Privacy notice

Last updated: July 25, 2026. This is a plain-language summary, not legal advice.

Who we are

Axo Alley (“we”, “us”) is a learning arcade and virtual pet hangout for children ages 7–12, operated at axolalley.com. Parents and teachers may create accounts; kids play on the device without passwords or email.

What we collect

Kid play data stays on the device by default (browser storage). Optional cloud backup stores a game snapshot when a parent signs in.
Parent/teacher accounts: email address, optional name, password hash if set, and sign-in provider identifiers (Google or school SSO when enabled).
Kid profiles: display name, grade preset, game progress, pets, decor, and learning stats — linked to the parent account when cloud sync is on.
Classroom mode: class name, join code, parent-approved enrollments, assigned quests, and aggregated learning stats for teachers.
We do not collect kid email addresses, phone numbers, or precise location. We do not run behavioral advertising or sell personal information.

Children’s privacy

Kids never create their own accounts or enter email.
Cloud features require a parent or guardian to sign in and approve classroom links.
Friend circle (max 4) allows emoji and treat gifts only — no chat or stranger contact.
Parents can use local-only play without any account.

How we use information

Run the learning games, virtual pet economy, and optional classroom features.
Show parents and teachers progress summaries on /parents and /classroom.
Send magic-link sign-in emails when a parent requests them.
Maintain security, rate limits, and optional pseudonymized learning telemetry when enabled.

Retention and deletion

Local device data can be cleared by removing site data in the browser.
Signed-in parents can manage profiles in Settings.
School organizations may use scoped student-data export and deletion APIs (see DPA for school contracts).
Inactive guest cloud profiles may be purged after a configurable inactivity window.

Your rights (Canada / schools)

Canadian users: access, correction, and withdrawal of consent where applicable under PIPEDA.
School boards: student education records are limited to school officials with legitimate educational interest; audit logging is available for org tenants.
Contact us to request access, correction, or deletion of cloud data tied to your parent account.

Security

We use HTTPS, hashed passwords, optional row-level security for school tenants, and rate limits on sensitive APIs. Operators must configure production secrets and a non-superuser database role for multi-tenant deployments.

Changes

We may update this notice. The “Last updated” date at the top will change when we do. Continued use after an update means you accept the revised notice.

Contact

Questions about privacy or a school data agreement: privacy@axolalley.com. School boards: see our About page and request the DPA template.