Privacy Policy
Effective Date: September 29, 2026 • Last Updated: September 29, 2026
At BoardPlay ("BoardPlay", "we", "us", or "our"), we take privacy and student data protection seriously. This Privacy Policy explains how we collect, use, safeguard, and disclose information when you access or use our classroom activity platform, website, and related educational services.
🚫 No Ad Tracking
We run no behavioral advertising, marketing pixels, or third-party ad networks.
🔒 Zero Third-Party CDNs
All fonts, scripts, and audio assets are self-hosted locally without overseas tracking leaks.
🎓 Student Privacy First
Students do not create accounts or submit personal identifiers to play games or use worksheets.
1 Information We Collect
We collect only the minimum personal information required to deliver our educational games and worksheet services:
When an educator registers, we collect a unique username, a required and unique email address, an optional display name, and securely salted/hashed password credentials. Email addresses are mandatory for account security, identity confirmation, password recovery, and email ownership verification. We do not sell, rent, or use educator emails for third-party advertising or unsolicited marketing. We do not collect student email addresses, real names, phone numbers, or government IDs.
Vocabulary word pairs, definitions, and custom images uploaded by educators for activities. Uploaded images are automatically processed on our server to strip all EXIF metadata (including GPS coordinates, device models, and timestamps) before being compressed and stored.
Server operational logs containing truncated IP addresses and timestamp headers solely for rate limiting, DDoS prevention, and brute-force login protection. We do not correlate logs with user behavioral profiling.
2 Cookie & Local Storage Disclosure
Under EU ePrivacy regulations, GDPR, and global privacy standards, websites must disclose cookie practices. BoardPlay uses only strictly necessary cookies and local storage:
| Cookie / Storage Key | Type | Purpose | Duration |
|---|---|---|---|
| bp_session | HTTP-Only Cookie | Maintains authenticated educator session state securely. | 30 days / Session |
| boardplay_lang | Browser Local Storage | Saves your preferred UI language selection (e.g. English or 简体中文). | Persistent |
| boardplay_cookie_consent | Browser Local Storage | Records your acknowledgement of essential cookies and privacy terms. | Persistent |
Because we use strictly essential cookies for authentication and preference retention without third-party ad networks, explicit opt-in consent for behavioral tracking is not required under EU ePrivacy Article 5(3), but we provide full transparency.
3 United States: Children's Privacy (COPPA & FERPA)
The Children's Online Privacy Protection Act (COPPA) and the Family Educational Rights and Privacy Act (FERPA) protect children's online personal data in the United States.
Student Account Policy: BoardPlay does not permit children under 13 to register accounts. The Service is operated for educators and schools. Students engage with BoardPlay purely as end-users on classroom screens or anonymous activity links. We do not collect student names, email addresses, voice recordings, geolocation, or personal photos.
If an educator discovers that a child has inadvertently submitted personal information through an activity prompt, the educator can immediately edit or delete the activity, or contact us for prompt server-level removal.
4 European Union & UK: General Data Protection Regulation (GDPR)
For users located in the European Economic Area (EEA) and the United Kingdom, BoardPlay operates as a Data Controller.
- Legal Basis for Processing: We process account information to perform our contract with you (providing the service requested under our Terms). We process security logs based on legitimate interests (ensuring platform integrity and preventing abuse).
- Your Data Subject Rights: Under GDPR Articles 15–22, you have the right to access your personal data, request correction of inaccurate data, request erasure ("Right to be Forgotten"), restrict processing, request data portability, and object to processing.
- Exercise of Rights: You can delete any activity or your entire account directly through the platform or by contacting privacy@boardplay.local.
5 California & US State Privacy Rights (CCPA / CPRA)
Under the California Consumer Privacy Act as amended by the CPRA:
No Sale or Sharing of Personal Information: BoardPlay does not sell personal information to third parties, nor do we share or disclose personal information for cross-context behavioral advertising. We have never sold or monetized user data.
California residents have the right to request notice of information collected, request deletion, and request correction without discrimination.
6 China (PIPL) & Hong Kong SAR (PDPO) Compliance
Our infrastructure is hosted on servers located in the Hong Kong Special Administrative Region (SAR), serving educators and international schools in mainland China and around the globe.
- People's Republic of China (PIPL 个人信息保护法): When users access the platform from mainland China, we adhere to the principles of lawfulness, justification, necessity, and good faith. We collect only what is strictly necessary to authenticate the teacher and store lesson pairs. Uploaded educational images are processed without facial recognition or biometric profiling.
- Cross-Border Transfer Notification: In accordance with PIPL requirements, users residing in mainland China are informed that account and activity data are hosted on our Hong Kong SAR servers. We apply technical encryption and strict access controls to safeguard data integrity.
- Hong Kong SAR (PDPO): In accordance with the Personal Data (Privacy) Ordinance (Cap. 486), we adhere to the six Data Protection Principles (DPPs) regarding purpose and manner of collection, accuracy and duration of retention, use of personal data, data security, openness, and data access/correction rights.
7 Security Safeguards & Data Retention
We implement rigorous technical protections including cryptographic password hashing (Scrypt / PBKDF2), rate-limited request throttling, magic-byte upload validation, automated metadata stripping, and HTTP-only cookie flags. Personal data is retained only for the duration of your active account. When you delete an activity or delete your account, associated activity data and uploaded files are deleted from the active filesystem.
Privacy Inquiries & Data Requests
If you have any questions about this Privacy Policy, wish to access or delete your stored data, or need documentation for your school district's privacy evaluation, please contact:
BoardPlay Data Protection Office
Hosting Jurisdiction: Hong Kong SAR
Email: privacy@boardplay.local