Privacy notice

Your child is not our data. Here is exactly what that means.

Version 1.0 · applies from 3 September 2026. Wundoria is run by Andrew Perry, trading as Wundoria, Flat 2, Linden House, 109 Packhorse Road, Gerrards Cross, Buckinghamshire, SL9 8JD, United Kingdom, who is the data controller. Contact for anything in this notice: hello@wundoria.org.

The whole thing in five lines

We collect nothing that identifies a child — no surname, no date of birth, no email, no address, no location, no photo, no tracking identifier. Ever.
Everything a child makes — photos, drawings, voice notes, videos, journal entries — stays on the device. It is never uploaded, never analysed, never seen by us.
The only personal data on our servers is a grown-up’s email address, if they join the waitlist or sign in, plus the purchase records the law makes us keep.
This website uses no advertising or analytics cookies and no tracking scripts.
We never sell, share for advertising, or profile anyone.

Why we work this way

Most apps for children collect first and justify later. We started from the opposite end: the best way to protect a child’s data is not to have it. Children never create an account, never sign in and never type anything that reaches us. The app is built so that a child can use everything it offers while our servers know only two things about them: an age band chosen by a grown-up (for example “6–8”), so activities are pitched right, and a nickname or buddy name. We follow UK GDPR, the Data Protection Act 2018 and the ICO’s Age Appropriate Design Code (the Children’s Code), and where those set a floor we try to build well above it.

What lives on the device only

The child’s first name, age band and buddy; their journal — notes, photos, drawings, voice recordings and short videos; and which activities they have done. This is stored in the app on the device it was made on. It leaves that device only if the device’s owner backs it up themselves, or if a grown-up turns on the Family Vault (below). Because we never receive it, the quickest way to delete it is on the device.

What we hold on our servers

Grown-ups: your email address, if you join the waitlist or sign in with a one-time code; when you signed in; and, if you buy something, the purchase record — what was bought, when, how much, the country on your card’s billing address, whether you accepted the cancellation waiver, and a receipt number. Card numbers never reach us; they go to Stripe.

Households and children: a household identifier, which worlds are unlocked, and for each child an age band and nickname. Nothing else.

Teachers and classes: a teacher’s email address, the classes they create, and for each pupil an anonymous pupil number, age band, whether a mission was completed and an enjoyment rating. The list matching pupil numbers to real children is kept by the teacher, off our systems; we cannot re-identify a pupil.

Sponsors of the pixel meadow: the email address, name, link, logo and colour you give us, and the payment record.

A security audit log of significant actions (a purchase, a refund, a setting change) so that we can investigate problems. Entries are tied to an account, not to a child, and are unlinked from any person when an account is deleted.

The Family Vault (optional, off by default)

A grown-up can choose to keep an encrypted copy of the household’s keepsakes so they can be restored or moved between that grown-up’s devices. The copy is encrypted on the device with a passphrase or passkey the grown-up chooses; the key never leaves the device and we cannot open the vault. Turning it on is a deliberate choice behind the parent gate, is recorded, and can be reversed at any time. The Vault is in beta and off for everyone who has not chosen it.

Cookies and this website

wundoria.org sets no advertising or analytics cookies and loads no tracking scripts. The app keeps your sign-in session in your browser’s local storage so you stay signed in. The sponsor form may use Cloudflare’s “I am human” check, which sets a short-lived cookie for that purpose only. The payment page is provided by Stripe, whose own cookie policy applies while you are on it.

Who helps us run Wundoria

A small, named set of providers act only on our instructions: Supabase (accounts, sign-in, database and vault storage, hosted in London), Stripe (payments), Postmark (sending sign-in codes, receipts and waitlist emails), Bunny CDN (delivering story pictures and audio), and Cloudflare (hosting, security and, if enabled, the “I am human” check). Where a provider processes data outside the UK, we rely on the UK’s adequacy regulations or the UK International Data Transfer Agreement. We do not sell personal data and we do not share it for advertising.

Why we are allowed to use this data

Waitlist emails: your consent, withdrawable at any time (reply, or use the unsubscribe link). Sign-in, accounts and purchases: to provide the service you asked for, and our legitimate interest in keeping accounts secure and preventing fraud. Purchase records: our legal obligation to keep financial records. Because children take part anonymously, we do not rely on a child’s consent and do not need to verify a parent’s identity for a child to play.

How long we keep things

Your account and waitlist entry: while they are active, then deleted on request. Purchase, refund and dispute records: six years, as UK tax law requires — but with no name or email attached once you have asked to be erased. On-device data: until you delete it or remove the app.

Your rights

You can ask to see, correct, export or delete the personal data we hold, or object to how we use it, by emailing hello@wundoria.org. We respond within one month. An export comes as a single file containing everything we hold about your household. If you ask to be erased, we delete your accounts and every email address in our records, keep only the anonymised financial records the law requires, and never touch your family’s photos, drawings, recordings or videos — those are yours to keep or delete; we give you time to do that first. If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk.

Changes

If we change anything important we will update this page and, where it affects grown-ups who have signed in, tell them by email. The version and date at the top say which notice applies.

That’s all of it. There is nothing hidden in here, because there is nothing to hide.