Privacy notice

The short version

• Whyland is a learning game for children aged 4 to 12. We collect as little as we can and use it only to run the game.
• A child's explorer (their first name, age, look and progress) and your setup answers are kept on the device they play on and in the explorer's cloud save in our database, so nothing is lost with the device. What else reaches us is listed below, and only so the game works.
• We never show ads, sell information, or track anyone across other websites or apps. Children cannot chat or type messages to anyone in Whyland.
• Character voices are made with AI. Reading out loud is on by default, and a grown-up can turn it off. Each reading is checked, and it is saved only if a grown-up agreed: handing the device over at the end of setup is that agreement, and it is recorded. Saved readings are kept for you to hear for up to 365 days after your child last read out loud, and you can delete them or turn saving off in Grown-ups.
• Grown-ups can see, download and delete what we hold, and change their minds at any time.

Family accounts, memberships and emails are still being switched on. This notice already covers them, so it will not need to change when they arrive.

Who we are and how to reach us

Whyland is a game and website run by the company below. Write to us about privacy at any time, and we will reply within 30 days.

What we keep about each explorer

What Whyland knows about an explorer lives in the web browser on the device your child plays on (its local storage) and, as soon as the device is online, in the explorer's cloud save in our database (see Cloud saves):

• The explorer: first name, age, the look your child picked, what they love, their pet, and settings such as voices and a daily time limit.
• Progress: ideas learned, stars, the homestead, companions, story choices and time played.
• Your setup answers: school year, how reading and numbers are going, and where to start.
• Tricky-things answers (for example big feelings or worries) and what helps. They are used only to pace the game gently, and are never shared with other players.
• Settings and places: sound, music, picture quality, the camera, the grown-up PIN, the reading out loud switch, where the explorer stands, today's extra minutes and their route on the map (My Footprints, the last 7 days). A new device that loads the explorer picks these up too.
• Simple play records for the Grown-ups report, the measures of whether Whyland is helping (days played, which ideas stuck at a later review, how visits ended, and your 0 to 10 rating), and the date this device first played.

To remove it from the device, delete the explorer in Grown-ups, or clear this website's data in the browser's settings. To delete the cloud save too, see Cloud saves.

What leaves the device when a child plays

Besides the cloud save, and without a family account, only these reach our servers or our service providers:

• A random session cookie (wl_s). It tells our server that a request comes from a real visit, so voices, cloud saves, online play and statistics work only for players, with fair-use limits for each browser. It holds a random number, not a name, and lasts up to 400 days. When a voice line is made for the first time, we keep this number next to it for 30 days to apply daily limits.
• A scrambled network address. We turn the internet (IP) address of a request into a one-way code made with a secret key before we keep it, and use it only for fair-use limits and to stop people guessing codes. We never store the address itself.
• Voice requests. The game asks our server for each spoken line, and most lines are the game's own words. A greeting that says your child's name sends their first name, spelled how it sounds, inside the request and never in a web address. See AI voices.
• Game events, when switched on: for example that a chapter started or a mission was finished, with how many days since this device first played, whether it is the first play today, a content level (early, core or upper) and the explorer's place in this device's list. Each page visit gets a new random id that is never stored. For a family that has given its consent and has not switched it off in Grown-ups, our server also adds a random family id and a random id for each child. No names, ages, typed words or locations are sent.
• Error reports, when switched on: what went wrong and where in the game, sent without cookies, request contents, web address details or anything about the player.
• Online play. It is on from age 7 and off below 7, and a grown-up can switch it either way in Grown-ups. It shares with other players nearby where the explorer stands, their look as a set of numbers, and which of a few preset waves or phrases they chose. Other players see a made-up nickname. Names and free text never travel. A random player id lasts only while the browser tab is open.
• The entry code cookie (wl_a), while Whyland is invite-only. It remembers that this browser entered the code.
• Readings, unless a grown-up turns reading out loud off for this device. See Reading out loud.

Reading out loud

Reading out loud is on by default. A grown-up can turn it off for the device in Grown-ups, behind the grown-up check. The device asks for permission to use the microphone the first time. The microphone is on only while the glowing ball is lit, for one reading at a time.

