Privacy Policy v4.0

DATA PRIVACY STATEMENT – NUMOPIA: MATH & MENTAL ARITHMETIC Effective from: October 2026 | Version: 5.0 1. CONTROLLER Numopia is operated by: Name: Mohamad Chaaban Address: Wittbräucker Str. 586a, 44267 Dortmund, Germany E-mail: info@numopia.com Website: https://www.numopia.com 2. WHAT IS NUMOPIA? Numopia is a free educational game for mental arithmetic and mathematics (grades 1–7 and adults). The game is ad-free, free of charge and does not sell data. It is available as a web app (www.numopia.com) and as an Android app on Google Play. Both versions use the same servers and the same data storage. We only collect the data that is necessary to operate the game. We run no advertising, no user tracking and no analytics services. There is no payment function and therefore no payment data. 3. WHAT DATA WE PROCESS PLAYER ACCOUNT (on registration): - Nickname (self-chosen, freely invented – no real name required) - Avatar (image ID from a fixed selection list) - Grade level (1–2, 3–4 or 5–7, or adult) – we do NOT ask for your age, only your grade level - Login credentials: either e-mail + password, or Google sign-in. Passwords are stored by Google Firebase Authentication in hashed form – we can never see them - Country (optional, for the country flag next to your highscore) GAME OPERATION: - Game progress, highscores and game history (points, tasks, time needed) - Current game mode and room while you are playing online - Predefined emoji reactions in multiplayer mode (no free-text chat) FOR CHILD ACCOUNTS (grades 1–7): - E-mail address of a parent or guardian – stored ENCRYPTED (see sections 6 and 8) FOR TEACHER ACCOUNTS (school access): - Teacher's contact e-mail address – also stored ENCRYPTED FEEDBACK FEATURE (only if you use it): - Your feedback message, the type (bug/suggestion), the page URL, browser and operating system; a screenshot only if you attach one yourself TECHNICAL DATA (automatic): - Time of your last page visit and rough device type (mobile/desktop/browser identification) while you have the page open ("presence") - Short server logs on web requests (internet service technology: IP address, time, requested page) – deleted automatically WHAT WE DO NOT DO: - No advertising, no tracking, no analytics tools, no passing data to third parties for marketing purposes - No Google Analytics or Facebook Pixel artifacts – the code simply contains no analytics services - No payment or bank data (the game is free) - No face recognition, no microphone, no camera, no location tracking 4. GUEST MODE (PLAYING WITHOUT AN ACCOUNT) You can use Numopia without registering. Technically, your device receives an anonymous, random identifier from Firebase Authentication – no name, no e-mail, no personal details. Your game progress runs under this anonymous identifier. When you register a proper account, you can keep your guest progress. Guest data is subject to the same protection rules as all other data. 5. OUR SERVICE PROVIDERS (DATA PROCESSORS UNDER ART. 28 GDPR) We do not operate our own servers. These providers process data exclusively on our behalf: GOOGLE FIREBASE (AUTHENTICATION + DATABASE): - Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland - Database region: Frankfurt, Germany (europe-west3) – your game data stays in the EU - Privacy: https://firebase.google.com/support/privacy - A data processing agreement (DPA) exists with Google - Google maintains industry-standard certifications for its cloud infrastructure (including ISO 27001, SOC 2) VERCEL (WEB HOSTING & GLOBAL CDN): - Provider: Vercel Inc., 410 Terry Ave N, Seattle, WA 98109, USA - Hosting with edge nodes worldwide; requests from Germany are preferably served by the EU/Frankfurt node - Privacy: https://vercel.com/legal/privacy-policy - Processes: delivered page content and short access logs GOOGLE SIGN-IN (ONLY IF YOU SIGN IN WITH GOOGLE): - OAuth 2.0 sign-in via Google; Numopia receives only your Google name and your Google e-mail address - https://policies.google.com/privacy STRATO (DOMAIN & E-MAIL DISPATCH): - Provider: STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany - Manages the numopia.com domain and sends our e-mails (e.g. parent confirmations) – servers in Germany - Privacy: https://www.strato.de/datenschutz/ WHATSAPP CHANNEL (ONLY IF YOU FOLLOW IT – NOTICE, NOT A DATA PROCESSOR): - For news we offer a WhatsApp channel (provider: WhatsApp Ireland Ltd. / Meta Platforms Ireland Ltd., Grand Canal Square, Dublin 2, Ireland) - Clicking the channel link takes you to WhatsApp: from that point Meta's privacy policy applies (https://www.whatsapp.com/legal/privacy-policy-eea) – not this statement - We only manage the channel's content. Your phone number is not shown to us as channel operators; we receive no personal data from WhatsApp about our followers - Whether and how you use WhatsApp is entirely your decision – Numopia works fully without WhatsApp Legal bases: Art. 6(1)(b) GDPR (contract performance – providing the game) and Art. 28 GDPR (data processing) for all service providers. 