This page is the beta operating charter, not a lawyer-reviewed privacy policy.
Privacy and Data Charter
Parent-managed records.
Data-light by design.
This beta charter explains what Dungeon Academy should collect, what it should avoid, and what must be finished before broad child-data enrollment.
Beta privacy status
This is not a final legal policy.
It is the operating charter for the current beta while the formal privacy notice, consent logs, retention policy, vendor inventory, and deletion workflow are prepared.
Broad enrollment still waits for a legal review of how long records are kept, and recovery for a parent who loses their sign-in account.
Learner records should be parent-facing and private, not published as social profiles or public leaderboards.
The product should avoid collecting address, school ID, health data, precise location, or payment details inside child-facing play.
Parent-managed
A guardian should control the learner profile, consent state, report access, and support requests.Dungeon Academy should not ask a child to manage legal or billing decisions.
Data-light beta
The school should store only what the learning loop and parent record need.The current product focus is learner profile, guardian email, consent state, progress, reports, and sync receipts.
Private by default
The full course and parent tools stay protected while account and entitlement systems mature.The public demo stays open, but full learner records belong behind parent-managed access.
No ad model
The product is intended as paid enrichment, not child-facing advertising.The academy should not rely on behavioral advertising, public child profiles, or social posting loops.
Plain-language data receipt
What parents should understand in one minute
The privacy page should not read like fog. Dungeon Academy records should exist to make learning visible to parents, not to build an ad profile or public child identity.
To show parents what the learner tried, completed, explained, and should do next.
The parent or guardian should control membership, records, reports, consent, correction, export, and deletion requests.
The free workshop and public information pages can be used without creating a child account.
Learner profiles, proof work, progress, reports, and family planning belong inside parent-managed access.
Current beta records
Data the school loop may use
Guardian email, parent account ID, member state, and sign-in/session signals when the parent dashboard is used.
Display name, age band, learning path, child profile ID, and consent version in beta records.
Completed rooms, attempts, answers, XP, mastery status, transcript entries, weekly goals, and report packets.
For a signed-in learner, the date each Year 1 school day was finished and the challenge level it was finished at, so a parent sees one record on any device. Written answers stay on the device where they were written. The learner's download includes it, and learner deletion removes it.
For a signed-in learner, the hero's name, look, class and chosen title, the best stars in each practice round, and how many practice battles were won, so the hero is the same on any device. The hero name is whatever the learner types, so a nickname works. No answers are kept. The learner's download includes it, and learner deletion removes it.
For a signed-in learner, each week and end-of-term test score: the date, how many questions were right on each school day, and the grade, so a parent sees the same grade book on any device. The questions and the learner's answers are not kept. The learner's download includes it, and learner deletion removes it.
For a signed-in learner, the date each daily Core lesson was finished and its best score (how many of 5 right), so the learning record counts those minutes on any device. The answers are not kept. The learner's download includes it, and learner deletion removes it.
Sync IDs, timestamps, route state, membership status checks, and basic server records needed to operate the beta.
Stripe keeps its payment records. A native USDC or $DGN payment also creates a public dungeon-1 transaction containing the sending address, destination, amount, and Academy invoice memo.
Parent requests and their review notes, stop-saving receipts, display-name correction receipts (with the old and new names), and saved-learning removal and account deletion records (family IDs, a hash of the guardian email, and the list of deleted files). These receipts are not anonymous and stay with the family account.
A suggestion or bug report stores the guardian account and learner record IDs, category, page area, device/browser choices, message, and timestamp. The guardian email is stored only when contact permission is checked.
Parent data rights
What a signed-in guardian can do today
Download the selected learner's synced progress, Year 1 finished-day dates, hero and practice-battle record, test scores, Core Math and Core Reading scores, lesson history, and saved lesson proofs. No membership is needed. Work saved only on a device is not included.
Stop new server saves for a learner and keep a receipt, then turn saving back on later if you choose. Existing records stay until you ask for removal, and billing is not cancelled.
Request a correction. Staff can correct a learner's display name today; other corrections are reviewed by hand.
Request deletion of one learner's saved learning or of the whole family account. After review, staff remove the learner's saved learning and any showcase entry, or delete the whole account's saved learning and parent sign-in. Request history, receipts, and billing records are kept.
Each request returns a receipt, and you can read its status and every review note. There is no email notification yet.
Not needed for learning
Data the school should not ask a child for
Stripe billing and native USDC / $DGN transfers stay in the guardian path; payment details should not be collected inside child-facing play.
The school does not need GPS or precise location to teach lessons or create reports.
No public friends list, child DMs, public profiles, or unmoderated student posting layer belongs in the current product.
Dungeon Academy learning access should stay inside the parent-managed family account path.
Before broad enrollment
Privacy launch gates
Convert this charter into a formal privacy policy, terms, deletion process, and retention schedule.
Each learner record keeps the consent version it was saved under, and stopping saves leaves a durable receipt. The signed-in guardian can turn saving back on, which records consent again with its own receipt; every pause and resume stays in the learner's save history.
When a parent asks, staff can delete the whole family account: every learner's saved learning and the parent's sign-in record. Request history, consent and correction receipts, the audit log, feedback, billing records, and a deletion receipt with a hash of the guardian email are kept as business records and are not deleted on a schedule.
Document hosting, auth, AI media, analytics, payment, email, and support providers before scaling.
A guardian who signs in again with the same Google account finds their family records. Recovery for a parent who loses that account is not built.
Paid access follows the family's own membership record, confirmed by Stripe or by a verified dungeon-1 payment.
Official reference desk
Sources parents and counsel should review
These links are not a substitute for legal review. They are the public reference points the beta should track while privacy work matures.
FTC COPPA Rule
Official rule page for online services directed to children under 13 or with actual knowledge of child users.
Official sourceFTC COPPA compliance planFTC business guidance for determining coverage and planning notice, consent, and parent rights.
Official sourceU.S. Department of Education Student PrivacyFederal student privacy resources, including FERPA and PPRA guidance.
Official sourceFERPA overviewDepartment of Education FERPA resources for education records and parent/student rights.
Official sourcePrivacy next step
Keep the beta small until the records layer is durable.
The free workshop stays data-light. Full-school access, parent records, and family tools remain protected while the record-keeping policy gets legal review and account recovery is finished.
Read beta termsBest next step after reviewing how parent-managed data should work.
Privacy support routes8 links
Learner saving controlsParentPause new server saves for the selected learner, or turn them back on, and keep a receipt. Existing records, device-only work, and billing are handled separately.Download saved learningParentDownload the selected learner’s synced progress and saved lesson proofs. Work saved only on a device and broader account records are outside this copy.Account & record requestsParentSign in as the guardian to request an export, correction, deletion, or consent withdrawal and check review status. Submission does not immediately change records or consent.Safety charterSafetyReview the parent-first operating posture for the private beta.School roadmapPlanSee what must be finished before broader child-data enrollment.Credential policyRecordsRead how beta records avoid official-credit and accreditation claims.Enrollment deskAccessOpen the protected beta only after reviewing privacy, safety, and terms.Parent reportsProofPreview what parent-managed learner evidence can look like.