Privacy policy

Last updated: 31 August 2026 · Effective: 31 August 2026

Curious Koko is a game for children, so this policy is written to be read by a parent or teacher rather than by a lawyer. Nothing here is hidden in a definitions section. If anything is unclear, email me@saurabhsrivastava.dev and I will explain it.

1. Who is responsible

Curious Koko ("the game", "this site") is operated by Saurabh Srivastava, an individual independent developer, acting as the data controller.

Contact for all privacy matters, including deletion requests and questions from parents, teachers and schools: me@saurabhsrivastava.dev.

2. What we collect

2.1 Information a player enters

The only thing the game asks a player to type is a nickname for their character — "Ari", "Bee", "Panda Girl". The game asks for a nickname, not a real name. It is used to label the save slot so that siblings sharing a device each get their own progress. We never ask for a real name, age, birthday, address, school, email, phone number, or photograph.

2.2 Game progress

The game stores what you would expect a save file to store: stars and coins earned, which quests have been completed and the best score on each, crafting materials collected, items built, pets adopted, the outfit the character is wearing, which character was chosen, where the character is standing on the map, which story scenes have already been seen, and when the daily gift chest was last opened.

2.3 An anonymous account identifier

When the game first loads it creates an anonymous account through Firebase Authentication. This is a randomly generated identifier with no name, email or personal detail attached to it. Its only purpose is to give the save file somewhere to live. We cannot identify a person from it, and it is not shared with anyone.

2.4 A Google account — only if an adult chooses to sign in

Signing in with Google is entirely optional and exists so progress can follow a child to a second device. It is intended to be done by a parent or teacher using their own Google account. If it is used, we receive from Google the account's email address, display name and a Google user identifier, and we store them so the save file can be reattached on the next device. We do not receive the password, and we do not use the email address for marketing — there is no mailing list.

2.5 Technical data

Like every website, the hosting and advertising services used here automatically receive standard technical information when a page loads: IP address, browser type and version, device type, operating system, referring page, and the time of the request. This is used for delivering the page, security, abuse prevention and aggregate statistics. See section 8.

3. What we deliberately do not collect

• No real names, ages, dates of birth, addresses or schools.
• No email addresses or phone numbers from children.
• No location or GPS data.
• No access to the camera, microphone, photo library, contacts or files. The in-game "polaroid" pictures are drawn by the game; no camera is ever opened.
• No voice or video.
• No chat, messaging, comments or user-generated content of any kind — there is nothing for a child to post and no way for anyone to contact them through this site.
• No biometric data.
• No behavioural advertising profile of the user (see section 6).

We do not sell personal information, and we do not share it with data brokers. We have never done so and have no plans to.

4. Why we hold it, and our legal basis

5. Children's privacy (COPPA and the UK/EU rules)

Curious Koko is directed to children. We treat every user as a child and apply the strictest handling by default rather than trying to work out who is under 13.

5.1 United States — COPPA

The Children's Online Privacy Protection Act restricts collecting personal information from children under 13. Our approach is to avoid collecting it in the first place:

• The game does not ask a child for any personal information. A nickname is requested explicitly instead of a real name.
• The account identifier created at load is anonymous and is used solely to support the internal operation of the game — saving progress — which is a permitted internal use.
• Google sign-in, the only route by which an email address enters the system, is presented to and intended for a parent or teacher.
• There is no chat, no public profile, no way for a child to disclose information to another person, and no behavioural advertising.
• We do not condition a child's participation on disclosing more information than is reasonably necessary. Every part of the game is playable with no account at all.

Parental rights. A parent or guardian may at any time ask what information is held about their child, ask for it to be deleted, and refuse any further collection. Email me@saurabhsrivastava.dev. There is no charge and no form to fill in.

5.2 UK and EU

Where the UK GDPR or EU GDPR applies, children merit specific protection, and this policy is written to be intelligible to a child's parent. Where processing relies on consent — advertising cookies, and optional Google sign-in — that consent is sought from the adult in charge of the device, and the site is configured so that ads are non-personalised regardless. Age-appropriate design principles have shaped the game itself: no chat, no purchases, no streaks, no notifications, no dark patterns pressing a child to keep playing, and data collection kept to the minimum that makes a save file work.

6. Advertising, and how it is restricted here

Curious Koko is free and has no paid tier. Its running costs are met by advertising served through Google AdSense.

