Privacy policy

Numi Isles is a free maths game for primary school children in Singapore, played at play.numinumi.app, with this website at numinumi.app. It is run by Out There Studio Pte. Ltd. (UEN 202648096N) in Singapore (“we”, “us”). We are responsible for the personal data described in this policy under Singapore’s Personal Data Protection Act 2012 (PDPA).

Our Data Protection Officer answers every privacy question and request. Write to support@numinumi.app.

A grown-up account is for a parent or guardian. Nobody has a password: you sign in with Google or with a one-time code we email you.

• Your email address, to create your account and to send you sign-in codes. The only emails we send are sign-in codes. The email says which kind of device asked for the code and roughly where it was (the city), so you can spot a code you did not ask for.
• Your name (what your kids call you). Your kids see it on cheers and on their Me screen, and another grown-up of the same kid sees it too. Other kids never see it.
• If you choose Google sign-in: your Google account’s id, your email address and that Google has verified it. That is all we ask Google for: not your name, and never your Google password, contacts or photos.
• Your signed-in devices: the kind of device and browser (such as “iPhone · Safari”, worked out from what the browser says about itself), how you signed in, and when the session started and was last used. You see and sign out your other devices in Settings.
• What you do for your kids: the kids you add, the settings you choose for them, the friend requests you approve, the stickers and short messages (up to 80 characters) you send them, sign-in links and invites you make, and the notes we show you (for example “signed in on an iPad”).

When you approve a kid’s device, we compare your rough location (city and country) with the device’s, to warn you when it seems far away. We use your location for that moment only and never store it.

Kids have no email address, username or password. Everything below is used to run the game, to pick questions at the right level, and to show her grown-ups how she is doing.

• Her profile: a nickname (up to 16 characters; we ask for a nickname, not her full name), her Primary level, the Numi she chose and her friend code.
• Her learning: for every round, the questions she was given, her answers, whether they were right, how long each took and the hints she opened; and from these, her stars, mastery, XP, level, streak, badges, missions and the minutes and rounds she played each day.
• Her game: the Numi she has collected, their outfits and her shells (pretend money with no real value).
• Her settings: sound, music, volume and read-aloud speed, and her timezone (Singapore unless changed), so her days start at her midnight.
• Friends and play (unless her grown-up turns friends off): her friends and friend requests, her races (the questions, her score and her times), the stickers she sends, her milestones on the activity feed, her Friend League results and her inbox.
• Her signed-in devices: the kind of device and app or browser, how it was signed in and when it was last used, so her grown-ups can sign a lost device out.
• A device asking to sign in: the kind of device, its rough location (city and country, from our network provider Cloudflare) and, for a brand-new kid, the nickname, level and Numi she picked. Her grown-up sees these before saying yes.

We do not collect a kid’s full name, birthday, school, address, phone number, email, photo, voice or precise location. Numi Isles never uses the camera, the microphone or location services. Read-aloud uses the voice built into her device or browser; on some browsers that voice comes from the browser maker’s online service, which then receives the text being read (questions, never her details).

Every kid account is made by a grown-up: in the grown-up area, or by approving the code a new kid’s device shows. A kid cannot get an account alone. What she picks on her own device (a nickname, a level and a Numi) only waits for her grown-up’s approval; if nobody approves it, it is deleted (see How long we keep data).

When you make a kid’s account, or approve a new kid’s device, the app asks you to confirm that you are her parent or guardian, or have their permission. In doing so you consent on her behalf to us using her data as this policy describes. You consent for yourself by signing in.

You can withdraw consent at any time: turn off friends for her, sign her devices out, or delete her account or yours in the grown-up area (see Seeing, correcting and deleting data). Without the data we cannot run her account, so withdrawing consent for everything means deleting it.

• No advertising, of any kind, anywhere in the app or on this website.
• We never sell personal data, and never share it for marketing or advertising, or for anyone to train AI models.
• No tracking: no analytics tools, advertising networks, social media plug-ins or other outside scripts, in the app or on this website. Our pages load only from our own sites.
• No free-text chat between kids. Kids can only send each other friend requests, race challenges and preset stickers (high five, wow, star, go go go). Only a kid’s own grown-ups can send her a short written message.
• No public profiles and no search. Kids become friends only by typing a friend code shared in person, and her grown-up can choose to approve every new friend.
• Nothing about a grown-up (name or email) is ever shown to other kids.

• Her grown-ups (at most two): everything about her progress, including her recent mistakes with her answers, her devices and her settings. They also see each other’s names, never each other’s email.
• Her friends: her nickname, Numi and outfit, Primary level, game level, streak, badges, how many Numi she has, her XP this week in the Friend League, her milestones and her race results. Never her answers or her grown-ups.
• A kid who types her friend code, or gets a friend request from her, and that kid’s grown-up if they approve friends: her nickname and her Numi.
• Nobody else. We only look at personal data ourselves when we need to, for example to answer your request or to fix a problem.

A few companies run parts of Numi Isles for us. They handle data only to provide their service to us.

• Vultr runs our server, in Singapore.
• Neon runs our database, in Singapore. Everything described above is stored there.
• Cloudflare delivers the app and this website and protects them from attacks: every visit passes through Cloudflare’s network, which sees your IP address and what is sent, and tells us your rough location (used only as described above). Cloudflare also hosts this website. It sends our sign-in emails, so it receives your email address and the email’s content, and it passes on the emails you send to our numinumi.app address. Our nightly database backups are stored with Cloudflare R2 (in its Asia-Pacific location), encrypted before they leave our server with a key only we hold, so Cloudflare cannot read them.
• Google, only when a grown-up chooses “Continue with Google”. Google then knows that you signed in to Numi Isles.

