1. Who processes your data
The data controller is Martin Novák, who runs the non-commercial project Učiland (uciland.cz). Contact: martin.novak02@gmail.com. We are not required to appoint a data protection officer.
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Family account: parent's e-mail (for older accounts an account nickname), e-mail confirmation, password (only an encrypted hash), recovery code (only a hash), date of creation and the parent's declaration | logging in and managing the account | performance of a contract, i.e. the terms (Art. 6(1)(b) GDPR) |
| Sign-in with Google (only if you choose it): Google account identifier and verified e-mail | signing in without a password | performance of a contract |
| Players (children): name or nickname, icon, school grade, character and clothes, round results (game, level, score, stars, time), points, bricks, day streaks, completed missions and challenges | playing, saving progress, the journey for the child's grade, leaderboard | performance of the contract with the parent. The child's data are entered and managed by the parent |
| 3D journey: block buildings and decorations, plots and islands on the water and their names (only from offered words, no free text), opened chests and character skills, activity per day (active minutes, number of actions and games started). Where the character is standing and which greeting it sent is kept only in the server's memory and disappears after 10 seconds. Other children in the journey see the player name, the character, where it is right now, its greetings (only 4 preset ones, no typing), its buildings and the names of its places. Islands, plots and friends in real time are visible only to children from the same neighbourhood (a group of at most 8 children of the same grade); children who played an online game together are preferably placed in the same neighbourhood and see each other's buildings first (from the round history, nothing else is stored) | playing in a shared world, meeting friends, saving buildings; activity per day: finding out whether children enjoy the journey | performance of the contract with the parent; activity per day: legitimate interest (Art. 6(1)(f) GDPR) |
| Usage measurement: which pages and games were opened, active time, taps on options, completed rounds, app errors, device type. Nothing is stored on your device for measurement: for signed-in users it is linked to the account on the server, for others only a temporary number is used, which disappears when the page is closed | improving the games: what children enjoy, where they make mistakes, what is too hard | legitimate interest in improving the service (Art. 6(1)(f) GDPR). You can switch measurement off at any time |
| Playing without an account (guest): rounds played, the guest's grade and character. They are stored only in the guest's browser. The server receives them only to calculate points and bricks and stores nothing. They are saved on the server only when a parent creates an account (or signs in) and the progress is added to a player | trying the games without signing up and not losing progress | performance of a contract (a feature the user asked for); after sign-up the same as for players |
| Game search: the text you type or say into search (e.g. “times tables for Grade 3”), the grade, and whether you sent a game wish. Not linked to a player or account | finding a suitable game, learning which games are missing | legitimate interest (improving the choice of games) |
| Games with friends and challenges: player name and score in the room, who challenged whom | playing on several phones | performance of a contract |
| Notifications (only if a parent turns them on): the delivery address for notifications to the device, created by the browser, and which kinds of notifications you want. The content of notifications is encrypted for your device | a challenge from a friend, a streak reminder, a new game | consent (by enabling them in the browser). You can turn them off in My account or in the browser settings and the address is deleted |
| Technical data: IP address (only in the server's memory, not stored in the database), time of requests | protection against abuse, e.g. limiting login attempts | legitimate interest (Art. 6(1)(f) GDPR) |
Please do not use a full name with a surname as the player name. A first name or nickname is enough. Other children will see the player name in the 3D journey. Microphone recordings in the game Rara the Tiger stay only on your device and are not sent to the server.
3. Children
Učiland is for children in Grades 1 to 5. That is why the account is created and managed by a parent or legal guardian, who confirms this when signing up. A child under 15 cannot give consent to data processing alone; the parent gives it on their behalf. In games, on the leaderboard and in games with friends, other families see the child only under an automatically generated anonymous nickname (e.g. “Happy Lion 42”). The exception is the 3D journey, a shared world where children meet: there other children see the player name entered by the parent (so please use only a first name or nickname). If the name contains unusual characters or three digits in a row (such as part of a phone number), a nickname is shown instead. There is no chat or sending of own messages between players; the journey has only 4 preset greetings and place names made from offered words.
