Privacy policy

Bobble Bay is a learning app for children aged 4 to 8. PerfectCorners, based in Ontario, Canada, runs Bobble Bay and is responsible for the personal information described here. This policy explains what we collect, why, who helps us, and how you control it. Questions go to our privacy officer at privacy@bobblebay.com.

The short version

• A grown-up makes the family account. Children never make accounts and never give us an email.
• We keep what Bobble Bay needs to work: the grown-up’s sign-in, each child’s name and age group, and what the child does in the activities, so we can plan trips and show progress.
• There are no ads and no advertising or tracking tools, and we do not sell or rent personal information. To improve the activities, we count how they are used only as totals across all families.
• Learning research is optional. Only if a grown-up says yes for a child, we keep a copy of the child’s answers with a random number, and with no name and no dates. You can say no at any time, and then we delete the copy.
• You can download your family’s data or delete the account at any time.

What we collect

About the grown-up

• Email address, and a password if you add one. We store the password only in a scrambled (hashed) form.
• If you sign in with Apple or Google, the account identifier they give us. For Sign in with Apple we also keep a token so we can tell Apple when you delete your account.
• Sign-in sessions, so that each device stays signed in. We do not keep the device’s IP address or browser details with them.
• To limit repeated requests and sign-in attempts, the device’s network address, for about one minute after each request. When you sign in with a password, we also keep a code made from the email address for about one minute. The code is not the address.
• To limit sign-in emails and new accounts, we keep each code below for up to two days. We make a code from the email address when we send it a sign-in email. We make a code from the network address when an account is made there, or when a sign-in email is asked for there and we could not check the browser or app. We make a code from the account when it uses its one extra sign-in email of the day. A code is not the address or the account.
• For each request for a sign-in email, also when we send no email: the address, the code and link in a scrambled form, the number of wrong tries, whether we could check the browser or app that asked for it (with the app’s key from Apple, below), and, for a new account, the place where we will keep the family’s records. So the code works only where it was asked for, and we can answer every address the same way. We delete it when its code or link is used or the account is deleted, and otherwise within 3 days.
• To check that a sign-in email or a new account comes from our app on a real device: when the iPhone or iPad app first asks for one, the key that Apple’s App Attest made for this copy of the app, with a count of its uses, the app’s build number, the number of accounts that the key made, and when the app last used it. We keep no device name or Apple ID with it.
• Your agreement to these terms, with the date and version.
• For each child, your learning research choice (yes or no), with the date and the version of the research text you saw.
• Membership details: your plan, trial and renewal dates, and the payment provider’s customer and subscription references. We never see or store your full card number.

About each child

• A name or nickname the grown-up chooses, the age group (4 to 5 or 6 to 8), the language and a picture chosen from the app’s portraits.
• Settings the grown-up chooses, such as sound, motion, captions, trip length and learning goals.
• Learning records: which activities the child played, and for each topic the stars, stage and review date, with a summary of recent answers: whether they were right, whether they needed help, and the mistakes that show what to practise next. Apart from learning research (below), we do not keep a list of every answer.
• A short receipt of each of the child’s last 50 answers, so that an answer the app sends twice counts once. If the app loses an answer before it can send it, for example because the saved copy was damaged, it tells us the answer’s number in that play session, so the child’s later answers still count.
• The child’s latest 8 planned trips, and favourite activities.
• Story plays: when the child starts a story from its beginning or reaches its end, which story and version it was, and whether the child finished that story before on the same device. We keep this only in that day’s counts (below). We also keep a short receipt of each of the child’s last 50 story plays, a random number and the day, so that a play the app sends twice counts once.

We do not collect a child’s email, photo, voice recording, location or contacts. The app does not use the microphone or camera.

Learning research, only if you say yes

• For each child whose grown-up says yes, a copy of each answer: the skill, the activity and its version, the question that it answers, whether the answer was right and at which try, the hints and help, the mistake codes, the type of activity and picture, the child’s stage in the skill, a time range for the answer (such as 5 to 15 seconds), the age group, and the number of days since the child’s profile was made. We keep at most 400 answers for a child in a day.
• The copy has a random research number in place of the child. It has no name, no identifier of the family, a device or the account, and no calendar dates or times. Only your family’s own records link the child to the research number. When you say no and then yes again, the child gets a new research number.

