Privacy Policy

1. Who We Are

Avalon Heroes is an educational action-RPG developed by Avalon Studios ("we", "us", "our"). This policy describes how we collect, use, and protect information when you use our website and related services (collectively, the "Service").

Contact: avalonheroesgame@gmail.com
For privacy matters: avalonheroesgame@gmail.com

2. Who This Policy Applies To

• Teachers / Educators: adults who create accounts to host sessions and build quizzes.
• Students (13+, self-registered): students who create their own accounts directly using their own email address.
• Students (teacher-created accounts): for students who don't have their own email - commonly younger students - a teacher creates and manages an account on the student's behalf, using a username and a system-generated password. No email address is collected for these accounts. The teacher's action to create the account, taken in their capacity as a school official acting for the school, serves as the required consent under COPPA's "school official" exception on behalf of the student's parent/guardian - see Section 4 for the conditions that come with that.
• Visitors: anyone who browses the public website without signing in.

3. Information We Collect

Account information (teachers and students 13+):

• Email address (used for authentication, including Google Sign-In if you choose that option)
• Display username (chosen by the user)
• Account role (student or teacher)
• Age verification flag: we store a boolean "age verified" flag, not your date of birth

Account information (teacher-created student accounts):

• Display username (chosen by the teacher or student - not the student's real name)
• A system-generated password, stored only as a salted hash - we never store or can see the plain-text password
• Account role (student)
• A link to the creating teacher's account, so that teacher can view, reset, deactivate, or delete the account
• Gameplay and progress data tied to the account (see "Usage data" below)
• No email address is collected unless and until a teacher enables the student to convert the account to an independent, self-managed one - at which point the student is prompted to add and verify their own email before the account is treated as a self-registered (13+) account.

Usage data (automatically collected):

• Server logs (IP address, browser type, pages visited), retained for up to 30 days for security purposes
• Session activity within the game (scores, quiz answers, session participation), only when the game server is active

We do NOT collect:

• Real names (usernames only)
• Physical addresses
• Phone numbers
• Payment information (the Service is currently free)
• Behavioural tracking or advertising profiles

4. Children Under 13 (COPPA)

When a teacher creates a student account under this exception, we commit to:

• Collecting no email address or real name for that account
• Using the data collected (username, gameplay/progress) solely to provide the Service to that teacher's class - never for advertising, profiling, or any other commercial purpose
• Never sharing that data with third parties beyond the hosting providers listed in Section 7
• Giving the teacher full control to view, reset the password of, deactivate, or delete the student's account at any time from their dashboard
• Deleting a student's account and data entirely on request from the teacher, the school, or a parent/guardian who contacts us directly

Teachers are responsible for confirming they're authorized by their school to create these accounts for their students, and for meeting any additional notice or consent requirements their school or district has in place. The direct, email-based sign-up flow described above is intended for students 13 and older; if a student uses it and we discover they are under 13, we will delete the account and its personal information promptly. If you believe a child under 13 has submitted personal information to us outside a teacher-managed account, contact us immediately at avalonheroesgame@gmail.com and we will delete it.

5. Student Data (FERPA)

We are aware of our obligations under the Family Educational Rights and Privacy Act (FERPA). Student education records and any data generated through classroom use are:

• Used only to provide and improve the Service
• Not shared with third parties for commercial purposes
• Not used to build advertising profiles
• Accessible to the relevant teacher and the student themselves

Schools or districts requiring a formal Data Processing Agreement (DPA) should contact us at avalonheroesgame@gmail.com.

6. How We Use Your Information

• To create and manage your account
• To run classroom sessions and store quiz data
• To allow teachers to view session results for their own students
• To send transactional emails (account confirmation, password reset). No marketing emails.
• To maintain security and prevent abuse
• To improve the Service based on aggregated, anonymised usage patterns

7. How We Share Your Information

We do not sell your data. We share data only with:

• Netlify: website hosting. See Netlify's Privacy Policy.
• Railway: application server and database hosting. See Railway's Privacy Policy.
• Google: only if you choose "Sign in with Google" instead of a password. See Google's Privacy Policy.
• Law enforcement: only when legally required and to the extent mandated by applicable law.

8. Data Retention

• Account data is retained while your account is active.
• You may request deletion at any time (see Section 10).
• Server logs are retained for up to 30 days.
• Anonymised, aggregated analytics may be retained indefinitely.

9. Security

We implement reasonable technical and organisational safeguards including HTTPS encryption, JWT-based authentication, HTTP security headers, and access controls. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

10. Your Rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data (via account settings or by contacting us)
• Delete your account and associated data
• Withdraw consent where processing is based on consent
• Data portability: receive your data in a machine-readable format

To exercise any of these rights, email avalonheroesgame@gmail.com. We will respond within 30 days.

11. Cookies

We do not use cookies at all: no advertising cookies, no tracking cookies, no analytics cookies. Signing in stores an authentication token in your browser's localStorage to keep you signed in. This is strictly necessary for the Service to function and does not require consent under most cookie regulations.

12. Third-Party Links

The Service may contain links to YouTube (embedded dev videos) and other external sites. We are not responsible for the privacy practices of those sites. YouTube embeds are loaded only when you choose to play a video.

13. Changes to This Policy

We may update this policy as the Service grows. We will notify teachers via email if we make material changes. Continued use after notice constitutes acceptance of the updated policy. The "last updated" date at the top reflects the most recent revision.

14. Contact Us

For any privacy questions or requests:
avalonheroesgame@gmail.com
avalonheroes.com