4. Who we share data with
- OVHcloud (OVH SAS, France): runs the server Učiland runs on.
- Google: only if you sign in with Google. Google then learns that you signed in to Učiland. Google's privacy policy applies.
- YouTube (Google): the parents' section of the game Rara the Tiger contains embedded videos in privacy-enhanced mode (youtube-nocookie.com). They load only when you open that section.
- Google Cloud Text-to-Speech: voices sentences from the games (questions, praise, explanations). We send it only the text of the sentence, not data about the child; sentences with the player's name are read by your device's own voice. The finished recording is stored on our server and is not sent again.
- Brevo (Sendinblue SAS, France): sends Učiland's e-mails (e-mail confirmation and a link to set a new password). It receives only the e-mail address and the text of the message. We do not send marketing e-mails.
- The browser's push service (Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox): only if you turn on notifications. It delivers an encrypted message to the device and cannot see its content.
- Anthropic (Claude, AI assistant) in game search: for signed-in accounts it receives the search text and the list of Učiland games, so that it can understand a whole sentence (“my boy can't tell the time”). It receives nothing about the child or the account. So please do not type names or other personal data into search.
- Anthropic (Claude, AI assistant): helps with development and suggestions for improvements. It receives only aggregated statistics with pseudonyms (“Player 1”), never names, account nicknames or e-mails.
We do not sell data, do not use it for advertising and do not pass it to anyone else. For Google and Anthropic services, data may be transferred to the USA under the EU-US Data Privacy Framework or standard contractual clauses.
5. Cookies and browser storage
| What | Purpose | How long |
|---|---|---|
| cookie lab_session | signing in to the account (necessary) | 180 days from last use |
| local storage: selected player, game progress, guest progress (rounds, grade and character when playing without an account), settings (sound, filters, notifications, language) | so that the game works and remembers settings (necessary) | until you delete them in the browser |
You can delete guest progress in Učiland with the Delete guest progress button (on the island) or by clearing the site data in your browser. Once it is moved to an account, it is deleted from the browser automatically.
We use only necessary cookies and storage. Nothing is stored on your device for measurement. We do not use third-party advertising or tracking cookies. Fonts are loaded from our own server, not from Google.
6. How long we keep data
- Account, players and their results: until you delete the account.
- An account that nobody has used for 2 years (no sign-in and no playing) is deleted automatically with all its data.
- 3D journey: buildings and places until you delete the player or the account (then the blocks the player built on other children's islands are deleted too); activity per day at most 120 days; the character's position is not stored.
- Usage measurement: at most 400 days. If you switch measurement off, the account's existing measurement data are deleted immediately.
7. Your rights
- Access and portability: in My account → Account → “Download all account data” you get all data in one file.
- Rectification: you can change the player's name, icon and grade in My account.
- Erasure: in My account → Account → Delete account. The account, all players and the whole history are deleted.
- Switching off measurement (objection): in My account → Account → Privacy and data, at any time and without affecting play.
- Objection and restriction of processing: write to us at martin.novak02@gmail.com.
- Complaint: you can lodge one with the Czech Office for Personal Data Protection (uoou.gov.cz), Pplk. Sochora 27, 170 00 Praha 7.
We do not carry out automated decision-making with legal effects or profiling for advertising. Učiland only uses results to choose suitable levels and missions.
8. Security
The website runs only over an encrypted connection (HTTPS). Passwords and recovery codes are stored only as a hash (scrypt), and the sign-in cookie is not accessible to scripts on the page. If a data breach occurred that could put you at risk, we would inform you and the supervisory authority.
9. Changes to this policy
We may change this policy, for example when a new feature is added. The current version is always on this page. We will announce significant changes in Učiland.