• Each reading (at most 12 seconds of your child's voice) goes only to Whyland's own speech service, which a cloud computing host runs for us under a data processing agreement.
• It is turned into words only to check the words on the page, and the words heard go back to the device for that reading's feedback.
• The speech service never stores audio: the sound is deleted when the check ends. Unless a grown-up agreed to saving reading recordings, we never store or log the recording or the words heard, and we never share them.
• Saving reading recordings needs a grown-up's agreement. At the end of setup, the screen where the grown-up hands the device to the child says in plain words that handing it over means agreeing to save that explorer's reading recordings, and we record that agreement (which words were shown and when, with no name). A signed-in family can also switch Save reading recordings on in Grown-ups. If a child starts playing before a grown-up finishes setup, nothing is saved until then. When saving is on, Whyland also keeps each recording, encrypted, so you can listen back to your child's reading, and so we can check and improve how well read-aloud hears children. We keep the recording, the words on the page, the words heard and a short result.
• Recordings are never sold, never shared beyond our service providers (our storage and hosting providers, who act for us), and never used to train AI models unless you separately agree.
• A recording is kept until your child has not played (for a family account) or not read out loud (for an explorer without one) for 365 days. You can listen to, delete one or delete all of them any time in Grown-ups. Turning saving off stops it, and recordings already saved stay until you delete them or they expire. They are all deleted at once when you delete your child, the explorer or your account.
• The device keeps only a simple result, such as that a word was read the first time, so the game knows what to work on next. Our server keeps only daily counts of readings, with no name, age or sound, for 35 days.
• The reading out loud switch is kept with the explorer's cloud save, so a new device that loads the explorer starts with it as you left it. Because each reading is used only to check it and is deleted straight away, we do not ask a grown-up's consent before it starts. Turning it off on a device stops it there; turn it off on each device the explorer already plays on. Tapping words to hear them always works.

Cloud saves

Every explorer gets a cloud save as soon as the device is online, under a made-up username such as otter_4821 that never contains your child's name, so the adventure is never lost and can carry on from another device. We keep in our database: the username; the explorer's first name, how to say it, age, look, loves, pet and settings; all your setup answers, including any tricky-things answers; and their progress and play records.

A cloud save opens only with its secret 8-character explorer code, which the device keeps. We store only a one-way code made from it with a secret key, so even we cannot read it. If you choose a different username in Grown-ups, do not include your child's name.

Deleting an explorer on one device does not delete its cloud save. To delete a cloud save, email us its username and explorer code, or delete the child in your family account.

What we use these for, and nothing else

The session cookie, the scrambled network addresses, the random page and player ids and the usernames are persistent identifiers. We use them only to support the internal operations of Whyland:

• running the game and the features a child or grown-up asks for (voices, cloud saves, online play);
• security and fair use: spending limits on voices, rate limits, and stopping people guessing the entry code or explorer codes;
• keeping a cloud save in step between devices;
• finding and fixing errors;
• counting which parts of the game work, so we can make them better;
• meeting our legal duties.

We never use them to contact a child, to build a profile of a child, for advertising of any kind, or for any other purpose. We keep it that way by:

• using random ids that carry no name. For a family that has given its consent, a random family id and a random id for each child tie that family's visits and play together, so we can see how the game works for real families. A parent can switch this off in Grown-ups. Only our own server can make these ids, and only our team, with a private tool that reads our own database, can connect an id to a family;
• keeping network addresses only as one-way codes, and never sending them with game events;
• telling our statistics provider not to build person profiles of children or look up locations from game events;
• using no advertising networks, ad pixels or outside scripts on the game's pages;
• deleting identifiers on the schedule in How long we keep things;
• letting only our service providers handle them, under contracts that forbid any other use;
• limiting who on our team can see them.

Family accounts, for grown-ups

A grown-up can create a free family account with an email address and a 6-digit code we email. With it we keep:

• About you: your email address and when you confirmed it, your country and time zone, your school system, the choices you make in your account, and when you last signed in.
• About each child, up to 3: first name, how to say it, age, your answers about school and reading, where to start, how the game has adjusted to them, and which explorer username is theirs.
• Tricky-things answers in the account too, only if you tick "Keep tricky-things answers in my account". Untick it and we delete that copy (each explorer's cloud save keeps its own).
• Devices you link, with a name you choose, so a child's adventure can come back on a new device.
• Weekly summaries of play for the email report, which you can turn off.
• Records of the emails we sent you and of each consent you gave.

Sign-in codes are stored only as one-way codes and stop working after a short time.