We do not share personal data with anyone else, unless the law requires it (for example a lawful request from the authorities) or it is needed to protect a child’s safety.

This website (numinumi.app) sets no cookies and keeps nothing on your device. The app uses only cookies that are strictly needed for signing in and keeping it safe. None is used for tracking or advertising, and scripts on the page cannot read them. In the app their names start with “__Host-”.

• numi_session keeps you signed in: 30 days for grown-ups and 90 days for kids, renewed while the device is used.
• numi_device_request is a private ticket while a kid’s device waits for her grown-up to approve it (about 15 minutes).
• numi_oauth protects a Google sign-in while it is in progress (10 minutes).
• numi_device is a random number, set when someone types a sign-in code on the device, so we can slow down anyone guessing codes (1 year).

If Cloudflare ever needs to check that a visitor is a person (for example during an attack), it may set its own short-lived security cookie. It is not used for tracking.

The app also keeps a few things in the browser’s own storage on the device: sound and music settings, how each island looked last time (for the colour coming back animation), and the answers of a round, race or dash until they reach us (at most a week). Signing out removes the island looks and the answers from the device at once; when a grown-up signs the device out or deletes the account, the app removes them as soon as it is next used. Only the sound and music settings stay, as they say nothing about who played. The installed app stores its own files so it opens quickly. Clearing the browser’s data for play.numinumi.app removes everything.

• Accounts and progress are kept while the account exists, so she can pick up where she left off.
• Deleting a kid’s account: her grown-up deletes it in her settings (when she has two grown-ups, the one who invited the other does). It goes at once, with everything about her: her progress, every question and answer, her Numi, friends, races, stickers sent and received, her devices, sign-in links and the notes about her. Her friends simply stop seeing her, and their Friend League results no longer list her.
• Deleting your own account: in Settings, once each of your kids has another grown-up (or after deleting their accounts), since every kid account needs a grown-up. It goes at once, with how you sign in, your notes, the stickers and messages you sent your kids, and the sign-in links and invites you made.
• Backups: we keep encrypted nightly backups for 29 days, and our database provider keeps a few hours of short-term history, so every copy of deleted data is gone for good within 30 days of a deletion. You can also ask us to delete an account (see Seeing, correcting and deleting data).
• A grown-up leaving a kid’s family (possible when she has another grown-up) loses access at once; their notes about her and their unused sign-in links and invites for her are deleted.
• Signed-in sessions end when you sign out (deleted at once) or after 30 days (grown-ups) or 90 days (kids) without use. Ended sessions stop working at once and are deleted within the hour.
• Email codes work for 10 minutes and are deleted when used. An unused code (with the email address it was sent to) is deleted within the hour after it stops working.
• A device asking to sign in: its rough location is deleted the moment the grown-up says yes or no, or within the hour after the request ends (10 minutes) when nobody answers. The request itself, with any nickname, level and Numi a new kid picked, is deleted a day after it ends.
• Sign-in links and invites are stored only in scrambled form and deleted a day after they end.
• Security counters (how many codes were asked for or tried from an IP address, a device or an account, or for an email address) are kept only in the server’s memory, for at most a day, and never written to disk.
• Server logs record errors so we can fix them: what kind of error, where in our code and which action failed, with a random request number. They never record what anyone typed or what we store about them (emails, names, answers, messages), IP addresses or visits. They are rotated: the oldest entries are overwritten after about 50 MB.

You can ask us for a copy of the personal data we hold about you or your kid, how we have used it in the past year, to correct it, or to delete it. Many things you can do yourself in the grown-up area: change your name, your kid’s level and settings, see and sign out devices, turn friends off, and delete your kid’s account or your own (see How long we keep data).

For everything else, write to support@numinumi.app from the email address of your grown-up account, so we know the request comes from you. We answer within 30 days (and tell you if we need longer), free of charge. If we cannot do something, we will say why.

• Everything travels over encrypted connections (HTTPS).
• No passwords to steal. Sign-in codes, links and session keys are random, short-lived and single use where they let someone in, and we store them only in scrambled form (hashes).
• Strict limits on how many times anyone can try a code.
• Sign-in cookies cannot be read by scripts or used by other websites, and every change must come from our own site.
• A grown-up only ever sees their own kids. Approving a device shows what it is and where it seems to be, and asks again when it seems far away. Grown-ups can sign any of their kid’s devices out.
• Our server has no open web ports: the app is reachable only through Cloudflare’s secure tunnel. Administrator access needs a private key (no passwords), and security updates install every day.
• If a data breach ever puts you at risk of significant harm, we will tell you and the Personal Data Protection Commission, as the PDPA requires.

Numi Isles is made for children of primary school age, so we collect as little as we can about them and design every feature with their safety in mind: no ads, no chat, no strangers, friends only by codes shared in person, nicknames checked against a list of rude words, and grown-up controls for friends.

We never knowingly keep a child’s data without a grown-up’s consent. If you think we do, tell us and we will delete it.

Our server and database are in Singapore. Cloudflare may handle a visit or an email in another country (usually its data centre nearest to you), and Google handles Google sign-ins on its own servers around the world. When data leaves Singapore this way, these providers protect it to a standard comparable to the PDPA under their data protection terms.

When we change this policy we update this page and the date at the top. If a change matters (for example a new kind of data or a new provider), we will tell grown-ups clearly in the app before it applies.

Write to our Data Protection Officer at support@numinumi.app with any question, request or complaint. If you are not happy with our answer, you can contact Singapore’s Personal Data Protection Commission.

Terms of use

The rules for using Numi Isles are in our Terms of use.