A note for parents
STEM Quest is built for kids. Most of the people who will use this app are children, and we treat their privacy the way we'd want our own kids' privacy treated. This policy is written in plain language so parents can understand exactly what we collect, why, and how to control it.
If you have any questions after reading this, contact us directly at stemquest@valosinmedia.com. We'll respond within 5 business days.
What this app is, in one paragraph
STEM Quest is an educational game where children battle bosses by answering math, science, and coding questions. The app stores a small amount of information about each player so progress, characters, and unlocked items aren't lost between sessions. We do not show advertisements, we do not use behavioral tracking, and we do not sell any data.
Children's privacy (COPPA)
STEM Quest is directed to children under the age of 13 in the United States, and is designed to comply with the Children's Online Privacy Protection Act (COPPA).
We have built the app to collect the minimum amount of information necessary for the app to function. Specifically:
- We do not ask for a child's full name. The app uses a chosen display name (like "Super Star" or "Magma Pup") that does not need to be a real name.
- We do not ask for a child's date of birth. The app uses an age bracket (5–7, 8–11, 12–14, or 15+) chosen during sign-up to deliver age-appropriate content.
- We do not ask for phone numbers, addresses, school names, photos, or any other directly identifying information.
- We do not use any behavioral advertising, retargeting, or cross-app tracking.
- We do not share children's information with third parties for marketing, advertising, or any commercial purpose.
The information we do collect (described below) is used only for internal app operations as defined by COPPA — that is, keeping the app working, maintaining the player's saved game progress, and authenticating the user.
If you are a parent or guardian and believe your child has provided information to us, you can contact us at any time to review, modify, or delete that information. See "Your rights as a parent" below.
What we collect
We collect the following data, all of which is tied to a single player account:
| Information | Why we collect it |
|---|---|
| Email address (provided during sign-up) | To create and identify the account; required for login |
| Display name | Shown in the game; chosen freely and does not need to be a real name |
| Age bracket (5–7, 8–11, 12–14, or 15+) | To serve age-appropriate questions and content |
| Game progress (XP, level, coins, equipped characters and gear, defeated bosses, daily streak, quest history) | To save the player's progress between sessions |
| Email and password | To authenticate the user when they return |
Passwords are stored as cryptographic hashes by our authentication provider — we never store them in plain text and we never see your password.
What we do NOT collect
For clarity, here are things we explicitly do not collect:
- Real names, dates of birth, government IDs
- Phone numbers
- Physical addresses
- Photos or videos
- Microphone or camera input
- Precise location (we don't request location permissions at all)
- Browsing history outside this app
- Behavioral or interest-based profiles for advertising
- Any data that could be used to track the child across other apps or websites
How we use what we collect
The data we collect is used only for these purposes:
- Authenticating you when you sign in
- Saving your game progress so you don't lose XP, coins, characters, or boss defeats between sessions
- Serving age-appropriate content (the right difficulty of questions for the chosen age bracket)
- Operating the app — fixing bugs, preventing abuse, complying with the law
We do not use the data for advertising, profiling, or any kind of marketing.
Third parties we work with
We use a small number of carefully chosen service providers to operate the app. None of them receive children's information for their own commercial purposes — only for the specific operational functions listed below.
| Service | What it does | Privacy policy |
|---|---|---|
| Supabase | Stores account data and game progress in a secure database. Provides authentication. | supabase.com/privacy |
| Lovable | Hosts the web version of the app. | lovable.dev/privacy |
These providers are bound by their own privacy obligations and act as data processors on our behalf. They are not permitted to use the data for any other purpose.
We do not use any analytics services, advertising networks, behavioral tracking SDKs, or social media tracking pixels.
Your rights as a parent
As a parent or guardian, you have the right to:
- Review the personal information we have about your child.
- Request deletion of all of your child's information from our systems. We will permanently delete the account and all associated data within 30 days of receiving your request.
- Refuse further collection by deleting the account and ceasing to use the app.
- Contact us at any time with questions or concerns.
To exercise any of these rights, email us at stemquest@valosinmedia.com with the subject line "Privacy Request" and the email address associated with your child's account. We may ask for a quick verification step to confirm you are the parent or guardian before taking action — this protects against unauthorized deletion requests.
Data retention
We keep account data for as long as the account is active. If an account is unused for 24 months, we may delete it automatically along with all associated data. You can request earlier deletion at any time using the process above.
Security
We protect data using industry-standard practices:
- All connections between the app and our servers use HTTPS encryption (TLS 1.2 or higher).
- Database access is restricted using row-level security so each player can only access their own data.
- Authentication credentials are never stored in plain text.
- Our service providers (Supabase, Apple, Google, Lovable) maintain their own security certifications.
No system is 100% secure, but we take this seriously and update our practices as standards evolve.
International users
The app is operated from the United States. If you use it from outside the US, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.
For users in the European Economic Area, United Kingdom, or Switzerland: we rely on legitimate interest and consent (where required) as our legal basis for processing under GDPR. You may request access, correction, deletion, or portability of your data using the parent contact process above.
For users in California: we comply with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). We do not sell or share personal information.
Changes to this policy
If we update this policy, we will:
- Post the new version inside the app and at the policy's public URL
- Update the "Effective date" at the top
- Notify the email address on file (if a material change to data practices)
We will not retroactively reduce parents' rights without obtaining new consent.
Apple App Store disclosures
For Apple's App Store privacy questionnaire, the data we collect maps to the following declarations:
- Contact Info → Email Address: Linked to user. Used for App Functionality only. Not used for tracking.
- User Content → Other User Content (display name): Linked to user. Used for App Functionality only.
- Identifiers → User ID: Linked to user. Used for App Functionality only.
- Usage Data → Product Interaction (XP, level, progress): Linked to user. Used for App Functionality only.
- Diagnostics: None collected.
- Tracking: None.
Contact us
Questions about this policy or about your child's data?
Email: stemquest@valosinmedia.com
We respond to all privacy-related inquiries within 5 business days.
This policy is intentionally written in plain language. If anything in it is unclear, please ask — and we'll improve the wording.