plan), voice recordings are processed entirely on your device using the Web Speech API. We never upload or store voice recordings on our servers. Audio is immediately discarded after speech-to-text processing.

Photos (Local Only)

Photo challenges allow a child to photograph a real-world chess position or object. Photos are processed locally (on-device) for pattern recognition. We do not upload, store, or transmit photos.

Device & Technical Information

• Browser type and version (for compatibility)
• Device type (desktop, tablet, mobile) — not device identifiers
• Approximate timezone (for session tracking)
• Service Worker registration status (for offline play)

Account Information (Paid Plan Only)

If a parent creates a Family Crown or School Realm account, we collect the parent's email address and a hashed password. We do not collect the child's real name or any account information from the child directly.

We are explicit about what we never collect, especially from children:

• The child's real first name, last name, or nickname (beyond the in-app kingdom name they choose)
• Email address of the child
• Home address, phone number, or physical location
• Geolocation coordinates
• Biometric identifiers of any kind
• Social Security Number or government ID
• Persistent device identifiers or advertising IDs
• Financial information from children
• Communications or messages from children

We do not build advertising profiles. We do not sell, rent, or trade any user data with third parties for marketing purposes.

Free Plan — localStorage

On the free tier, all gameplay data (XP, chess history, worlds visited, quiz results, achievements) is stored exclusively in your browser's localStorage. This means:

• Data never leaves your device
• No account is required
• Clearing browser data or using a different browser will erase progress
• We have no access to this data whatsoever

Paid Plan — Cloud Storage (Supabase)

When a parent creates an account on the Family Crown or School Realm plan, gameplay progress is synced to our cloud database powered by Supabase (hosted on AWS us-east-1). Data is encrypted at rest (AES-256) and in transit (TLS 1.3). Our Supabase project is configured with Row Level Security (RLS) so that each family's data is isolated and inaccessible to other users.

Data Retention

• localStorage data: persists until you clear it — entirely under your control
• Cloud data: retained while your account is active, then deleted within 30 days of account closure
• Anonymized, aggregated gameplay statistics may be retained indefinitely for product improvement

Kingdom of Ferrán is designed for children and we take the Children's Online Privacy Protection Act (COPPA) seriously. The following rules apply:

Under 13 — Parental Consent Required

• Children under 13 may use the free tier without an account — no personal information is collected
• To create a cloud-synced account for a child under 13, a verifiable parent or guardian must create the account
• We do not knowingly collect personal information directly from children under 13
• If we discover we have inadvertently collected such information, we will delete it promptly

Ages 13–17

Teenagers between 13 and 17 may create their own accounts. We still recommend parental awareness and encourage families to review this policy together.

How Parental Consent Works

• Parent creates the account using their own email address
• Parent verifies their email via a confirmation link
• Child profiles are created under the parent's account
• Parents can view, modify, and delete all child data at any time

Reporting Concerns

If you believe a child has submitted personal information without parental consent, please contact us immediately at privacy@kingdomofferran.com. We will investigate and delete the information promptly.

As a parent or legal guardian, you have the following rights regarding your child's data:

Right to Access

You may request a complete export of all data associated with your child's profile at any time by emailing privacy@kingdomofferran.com. We will respond within 30 days with a full data export in JSON or CSV format.

Right to Delete

You may request deletion of your child's data at any time. Account deletion removes all personal data and gameplay history from our servers within 30 days. This action is irreversible.

Right to Correct

If any data associated with your child's profile is inaccurate, you may correct it directly from the parent dashboard, or by contacting us.

Right to Withdraw Consent

You may revoke consent for your child's data collection at any time by closing their account. The child may continue using the free tier with localStorage only.

Kingdom of Ferrán does not currently use advertising cookies, tracking pixels, or third-party analytics SDKs. Specifically:

• No Google Analytics, Facebook Pixel, or similar trackers
• No advertising cookies
• No cross-site tracking
• Session data is stored in localStorage, not cookies

In the future, if we add opt-in analytics (to help us understand how children learn and where they get stuck), we will:

• Ask for explicit parental consent before enabling any tracking
• Use privacy-first analytics tools (e.g., Plausible or Fathom — no personal data collected)
• Provide a clear opt-out mechanism in the parent dashboard
• Update this policy to reflect the change

We use a minimal set of trusted third-party services:

• Supabase (paid plan only) — database and authentication. See supabase.com/privacy
• Vercel — hosting and CDN. See vercel.com/legal/privacy-policy
• Anthropic Claude API (optional AI features) — no personal data from children is sent to the API
• Google Fonts — font loading (Inter, Cinzel). Google may log font requests per their privacy policy

We do not share personal data with any other third parties. We do not sell data. We do not use data brokers.

We take reasonable and industry-standard measures to protect your data:

• All connections use HTTPS / TLS 1.3
• Passwords are hashed using bcrypt (never stored in plaintext)
• Cloud database uses Row Level Security to isolate user data
• Data at rest is encrypted with AES-256
• We conduct periodic security reviews
• We do not log or store payment information (Stripe handles this directly)

No system is 100% secure. If you believe there has been a security incident affecting your data, contact us immediately at privacy@kingdomofferran.com.

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this page
• Notify registered parents via email for material changes
• Post a notice on the Kingdom of Ferrán home page for 30 days after significant changes

Continued use of Kingdom of Ferrán after a policy update constitutes acceptance of the revised terms.

Questions, concerns, or data requests? Reach our privacy team: