Privacy Policy

Short version: The app has no account, no tracking and no advertising. Settings and progress are stored only on the device. The app sends anonymous error reports and usage statistics so we can fix bugs and improve the app. They contain no name, account, IP address, identifier or answers, and we cannot link them to you or your kid. You can turn them off in the parent settings. The website uses Google Analytics and sets analytics cookies only if you accept them in the cookie banner; see Cookies and Google Analytics. Only our optional feedback portal has a sign-in; see The feedback portal.

Controller and contact

See the Contact page and the Legal Notice.

The app

What stays on the device

The app stores the parent’s settings, your kid’s progress and the parent PIN (only as a salted hash) on the device, in storage that only Solve To Play and its extensions can read. Apart from what the error reports and usage statistics below contain, this data stays on the device.

Screen Time and the apps you block

The app uses Apple’s Screen Time frameworks (Family Controls, Managed Settings, Device Activity). When you choose apps, categories or websites to lock, iOS gives Solve To Play only opaque tokens. The app cannot see which apps these are, and it cannot see how your kid uses the device. Screen Time data is processed by iOS under Apple’s Privacy Policy.

Error reports and usage statistics

The app sends anonymous error reports and usage statistics to Sentry, a service for error monitoring, so we can fix errors and see which features are used. They contain what happened in the app (for example an error, a finished round or a purchase), the app’s state and settings, and technical details such as device model and iOS version. They contain no identifier, no answers, no PIN and no names of blocked apps, so we cannot link them to you or your kid. Your IP address is necessarily transmitted, but Sentry is configured not to store it.

Sentry is operated by Functional Software, Inc. (USA). We use its EU data region, so the data is stored in Frankfurt, Germany. Sentry acts as our processor under a data processing agreement that includes the EU Standard Contractual Clauses. The data is deleted after 90 days at the latest. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in finding and fixing errors and improving the app. You can turn this off at any time in the app under Parent settings → Share usage and crash data, or object by email. See the Sentry Privacy Policy.

Notifications

The app shows local notifications that are created on the device. No push service is used.

Purchases

Subscriptions and one-time purchases are processed by Apple through the App Store. We do not receive your name, email address or payment details. Apple gives us only anonymous sales reports. See Apple’s Privacy Policy.

App Store statistics

If you have chosen in iOS settings to share analytics with app developers, Apple may also pass anonymous crash reports and usage statistics to us. You control this in Settings → Privacy & Security → Analytics & Improvements. We use this only to fix errors.

Deleting data

Deleting the app removes all its data from the device. With Screen Time protection active, deleting the app needs the parent’s approval.

Children

Solve To Play is meant to be set up by parents on their kid’s device. The app does not ask for or collect personal data from children or anyone else. The anonymous error reports and usage statistics described above contain nothing that identifies a child. The app contains no advertising. On child accounts, purchases need the parent’s approval through Apple’s Ask to Buy.

The website

Hosting

This website is hosted on Amazon Web Services (AWS): the files are stored in Frankfurt, Germany, and delivered through the CloudFront content delivery network. To deliver a page, AWS necessarily processes your IP address and technical request data (browser, requested page, time). We do not store access logs. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a secure and working website. AWS acts as our processor under a data processing agreement that includes the EU Standard Contractual Clauses. See the AWS Privacy Notice.

Cookies and Google Analytics

The website uses Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to see how many people visit it and which pages they read. Google Analytics records:

Which pages you view, for how long and how far you scroll, which links to other websites you click, and the website you came from
Technical data: browser, operating system, device type, screen size, language
Your approximate location (country, region, city), derived from your IP address

Google Analytics 4 does not log or store IP addresses. Advertising cookies and ad personalization always stay off, so the data is not used for advertising.

On your first visit, a banner asks about cookies. You can accept them, or choose under “Manage” whether to allow analytics cookies. Only with your consent does Google Analytics set the cookies _ga and _ga_5XKLC4F9PK (stored for 2 years) to recognize your browser on later visits. Legal basis: your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Your choice is stored for 365 days in the cookie solvetoplay_cookie_consent, which is needed to remember it (§ 25(2) no. 2 TDDDG). You can change your choice or withdraw your consent at any time with “Cookie Settings” at the bottom of every page. Google Analytics then stops using its cookies; cookies already set stay in your browser until they expire or you delete them.

We look only at aggregated reports. Google processes the data as our processor under the Google Ads Data Processing Terms, which include the EU Standard Contractual Clauses. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework. Google deletes the individual data after 14 months at the latest; only aggregated reports without personal data are kept. See Google’s Privacy Policy and how Google uses data from sites that use its services.

The feedback portal

At feedback.solvetoplay.com you can suggest features, vote on ideas and report problems. The portal is meant for parents. Anyone can read it; to post, comment or vote you sign in with a link we email you, with Sign in with Apple or with Google. The app sends nothing to the portal: the link in the parent settings only opens it in Safari.

When you use the portal, we process:

Your email address, to sign you in and, if you turn them on, to notify you about replies and status changes. It is never shown publicly.
Your name and, with Google, your profile picture. They come from the sign-in provider or you enter them, and they are shown next to your posts.
What you post: ideas, comments, votes and attached images. Ideas and comments are public with your name. Support requests you mark as private are visible only to you and us. Your votes are shown publicly only if you turn that on.
Your IP address, only in hashed form, to limit spam. It is deleted after 48 hours.
Cookies that are needed for sign-in, voting and protection against abuse. The portal sets no analytics, advertising or tracking cookies.

The portal runs on Amazon Web Services in Frankfurt, Germany, like this website; sign-in and notification emails are sent through Amazon SES. If you choose Sign in with Apple or Google, Apple or Google confirm your identity and give us your email address and name, see Apple’s Privacy Policy and Google’s Privacy Policy. To keep bots out, the portal uses Cloudflare Turnstile from Cloudflare, Inc. (USA): it loads a script from Cloudflare that processes your IP address and technical browser data to tell people from bots. Cloudflare is certified under the EU-U.S. Data Privacy Framework. See the Cloudflare Privacy Policy.

Legal basis: Art. 6(1)(b) GDPR for your account and what you post, since you use the portal at your own request, and Art. 6(1)(f) GDPR for spam and bot protection, our legitimate interest in a portal free of abuse.

We keep your account until you delete it. You can do that yourself on the portal under Account: your email address, linked sign-in providers and sessions are removed, and your posts and comments stay visible with “(deleted)” instead of your name. To have your posts removed as well, email us.

Contacting us

If you email us or use the contact form, we use your name, email address and message only to answer you.

The contact form sends your name, email address and message to our feedback portal (see The feedback portal). The portal stores the message as a private support ticket that only you and we can see, and links it to a portal account for your email address. It then emails you a confirmation with a link to your ticket, sent through Amazon SES. The form is processed on Amazon Web Services in Frankfurt, Germany. To limit spam, your IP address is used only in memory and is not stored.

Legal basis: Art. 6(1)(b) GDPR where your request relates to a purchase or contract, otherwise Art. 6(1)(f) GDPR. We delete the correspondence and contact form tickets when they are no longer needed, unless statutory retention periods apply. You can delete the portal account yourself as described in The feedback portal.

Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Email us to use them.

You can also lodge a complaint with a data protection supervisory authority.

Residents of the United States

We do not sell or share personal information, and we do not collect personal information from children under 13 (COPPA).

Changes

We update this policy when the app or website changes. The date below shows the current version.