Privacy Policy

1. Who runs Wizarding Quizbook

Wizarding Quizbook (“the App”) is operated by Premier 99 Software LLC (“we,” “our,” “us”), a small US-based company that builds reading tools for kids. We can be reached at hello@wizardingquizbook.com.

2. What we collect, and why

We try hard to collect as little as possible. Everything below is what is actively used to run the app.

From the parent’s account

• Email address. Used as the login identifier and to send password reset messages. Not used for marketing.
• Hashed password. Stored by our authentication provider (Supabase). We never see your raw password.

From the child’s wizard profile

• Wizard name. Whatever first name or nickname the parent typed during sorting. We do not require a real name.
• Chosen house (Emberwing, Tidecaller, Thornroot, or Starforge).
• Reading progress. Which sight words have been practiced, how many times, and the resulting mastery level (0–5).
• Session timestamps. When practice happened and how long it lasted, used to draw the parent dashboard’s weekly chart and award reading streaks.
• Wizard level & collected creatures. Game progression markers tied to the child’s profile.

From the device

• App settings (sound on/off, haptics on/off, sparkle intensity, parent settings like daily limits) are stored on the device only, in the secure keychain. They are not sent to our servers.

From the App Store / Google Play

• Subscription status from RevenueCat (whether the “Grand Wizard” subscription is active). RevenueCat receives an anonymous user id, the purchase event, and the platform receipt — never the child’s name, email, or any reading data.

What we do not collect

• No advertising identifiers (IDFA, AAID).
• No third-party analytics SDKs.
• No browsing history, location, contacts, photos, microphone audio, or biometrics.
• No social-network linking. No friends lists. No public profiles.

3. Information from children under 13

The App is designed for ages 5–9 and is built to comply with COPPA. Account creation and all in-app purchases are gated behind a parent-only flow that requires solving a basic multiplication problem (e.g., 8 × 7) — this prevents a child from creating an account or making a purchase without an adult present.

We collect the absolute minimum from a child’s profile: a wizard name (first name or nickname only), a chosen house, and reading progress. We do not collect a real name, photograph, voice recording, location, contact information, or any persistent identifier beyond the internal profile id needed to save progress.

Reading progress is used solely to power the app’s lesson loop, parent dashboard, and creature unlocks. It is never used for advertising, recommendations, or any third-party purpose.

4. How we use information

• To run the app: route the child to the right reading level, save mastered words, draw the parent dashboard.
• To honor your subscription and support purchases / refunds.
• To respond to parent requests for access, deletion, or support.
• To detect abuse or platform misuse where that’s required for security.

We do not use the information for advertising, profiling, or behavioral targeting.

5. When we share information

We share information only with the small set of vendors required to run the app:

• Supabase — our database and authentication provider. Stores parent email, child profile, and reading progress in a Postgres database with row-level security enabled.
• Apple App Store & Google Play — process the subscription and handle billing.
• RevenueCat — receives subscription events from the stores so we can show the right entitlement state in the app. RevenueCat does not receive child profile data.

We do not sell information. We do not share it with advertisers, brokers, or analytics companies. We will only disclose information to law enforcement when legally required and, whenever permitted, after notifying the affected parent.

6. How long we keep it

We keep account and progress data while the account is active. If you delete the account (see Parent rights below), we delete the parent record, all child profiles, all reading progress, and all session history within 30 days. Backups are rotated every 30 days, after which the data is permanently gone.

7. Parent rights & choices

As a parent, at any time you can:

• Review your child’s data via the Parent Dashboard inside the app.
• Edit or delete your child’s wizard name, house, or progress by emailing hello@wizardingquizbook.com from the email associated with the account.
• Delete the entire account (parent + all child profiles) by emailing the same address. We confirm and act within 30 days.
• Withdraw consent for further data collection by deleting the account. Past data is removed as described above.

8. Security

Data is encrypted in transit (TLS 1.2+). Database access is governed by row-level security — a parent’s account can only read or write its own children’s rows. Authentication is handled by Supabase, which stores only hashed passwords. We do not store payment card numbers; those live with Apple, Google, and RevenueCat.

9. Changes to this policy

If we change this policy in a way that materially affects what we collect or how we use it, we will email parents at the address on file and update the “Last updated” date at the top of this page. Continued use after notice means acceptance of the new terms.