Reading plans and start links

A grown-up can make a reading plan on our website. We save the child's first name or nickname, age, the reading stage you choose, your answers to the picture checks about what you have seen them read, the goal, the hardest part and the other answers you pick, their interests and how many days a week you plan to read. A private cookie lets you resume it. If you tell us your child learns differently, we never keep that answer: the plan keeps only the extra help it switches on in the game (spoken instructions, fewer choices, a calm pace and no timers). This browser also keeps a copy of your answers so a reload never loses them, without that answer and without your email once we have it; it is removed when the free week starts or after 30 days. We keep the plan, the email you give to save it, the campaign source, whether you chose yearly or monthly and whether a free trial started, for 30 days after its last change. A private device link can reopen the same plan, so treat it like a password. Deleting a completed explorer's cloud save also deletes its plan copy.

The plan email. We use the email you give to save the plan to send you at most three emails about it (about an hour later, a day later and three days later), each at most once a month to the same address however many plans use it, and we stop once you start a membership. The link in them opens a copy of the plan on any device until a membership starts. Each has a one-click unsubscribe link. If you unsubscribe before you have a family account, we keep only a one-way code made from the address, never the address itself, so we never email it about a plan again. When you confirm the address with the 6-digit code we send, it becomes your family account's email, and the plan and your child's explorer are linked to that account.

Progress for you. The plan can keep a short daily summary from the game: how many words and stories were read, quests finished and minutes played, and milestones such as a first book finished. It has no recordings and nothing your child typed. When the game sends these summaries, we keep the last 60 days of them with the plan, show them to you on the plan page, and use them for the first-book email and your weekly report, which you can stop from any of those emails. From a device that opened the plan or its private link, the game sends one after each visit and after each finished story. Besides the counts it names the library stories read that day, the reading step your child is on and, when it does not hold your child's name, the first book's title. Your child's name is never sent: the plan page fills it in from your answers.

A free trial starts on Stripe's own page, as described under Memberships and payments. When payments are not live yet, a preview checkout takes no card, charges nothing and starts no subscription. The completed explorer and the answers that personalize it are saved in our database under its secret recovery code, following the cloud-save rule. A preview access cookie is not a verified family account. We keep campaign tags and the referring website, never its full address, with the plan to understand how parents find Whyland. Step statistics record which screens were seen and the options picked (such as an age range, a reading stage or a plan), never a name, an exact age, an email or recovery details. These pages carry no advertising pixels.

Existing emailed start links and their short codes still work. They keep their setup answers for at most 7 days, and those answers are deleted when the link or code is used. Tricky-things answers travel only if the parent chose to include them. The device that opens the link keeps the setup with the new explorer and its cloud save.

Asking for your consent

We ask a parent before we collect any personal information from a child beyond what our internal operations need.

• Free family account: we email you a notice that explains what we collect and ask you to confirm, then send a second email to confirm your choice. This method is allowed because we never disclose children's information to anyone for their own use.
• Membership: paying with your card gives your consent, and the charge shows on your card statement. A free trial starts with no charge, so it needs your consent by email first. On a reading plan, the checkout shows that consent in one line above the Start my free week button: by tapping it, you confirm you are the child's parent or guardian and agree to our terms and this notice. Tapping it after you enter the code we email you records the consent, with those words, and we send you the notice and the confirming email described above. Without the code and that tap, no consent is recorded and no free trial starts.
• We record each consent with the date and the version of the words you saw.

You can agree to us collecting and using your child's information without agreeing to share it with third parties. We do not share it with third parties for their own use in any case. If you do not confirm within 30 days, we delete your email address and anything you gave us.

The children's privacy notice is the notice we send to parents.

Memberships and payments

Only a signed-in grown-up can buy a membership, through Stripe. You type your card details into Stripe's own page, so we never see or store your card number. We keep the plan, its status, when it renews, and the ids Stripe gives us. Stripe sends your receipts. Children never see prices or a way to pay.

In our iPhone, iPad and Android apps a membership is bought through the App Store or Google Play instead, under your own Apple or Google account. RevenueCat, the service our apps use for these purchases, tells our server when such a membership starts, renews or ends, with our random family id. We get the plan, its status and when it ends, never your card details.

When you delete your family account we cancel a Stripe membership at once and delete our records of it. Stripe keeps its own payment records (the customer, the email address and the invoices) for as long as payment and tax laws require. Apple and Google keep the records of purchases made through them.