About the app on each device

• For each device that the family adds: its operating system and model name, a key that the device made, whether the app on it was confirmed genuine, and when it last got permission to open activities. For the device that took the family’s free first trip, a scrambled form of that key, so each device gets one free first trip.
• Counts of records saved on a device that the app found damaged, such as a record that was cut short. Each count gives only the kind of record, the kind of damage, the app’s build number, the device’s operating system (iOS or Android) and the day we receive it. The counts do not name the family or a child, and they contain nothing from the records.

Counts across all families

• Each day, the family’s records give counts of that day with no name and no identifier of the family, a child, a device or the account. For example: how many answers in each activity were right at the first try, which mistakes showed, how long play sessions were, how far children are in each skill, how many plays of each story started, finished and started again, how many requests the app made and what they cost, a membership that started or ended, a request to download or delete data that was made, done or failed, and an agreement to a policy. Once a month they also count the children, how many have a yes to the learning research, the activities that children keep as favourites, and the size of the family’s stored data (in ranges such as 128 to 256 KB). A new family’s counts also show the first time it agrees to a policy, adds a child, plays an activity, comes back in a later week, and starts a membership. The only other details are a child’s age group, the weeks since the child’s profile was made (in ranges such as 4 to 7 weeks), the week the account was made, whether it has a paid membership, whether a membership was bought on the website or in the app, the version of a policy, and the time a data request took (in ranges such as 1 to 7 days).
• Two days after the day ends, we add these counts to the counts of all other families, then delete the family’s counts. If that fails, we try again each day, and we delete the family’s counts after 7 days at most.
• For each download of activity content, a count with the result, its size, the device’s operating system and the app’s build number. For each request that we refuse, a count with the reason and the part of the service that was asked for. These counts do not name the family or the device.

How we use it

• To run the account and keep it secure.
• To plan each child’s trips, bring skills back for review, and show grown-ups what each child has learned.
• To keep a child’s progress the same on every device the family uses.
• To manage the membership and payments.
• To send the emails the service needs, such as sign-in codes and links. We do not send marketing email.
• To answer you when you contact us.
• To find and repair faults in the app, from the counts of damaged records.
• To see how families use the service and how children learn with each activity, so we can improve the activities and keep the service working, from the totals across all families. From the same totals, we check that we end each request to download or delete data within 30 days, see how many families agree to each policy version, and keep the cost and the stored data of the service within their limits. In our staff’s reports, a total shows only when it has 10 or more families (or 10 or more downloads or requests); a smaller total is hidden. To check these reports and answer new questions, a few of our staff can also read each day’s totals directly. These can include a total of fewer than 10 families, but they never name a family, a child, a device or the account.
• To learn how children learn over time, from the learning research copies: how many days and answers a skill takes, whether a skill stays after a break, which mistakes last and what came before they stopped, whether help leads to right answers later without help, and how hard each item is. Once a month we make totals from all the copies. Our staff see a total only when each group in it has 10 or more children. Our research staff can also read the copies, which have no name, for this purpose.

We do not use children’s information for advertising, and we do not build marketing profiles.

Children’s privacy

Bobble Bay is made for children, so a grown-up controls everything. The grown-up makes the account, adds each child, agrees to how we use the child’s information, and can change settings, download the data or remove a child at any time. Purchases and settings in the app open only after a grown-up check. If you think a child gave us information without a grown-up, write to privacy@bobblebay.com and we will delete it.

Who helps us

These companies process information for us, only to provide Bobble Bay:

• Cloudflare: hosting, database and file storage for the website, the app’s server and its content, and delivery of our emails (sign-in emails, and the notice before we delete an unused account). Cloudflare Turnstile checks that a sign-in email or a new account on the website comes from a person’s browser.
• Stripe: payments made on the website, and the membership page where you change your card or cancel.
• Apple: Sign in with Apple, purchases made in the App Store, and App Attest, which checks that a sign-in email or a new account in the iPhone or iPad app comes from our app.
• Google: Google sign-in, if you choose it, and Play Integrity, which checks that a sign-in email or a new account in the Android app comes from our app.

