Privacy Policy
Last updated: 11 August 2026
1. Who we are
"Universe of Knowledge" (the "Game", "we", "the service") is an educational quiz for children aged approximately 9–12. The operator (data controller) is:
- Name: Khatuna Volodchenko
- Country and registered address: Portugal — Rua da Praia Formosa, Edf. Atlantic Gardens, apt. 314, 9000-659 Funchal
- Privacy contact: privacy@universe-of-knowledge.com
2. Our main principle — minimum data
The Game is built on the privacy by design principle. This means:
- The account and payment are handled by an adult (a parent or guardian), not the child.
- A child's profile is pseudonymous: only a game nickname, an avatar and game progress. We do not ask for a child's real name, email, age or any other personal data.
- A profile's real name (if the child entered one) is stored only locally in the browser and is never sent to our servers.
3. What data we process
3.1. Playing without an account (guest mode)
If you play without registering, all data is stored only on the device (in the browser's localStorage) and is not sent to us: progress, the chosen profile nickname, avatar, language and sound settings. We have no access to it.
3.2. Leaderboard (optional)
If a player takes part in the leaderboard, only the following is sent to our server: the game nickname (e.g. "Nova 4213"), the points (XP) and the emoji avatar. No real name is transmitted. This data is pseudonymous and does not let third parties identify a specific child.
3.3. Online modes (Duel, Defend the Planet)
During real-time play with a friend, the nickname, avatar and in-game actions (answers, score) are exchanged between the participants of the room. This data is temporary and is not stored after the game ends.
3.4. Parent account and subscription (when activated)
When we launch the paid subscription, parents will provide an email address to set up the account (for login, receipts and subscription management). Payment card data is processed solely by our payment provider Paddle — we never see or store the card. We only store the subscription status and the payment-system customer identifier.
3.5. Technical data
Our infrastructure providers (Vercel — hosting, Supabase — database and leaderboard server) may automatically keep short-lived technical request logs — including IP address, browser type (User-Agent) and request time — solely for security and reliable operation. We do not store IP addresses or User-Agent in our own data, and we do not link them to a child's profile. We do not use advertising, tracking analytics or third-party trackers.
4. Why we process this and on what basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Running the game and saving progress | Local data on the device | No processing by us (data never leaves the device) |
| Leaderboard and online games | Nickname, XP, avatar | Legitimate interest (Art. 6(1)(f)) — providing the game feature in a pseudonymous form |
| Account and subscription | Parent email, subscription status | Performance of a contract (Art. 6(1)(b)) |
| Receipts and accounting | Payment data | Legal obligation (Art. 6(1)(c)) |
| Site security | Technical logs | Legitimate interest (Art. 6(1)(f)) |
5. Who we share data with
We do not sell data. We use trusted service providers (processors) that act on our instructions:
- Vercel — website hosting.
- Supabase — server for the leaderboard and real-time online modes.
- Resend — sending service emails (e.g. account confirmation). Processes the email address only.
- Paddle — payment and subscription processing (Merchant of Record; processes the buyer's email and payment data).
6. International data transfers
Some providers may process data outside the EU/EEA (e.g. in the USA). In such cases, transfers are made on the basis of Standard Contractual Clauses (SCCs) or adequacy decisions under the GDPR.
7. How long we keep data
- Local data — until you delete the profile or clear your browser.
- Leaderboard records — while the profile is active; can be deleted on request.
- Account data — for the duration of the subscription; payment data — for as long as tax law requires.
8. Rights of the child and parents
The Game is intended for children, so the account holder is a parent or guardian. The age of digital consent in the EU varies by country (for example, 13 in Portugal, 16 in Poland), so in any case the account is created and controlled by an adult. Because we do not collect children's personal data (only pseudonymous data), parents have full control of profiles: they can change the nickname or delete a profile together with all local data at any time directly in the Game.
Under the GDPR you have the right to: access, rectification, erasure, restriction and objection to processing, data portability, and the right to withdraw consent. To exercise these, write to privacy@universe-of-knowledge.com.
9. Cookies and browser storage
We use only necessary technical storage (localStorage) to run the game — it does not track you and does not require separate consent. More details on the Cookies page.
10. Security
The site works over a secure connection (HTTPS). We apply data minimisation and pseudonymisation as the primary measure to protect children.
In the unlikely event of a personal data breach that poses a risk to your rights, we will notify the supervisory authority (CNPD) within 72 hours, and you as well if necessary.
11. Changes to this policy
We may update this policy. The current version is always available on this page with the date of the latest revision.
12. Complaints
If you believe we are infringing your rights, you may contact a data protection supervisory authority — in Portugal this is CNPD (cnpd.pt), or the authority in your country.
← Home