Emails

Emails go only to grown-ups, never to children. We send sign-in codes, start links, the parent notice, emails about a reading plan you saved, reports about your child's play (which include your child's first name), such as a first book finished and the weekly report, and membership notices such as the start of a free trial, a reminder before it ends, a failed payment or an upcoming yearly renewal. We send tips or news only if you ask for them. Emails about a saved plan, play reports, tips and news each have a one-click unsubscribe link.

Statistics on grown-up pages

On grown-up pages only, such as the reading check and your account pages, we use PostHog to learn how parents use them. After you sign in, these statistics carry a random family id, never your email address, and before you sign in, a random id for your reading plan. If we record visits to account pages to fix problems, all text and everything you type is hidden first. They use a cookie on this browser, and they reach PostHog through our own server, which leaves out your IP address. None of it runs on the game's pages.

Who we share information with

We use the service providers below to run Whyland. They act only on our instructions, under contracts that require them to keep information safe and forbid them from using it for anything else. We do not sell or rent personal information, and we do not share it for advertising.

We may also disclose information when the law requires it, to protect the safety of a child or anyone else, or to protect Whyland from fraud or attack. If Whyland is ever sold or merged, this notice keeps applying to the information we hold, and we will tell parents before anything changes.

Where information is stored

Our database and our server code run in Seoul, South Korea. Pages are delivered from Vercel's worldwide network, and our other providers work in the United States. Your information may therefore be handled outside the country where you live, with the protections described here.

AI voices

Every character voice in Whyland is made with AI by ElevenLabs. Some of the young characters' voices are AI voices modeled on recordings of real people. Whyland never uses your child's voice to make a voice. The game uses the microphone only for reading out loud, unless a grown-up turns it off, and otherwise our site tells the browser to keep it switched off.

When a greeting says your child's name, our server sends ElevenLabs only that line, such as "Hi, Maya!", and nothing else about your child, your device or you. We keep the finished sound so it can play again without being made again. It is stored under a one-way code made from the line, never with the name written out or with any id of a device, child or account, and deleted after 90 days.

How long we keep things

We keep information only as long as we need it for the reasons below, then delete it.

Our providers keep their own short-lived records: for example error reports for up to 90 days and server logs for a few days. Game statistics carry only random ids, never a name, age, email address or typed word. Only our own database can connect those ids to your family, and that connection ends when you delete your account: we delete the information the ids are made from, so nobody can connect them to you afterwards. When you delete your family account, we also ask PostHog to delete your grown-up profile there, with the statistics and recordings under it from grown-up pages, payments and email. We do not delete the game statistics themselves one by one: they stay in PostHog as random ids that nothing connects to you, until PostHog's own retention period under our plan ends (a year or more).

Your choices and rights

• See and download what we hold about your family from your account's privacy page, or ask us by email.
• Correct your child's details in Grown-ups or in your account.
• Delete an explorer on a device in Grown-ups, a child or the whole family account in your account, or a cloud save by emailing us. Deleting is permanent.
• Stop further collection at any time: turn off online play in Grown-ups, delete a cloud save, or withdraw your consent by email. We then delete the information that needed it, and the game keeps working on the device.
• Stop the linking of game statistics to your family at any time in Grown-ups. New statistics are then no longer tied to your family's random id. Switching it off does not delete statistics already sent: they stay as random ids, and deleting your family account is what ends the connection to you.
• Refuse sharing with third parties. We do not share children's information with third parties for their own use.

Before we show or delete a child's information, we check that the request comes from the child's parent: through your signed-in family account, or with the explorer code for a cloud save.

Depending on where you live (for example the UK, the EU or California), you may have further rights, such as to object to or limit how we use information, or to complain to your data protection authority. Email us and we will help.

Keeping information safe

We follow a written information security program. Information travels encrypted. Only our server and our team can reach our database, and our server uses an account with the least access it needs. Explorer codes, sign-in codes and network addresses are stored only as one-way codes made with secret keys. Codes and costly features have rate limits. Secrets live only in our hosting settings. Error reports and statistics are cleaned of personal information before they leave our servers. No system is perfect: if something goes wrong that affects your family, we will tell you.

Cookies and similar storage

Whyland uses only these cookies, and none for advertising:

The game also keeps the explorer and settings in the browser's local storage, as described in What stays on the device.

Changes to this notice

When we change this notice, we update the version and date at the top. If a change affects what we collect from children or how we use it, we email parents with family accounts first, and ask for consent again where the law requires it.