Privacy Policy · Growney Dino

The short version

• A child can use Growney Dino without any account. Then we collect no personal data at all: the finds, the dinosaurs' colours, the chapters done and the age for the “Next to you” chapter stay on the device.
• The app has no ads, no analytics, no tracking, no purchases, no chats and nothing a child could publish. Children don't enter data about themselves.
• A grown-up can sign in with a Growney account and choose a child: then the child's finds and museum are kept with the family and show up on the child's other devices, and grown-ups see in Growney Family how many minutes a day the child played.
• What the child sees, the pictures, voice recordings, maps, real photos, sounds and videos (from Wikimedia Commons, with their authors and licences shown), is part of the app.
• Links that leave the app, signing in and the settings for grown-ups are behind a parental gate.

1. Who is responsible for your data

The controller of your personal data is Yevhenii Dryha, ul. Milczańska 18a/22, 61-131 Poznań, Poland, NIP 5273007452, REGON 522367200 (“we”, “us”). Contact: support@growney.app. We have not appointed a data protection officer.

2. Without an account

Without signing in, Growney Dino works entirely on the device. The facts and finds discovered, the colours the child painted the dinosaurs with, the expedition chapters done and the chapter where the child stopped, the age the child picked (from 5 to 10, used to work out the height next to the dinosaur), who walks alongside (a boy or a girl), where the shaft was left, the chosen language and whether sound is on are saved only on that device (in the app's storage, or in the browser on the website). They are deleted with the app, with the browser data, or with the “Start again” button (Me → For grown-ups).

Without an account, the app and the website send nothing about the child.

3. With a Growney account

A grown-up can sign in with a Growney account (email and password, Sign in with Apple or Sign in with Google), create a family if there is none and add a child, or pick a child already in the family. The grown-up enters the child's name or nickname, picks an animal avatar and the year of birth. The account, the family and the child's profile are the same as in the Growney app and are described in the Growney privacy policy: chore.growney.app/privacy.

When a child plays as themselves, we keep with their family: the facts found, the expeditions done and the chapter where the child stopped, the dinosaurs' colours and colouring, the chosen age, who walks alongside, and when this was last updated.

So that grown-ups can see in Growney Family how long the child played and set a daily limit, we count the minutes played: the date, the number of seconds that day on this device and the app's name. These records are deleted after 40 days. When today's time is up, the child can ask for more, and grown-ups see the request in Growney Family.

The device the child plays on is linked like a child's phone in Growney: we keep an identifier the app creates for that device (no email or password), the name “Growney Dino”, the type of device and the time it was linked. The device appears among the child's devices in Growney Family, where a grown-up can unlink it. A grown-up can also show a one-time 6-digit code to link a child's own device; the code expires after 15 minutes.

4. What we don't do

• We don't show ads, use advertising SDKs or read the advertising identifier.
• The app has no analytics and no crash reporting from other companies.
• We don't track anyone across other companies' apps and websites.
• We don't ask for a child's email, phone number, location, contacts, photos or voice. The app doesn't use the camera or the microphone.
• We don't sell personal data or share it for marketing.

5. The website

The website dino.growney.app uses no cookies or third-party trackers. We count visits with Cloudflare Web Analytics, which sets no cookies, does not store IP addresses and does not follow anyone across sites: it shows us only totals, such as how many times the museum was opened. Our hosting provider processes IP addresses and request logs to deliver the pages and protect them from abuse.

6. Legal bases

We process personal data under the EU General Data Protection Regulation (GDPR) for the contract with the grown-up who signs in (Art. 6(1)(b)): keeping the child's progress, counting play time for grown-ups and linking devices; and for our legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, fixing errors and answering support requests. By adding a child or choosing one, a grown-up confirms that they are the child's parent or legal guardian, or have their permission.

7. Who we share data with

• The child's family: the progress and play time are stored with the family, and grown-ups in the family manage the child's profile and devices in Growney and Growney Family.
• Google Cloud and Firebase (Google Ireland Limited): sign-in, database, server functions and hosting. Database and server functions are in the EU (Belgium); sign-in may also be processed in other countries, including the United States.
• Google Workspace (Google Cloud EMEA Limited): our support email.
• Cloudflare, Inc.: visit counts on the website only.
• Apple and Google: downloading the app from the App Store or Google Play and, if a grown-up chooses Sign in with Apple or Sign in with Google, the sign-in too, under their own privacy policies.
• Authorities: only when the law requires it.

8. Transfers outside the European Economic Area

When a provider processes data outside the EEA, we rely on a European Commission adequacy decision, such as the EU–US Data Privacy Framework for certified companies, or on the Commission's Standard Contractual Clauses.

9. How long we keep data

• Progress on a device without an account: until the app is deleted, the browser data is cleared or “Start again” is pressed.
• A child's Dino progress: until a grown-up deletes the child's profile or the family is deleted.
• Minutes played: 40 days.
• A linked device: until it is unlinked in Growney, Growney Family or Growney Dino, or the child's profile is deleted.
• Device codes: 15 minutes.
• Database backups: 7 days. Server and hosting logs: up to 30 days. Support emails: up to 2 years after the question is resolved.

10. Your rights

You have the right to access your data and get a copy, to correct it, to have it deleted, to restrict processing, to data portability and to object to processing based on our legitimate interests. Parents exercise these rights on behalf of their children. A grown-up can delete the account and all the family's data in Growney Dino (Me → Sign in, behind the parental gate), in Growney Family or in the Growney app; for anything else write to support@growney.app. We reply within one month.

You can also complain to a data protection authority. In Poland that is the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

11. Security

Data is encrypted in transit and at rest. Access rules let a child's device read and write only that child's progress, and it loses access as soon as it is unlinked.

12. Changes and contact

When we change this policy, we update the date at the top and tell grown-ups about significant changes before they take effect. Yevhenii Dryha, ul. Milczańska 18a/22, 61-131 Poznań, Poland, support@growney.app.