6. CHILD PROTECTION & PARENTAL CONSENT Numopia is explicitly aimed at school children. Therefore: - On registration we only ask for the GRADE LEVEL, never the age and never the date of birth. - If a child chooses grade level 1–2, 3–4 or 5–7, PARENTAL CONSENT is mandatory (Art. 8 GDPR). We require it for all minors regardless of country – including countries where the GDPR would only apply from age 16. - The child provides a parent's or guardian's e-mail address for this purpose. This address is stored AES-256 encrypted (section 8). - Parents receive an e-mail with two links: confirm or reject. If they reject, the account is blocked immediately and removed by the operator. - Only the nickname and avatar are visible to other players (plus the country flag, if chosen). The parents' e-mail address is not visible to anyone – not even to the operator. - There is no free chat between players. The only communication is predefined emoji reactions. - Parents can request deletion of the child's account at any time (section 9) or use the rejection link from the e-mail. Note for parents: a compact "For parents" overview of all child-protection features is available on the website. Questions: info@numopia.com. 7. LEGAL BASES (GDPR) - Art. 6(1)(b) – contract performance: player account, game progress, highscores (the game cannot be operated without this data) - Art. 6(1)(a) – consent: parental consent for child accounts; optional details such as country; feedback messages - Art. 6(1)(f) – legitimate interest: short server logs for security and troubleshooting; presence display of active players - Art. 8 – child protection: consent of the guardians for all minors - Art. 13/14 – information duty: fulfilled by this statement 8. SECURITY MEASURES (ART. 32 GDPR) - ENCRYPTED CONTACT DATA: parent and teacher e-mail addresses are stored in the database encrypted with AES-256-GCM. The key exists exclusively in the protected server environment – not in the code, not in the database, not in the browser. Even if the entire database were stolen, the addresses would be unreadable. The operator cannot view them either; they are decrypted only briefly and automatically for sending the necessary e-mails. - DATABASE ACCESS: user data is protected by strict access rules (server-side checks); your own data is visible only to your own account, third-party access is technically impossible. - TRANSPORT: all connections run over TLS (HTTPS). - PASSWORDS: exclusively hashed at Firebase Authentication. - NO ANALYTICS SERVICES: no Google Analytics, no tracking – so there are no tracking data that would need protecting. - We review these measures internally on a regular basis. An external security audit has not taken place (will be arranged if needed). 9. YOUR RIGHTS (ART. 15–21 GDPR) ACCESS (Art. 15): you can request an overview of your stored data at any time – free of charge, by e-mail to info@numopia.com (subject: "Access"). RECTIFICATION (Art. 16): nickname, avatar and country can be changed directly in the game. Everything else we correct on request. ERASURE (Art. 17): you can delete your account YOURSELF and IMMEDIATELY – in the app via "Delete account" (settings/profile). Deletion removes the account and game progress completely. Alternatively by e-mail. Exceptions: statutory retention (e.g. commercial law obligations in the operator's imprint sphere). RESTRICTION (Art. 18), DATA PORTABILITY (Art. 20, JSON format), OBJECTION (Art. 21, e.g. against the presence display – can be exercised by not using the service or by deletion): each by e-mail, free of charge. Response time: within 30 days (extended to a maximum of 60 days for complex requests, in which case we will inform you). 10. COMPLAINT TO THE SUPERVISORY AUTHORITY (ART. 77 GDPR) Competent supervisory authority (Germany, North Rhine-Westphalia): Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) – North Rhine-Westphalia's data protection authority Address: Kavalleriestraße 8, 40213 Düsseldorf, Germany E-mail: poststelle@ldi.nrw.de Phone: +49 211 38424-0 Online complaint: https://www.ldi.nrw.de/beschwerde All other EU data protection authorities: https://edpb.ec.europa.eu/about-edpb/board/members_en For users outside the EU: we grant the same data protection rights as for EU citizens, regardless of residence. 11. RETENTION PERIODS - Active account: until deletion (possible by you at any time) - Deleted account: game progress and profile data are removed with the deletion; technical database backups expire after a maximum of 90 days - Parent/teacher e-mails: encrypted, until the associated account is deleted - Server logs (web hosting): short-lived, automatic deletion after a few weeks - Presence data: ends when the page is closed, expires after a short time at the latest 12. COOKIES & LOCAL STORAGE Numopia sets no tracking or advertising cookies. There is no consent banner because we use no non-essential cookies. Only the technical login session (Firebase authentication) and player settings (e.g. language, sound) are stored locally on your device. This data never leaves your device. 13. ANDROID APP (GOOGLE PLAY STORE) The Android app is a WebView wrapper: it displays the web app in an app frame and uses the same servers and the same privacy statement. It requests NO dangerous app permissions (no camera, microphone, location or contacts access). The "Data Safety" information filed in the Play Store matches this statement. For the download itself, Google Play's privacy policy applies. 14. CHANGES TO THIS STATEMENT This statement may be adapted if the service changes. The current version can always be found on the privacy page of the website. In the event of material changes, we inform users in the game. 15. CONTACT FOR PRIVACY REQUESTS E-mail: info@numopia.com (subject e.g. "Access", "Erasure", "Privacy") Mail: Mohamad Chaaban, Wittbräucker Str. 586a, 44267 Dortmund, Germany SUMMARY – WHAT WE PROMISE: 1. Free, ad-free, no in-app purchases 2. No tracking, no analytics services 3. Player data in Germany/EU (Frankfurt) 4. Parent and teacher e-mails encrypted – not even the operator can read them 5. Children play only with parental consent 6. No free chat between players 7. Account deletable by yourself at any time 8. Your GDPR rights apply to all users worldwide Version: 5.0 | Language: English | Effective from: October 2026 | Last updated: October 5, 2026