These providers may store and process information in the United States and other countries, so it may be subject to the laws of those countries. We may also share information if the law requires it.

Where we keep your family’s records

When you make the account, we choose where to keep the family’s records from the country that your connection comes from. This place does not change later. The family’s records are the children’s profiles, settings, progress, trips and answers, a day’s counts until we add them to the totals, download files, and research information.

• An account made in the United Kingdom, the European Union, Iceland, Liechtenstein or Norway, or in a country that we cannot tell: Cloudflare keeps the family’s records in the European Union.
• An account made in another country: Cloudflare keeps the family’s records with no fixed country. They can be in the United States or in other countries.

We keep some information in one place for all families, which can be outside the European Union: your email address and sign-in details, the links to your payments, the scrambled key of the device that took the family’s free first trip, and counts and totals that name no family or child.

If you move to another country, the family’s records stay where they are. To move them, download the family’s data, delete the account, and make a new account in the new country.

How long we keep it

We keep the account and each child’s profile, settings, progress and favourites while the account exists. We keep these records for a shorter time:

• A child’s planned trips, answer receipts and story play receipts, and the records of which answers the app sent: 12 months at most. We also keep only the latest 8 trips, 50 answer receipts and 50 story play receipts for each child, and the latest 50 answer records for the family.
• Devices that you removed: 12 months at most, and only the latest 20.
• Finished download and deletion requests: only the latest 10.
• Prepared download files: 7 days. You can prepare one file each day.
• Membership records from Apple: only the latest 10 subscriptions.
• Sign-in sessions: only the latest 12 for the account. A new sign-in after that signs out the oldest session. A changed password signs out every other session.
• Expired sign-in sessions and codes for another device: 1 day at most.
• App keys from Apple’s App Attest: 13 months after the app last used the key.
• Totals across all families: 25 months. A family’s own counts of a day: 7 days at most, until we add them to the totals. Counts of downloads and refused requests: 3 months.
• Learning research copies: each month’s copy for 25 months at most. The answers of the current month wait in your family’s records and in a staging copy for 45 days at most, until we add them to that month’s copy. Totals from the research copies: 25 months.

Our file storage can take up to one more day to delete a file after its period ends. This applies to download files, a family’s day counts, learning research copies and the totals.

If no one uses the account while signed in for 24 months, and it has no paid membership, we send an email to the account 30 days before we delete it. Then we delete the account and all its data. If someone signs in before that date, we keep the account.

When you delete a child or the account, we delete their profiles, learning records, learning research copies and prepared download files, and the account itself. When you say no to learning research for a child, we delete that child’s research copies; if our file storage does not answer, we try again each day. Deleted information can remain in our database provider’s recovery history for up to 30 days before it is gone. Stripe and Apple keep payment records for as long as the law requires. We keep the counts of damaged records for 90 days, then delete them. These counts, the counts across all families and their totals do not name your family, so they are not in your family’s download, and deleting the account does not remove them earlier. Your family’s download contains each child’s learning research copies while we keep them.

Your choices and rights

• See and download your family’s data from the Account page on the website.
• Change a child’s age group or settings in the app’s grown-ups area. To correct anything else, write to us.
• Remove a child, or delete the whole account, on the website.
• Say yes or no to learning research for each child, on the child’s page on the website or in the app’s grown-ups area. Bobble Bay works the same if you say no.
• Withdraw your agreement by deleting the account; Bobble Bay cannot work without the information above.
• Ask us any question, or ask for access or correction, at privacy@bobblebay.com. We answer within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada, or to the authority where you live.

Security

We use encrypted connections, store passwords only in hashed form, and allow each family to read only its own records. No system is perfectly secure; if a breach puts your information at risk, we will tell you and the regulator as the law requires.

Changes

When we change this policy, we update the date above. If a change affects how we use your family’s information, we ask for your agreement again in the app or on the website.

See also the terms of use and membership.