Tadpole Games is built for children, so we collect as little as we can. We don't show ads, we never sell or rent your data, and we don't track you across other websites or apps. Your game progress stays on your own device. If a parent creates an account, we hold that email address, the account's Premium status, and a record of when the account last played and which games it played, and you can delete all of it at any time. Our apps, and our website once you accept analytics cookies, also send us a daily note of which games a device played, under a random identifier rather than a name. Meta learns when our apps are installed, opened and used to buy a subscription, so that we can measure our own adverts. Sections 3 and 5 set out everything we collect and who receives it.
This policy explains what information Tadpole Games collects, why, and what your rights are. It applies to our website at tadpolegames.com and our mobile apps.
Tadpole Games is a service operated by Difflex Ltd, a company registered in England and Wales under company number 09803430 (trading as "Tadpole Games"), whose registered office is at First Floor North, 40 Oxford Road, High Wycombe, Buckinghamshire, HP11 2EE. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), Difflex Ltd is the data controller for the personal data described in this policy.
You can reach us about anything in this policy, including privacy requests, at hi@tadpolegames.com.
Our games are designed to be played by children, with the educational content (phonics, maths, languages and geography) aimed at primary-school ages. We take that responsibility seriously and follow the principles of the UK Information Commissioner's Age Appropriate Design Code (the "Children's Code").
Children never need an account of their own, and we do not ask children for any personal information. In our mobile apps, the free puzzles can be played without signing in and without giving us a name, an email, or anything else. On the website, a parent or guardian signs in before play starts. Accounts and payments are for adults only (a parent or guardian); see "Eligibility" in our Terms of Use. We do not knowingly collect personal data directly from a child. While the games are played, our apps do send the play and setup counts described in section 3d, which carry a random device identifier and no name. Meta's measurement kit in our apps also sends Meta install, launch and purchase events from the device, as section 5 describes. If you believe a child has provided us with personal information, please contact us and we will delete it.
As you play, the game saves your progress in your browser or app's local storage, for example your chosen difficulty, which puzzle you're on, the words you've found, and your gentle accomplishment stats. The same place holds a sign-in token if you've signed in, and a cached copy of your Premium status.
This information stays on your device, and it isn't used to build a profile of anyone. The one exception is a random identifier kept in the same place, which our own play and setup counts send to us (see section 3d). On the website that identifier is only created after you accept analytics cookies. You can clear all of it at any time by clearing your browser's site data, or by deleting the app.
Premium is optional. If a parent chooses to subscribe, we handle a small amount of personal data so we can give you access and manage your Premium subscription:
We do not see or store your card number. All card details are handled directly by our payment processor, Stripe (see below).
A free account lets you try each Premium game once. On the website you need one to play; in our apps it is optional. To provide it we use your email address: to send the one-tap "magic link" you sign in with, and as the key to your account (we also store a one-way hashed SHA-256 form of it as the lookup key). If you sign in with Apple or Google instead, they give us your email address for the same purpose, and they may also share the name on that account. We don't store that name. We record the date you signed up, how the account was first created (for example by email link, Apple or Google) and whether that was in our iPhone or iPad app, our Android app or on the website, the language your device was set to and the country you were in when the account was created (such as English, United Kingdom), and, only when it was, that the account was created from Google's or Apple's own network (which is how their app reviewers and test devices connect), when you last signed in, when you finished the first-run setup, which Premium games the account has used its one free try on, and your email preferences. While you're signed in, we also add a record of your play to the account, described in section 3d.
Marketing emails. We don't currently ask you to sign up for occasional emails about new games and learning tips when you sign in. If you agreed to receive them before, they stay separate from the essential sign-in and Premium emails, and you can unsubscribe at any time using the one-tap link in every marketing email, or by emailing hi@tadpolegames.com. We never share your email with other companies for their own marketing.
/get), which holds no games and does nothing but pass you on to the App Store or Google Play: so we can tell whether an advert worked, that page sends Google a single anonymous count of the visit, with no cookies, nothing stored on your device, and none of Google's own software loaded, and shows no banner because it forwards you on immediately. In Google Analytics, Google Signals and all advertising features are switched off: the data is not used to identify you, for advertising, or to build advertising profiles.Our Colour It and Draw It games, which are on the website only, let a signed-in Premium user turn a photo of their own into a black-and-white colouring page or a step-by-step drawing sheet. When you choose a photo and ask for a page or sheet, the photo is sent securely to our AI partner, Google's Gemini model reached through the AI gateway OpenRouter, which redraws it as outlines and sends the drawing back. We finish the page or sheet in your browser.
We do not store your photo, and we do not store the finished page or sheet unless you choose to share it (see "Sharing to the community" below). Your photo is passed straight to the AI to be processed and is then discarded: we don't write it to disk or to any database. So that the same photo can't be charged for twice, our server briefly keeps a one-way hash (a scrambled fingerprint that can't be turned back into a picture) for a minute or two; it holds no image. To apply the monthly limit on pages and sheets, we also keep a count of how many each account has made that month, stored against a one-way hash of the account's email address and deleted automatically 35 days after it was last updated.