6.1 Where ads appear

Ads appear only on this site's information pages — the ones written for adults, including this one. There are no ads inside the game: none over the play area, none next to the joystick or a puzzle's answer buttons, no video ads, no interstitials, and no "watch an ad for a reward". This is both a deliberate design choice and a requirement of the ad network, because a child mis-tapping an ad serves nobody.

6.2 Non-personalised only

Because this site is directed at children, it is tagged for child-directed treatment with Google. The consequences are:

• Ads are served on a non-personalised basis: chosen from the content of the page and coarse, non-identifying signals such as approximate region, rather than from any profile of the user.
• No advertising identifier is used to build an interest profile of the user.
• Remarketing, interest-based targeting and audience segments are disabled.
• Ad categories are restricted to those appropriate for a family audience.

Non-personalised ads still involve a cookie or similar identifier for limited purposes: capping how often the same ad is shown, aggregate reporting to the advertiser, and detecting fraudulent clicks. That is the minimum needed for an ad to be delivered and paid for at all.

6.3 Third-party vendors and the DoubleClick cookie

Third-party vendors, including Google, may use cookies to serve ads based on a user's prior visits to this or other websites — a practice we have switched off for this site, as described above, but which is disclosed here because Google requires publishers to do so.

• Google's use of advertising cookies enables it and its partners to serve ads to users based on their visit to this site and/or other sites on the internet.
• Users may opt out of personalised advertising by visiting Google Ads Settings.
• Users may opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info/choices, or, in Europe, at youronlinechoices.eu.
• How Google uses information from sites that use its services is described at policies.google.com/technologies/partner-sites.

If you would prefer no ads to be requested at all, use a content blocker at browser or network level. The game will continue to work normally.

7. Cookies and local storage

The game itself sets no tracking cookies. It stores your save file in the browser's local storage — a private area belonging to this site alone, which never travels to a server on its own and is not readable by any other site.

Cookies are set by Firebase Authentication (to keep a session signed in) and, on the information pages, by Google's advertising services. The full list, what each one does, and how to refuse them is in the cookie policy.

8. Who else processes data

Curious Koko is run by one person and uses a small number of third-party services. Each has its own privacy policy.

We do not use analytics that profile individuals, and we do not embed social network widgets, trackers or pixels.

9. International transfers

The services above are operated by Google and may process data on servers outside your country, including in the United States. The game's database is hosted in the Asia–Southeast region. Google provides safeguards for such transfers, including the European Commission's Standard Contractual Clauses and the UK addendum, as described in its own policies.

10. How long we keep it

• Local save data: stays in the browser until it is deleted by clearing site data, or by deleting the player inside the game. We cannot see it and cannot delete it for you.
• Synced save data: kept while the account exists. Deleting a player removes that player's data immediately; deleting the account removes all of it.
• Anonymous accounts that are never signed into: pruned periodically once they have been inactive.
• Server and advertising logs: retained by Google for the periods stated in its own policies, which are outside our control.

11. Security

The site is served only over HTTPS. Database access is governed by server-side rules that let a signed-in account read and write its own save data and nothing else — one account cannot see another's. Firebase App Check is used to reject requests that do not come from the genuine game. No payment details are ever handled, because nothing is for sale.

No system is perfect, and the honest position is that the data at risk here is a list of how many stars a panda has collected.

12. Your rights, and how to delete everything

Depending on where you live, you have the right to ask for a copy of the data held about you or your child, to have it corrected, to have it deleted, to restrict or object to processing, to withdraw consent, and to complain to a regulator. We honour these requests wherever you live, not only where the law compels it.

Deleting the data yourself, right now

1. If you have not signed in — everything is in the browser. Clear this site's data in your browser settings, and it is gone completely.
2. If you have signed in — open the main menu, select the player, and delete it. That removes that child's progress from the database at once. To remove the entire account, email me.

Asking us

Email me@saurabhsrivastava.dev with what you want done. We aim to reply within 7 days and to complete requests within 30 days. There is no charge, and parents do not need to explain why.

If you are in the UK you may complain to the Information Commissioner's Office; in the EU, to your national supervisory authority.

13. Changes to this policy

If this policy changes, the "last updated" date at the top changes with it. A change that materially affects how data is handled — for example, introducing a new category of collection — will be announced on the site's front page as well. Continuing to use the game after a change means accepting the updated policy.

14. Contact

Saurabh Srivastava, independent developer of Curious Koko.
Email: me@saurabhsrivastava.dev

Questions from parents, teachers, schools and data-protection officers are answered personally. See also the contact page and the parents' guide.