This AI processing happens on our providers' servers, which are outside the UK, in the United States (see section 6). Google and OpenRouter may hold the image briefly for their own safety and abuse checks, under their own privacy policies (OpenRouter, Google).
Sharing to the community. If you tap Share to the community on a finished page or sheet, we do store that picture, with the name you give it, the box (category) you put it in, the time, and a one-way hash of your email address. A separate count, kept against the same hash for two days, limits how many pictures one account can share each day. The picture is emailed to a grown-up at Tadpole Games to review, and nobody else can see it until they approve it. If they reject it, we delete the picture but keep a record that it was shared (its name, the box, the time and the hashed email address). If they approve it, it appears on that game's page for everyone who visits, without your name or email. Deleting your account does not remove a picture you have shared, so email us if you would like one taken down. Your original photo is never shared.
Photos of children. A photo is chosen and uploaded by the adult account holder. Photos may show children, so please only upload images you have the right to use. You don't need a photo of your child's face: pets, toys, drawings and objects work just as well. Because we don't keep the photo, there is nothing for us to retain about anyone pictured in it. A drawing made from a photo can still look like the person in it, so please bear that in mind before sharing one.
We do not use advertising or cross-site tracking cookies. We use your device's local storage to remember your game progress and your cookie choice, and to keep you signed in. It also holds the random identifier that our own play and setup counts send (see section 3d); on the website, that identifier is only created after you accept analytics cookies.
Analytics cookies (optional, with your consent). On the website, if you accept the cookie banner, Google Analytics sets its _ga cookies so we can count visits and see which games get played. If you decline (or simply ignore the banner), Google Analytics is never loaded, no analytics cookies are set, and our own play and setup counts are not sent. The games work exactly the same either way. Our advert landing page (/get) is the one place that measures without asking: it only forwards you to the app stores, and counts that visit cookielessly: nothing is written to or read from your device, so there is no cookie choice to make there. Cloudflare's analytics remains cookieless regardless. You can change your mind at any time: .
We never sell, rent, or trade your personal data. We share the limited data above only with the trusted service providers that help us run Tadpole Games, and only so they can perform that service for us:
We may also disclose information if we are legally required to do so, or to protect the rights, safety and security of our users and our service.
Some of our service providers (such as Stripe, Cloudflare, OpenRouter and Google) are based in, or process data in, countries outside the UK including the United States. Where personal data is transferred outside the UK, it is protected by appropriate safeguards, such as the UK's International Data Transfer Agreement or Addendum, or the providers' approved data-transfer frameworks.
Under UK GDPR, we rely on the following legal bases:
We keep your account and Premium data for as long as you have an account or Premium subscription with us, and for a limited period afterwards as needed for accounting, tax and fraud-prevention. You can delete your account at any time from the Account page (this cancels any active subscription, removes your account record, and removes you from our marketing list). After a deletion we keep a one-way hash of your email address and the time of the deletion, with no expiry, so that a late message from a payment provider, or a device that is still signed in, cannot recreate the account. It is cleared if that email address signs in or pays for Premium again. If you only unsubscribe from marketing emails, we keep a minimal record of that choice so we can honour it. Information stored on your device stays until you clear it or delete the app. Payment records held by Stripe are retained under Stripe's own policy and applicable law. Our own daily play and setup counts (section 3d) are deleted from our main database automatically 540 days (about 18 months) after they are recorded, by a job that runs every day. We keep our own copy of those counts for longer than the 540 days, on a computer of ours, so that we can compare one season or one year with another; that copy holds the same information, with no name, email or precise location in it, and it is never shared. The play record on a signed-in account is part of the account record, so it is removed when you delete your account. Deleting your account also removes the account identifier from every play, setup and in-game record sent while you were signed in, in our main database and in our copy; those records then stay, without it, for the periods above. We record the one-way hash of a deleted account with the time of the deletion, with no expiry, so that a device still signed in cannot add the identifier back. The IP addresses in our request counters are deleted within one hour of the last request from that address. A picture you shared to the community stays until we remove it, which we will do if you ask.
You have rights over your personal data under UK data protection law, including the right to:
To exercise any of these rights, email hi@tadpolegames.com. You can also delete your account yourself at any time. We won't charge you for a request or treat you differently for making one.
If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to put things right first.
We design for safety: minimal data collection, payments handled by a specialist processor, your Premium subscription stored against a one-way hash of your email, and sign-in by short-lived links rather than passwords you have to remember. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information.
We may update this policy from time to time, for example if we add a feature or change a service provider. When we do, we'll update the "Last updated" date at the top of this page. Significant changes affecting Premium users may also be notified by email.
Questions, requests, or concerns about your privacy? Email us any time at hi@tadpolegames.com. We're a small UK team and we read everything.