FOR GROWN-UPS

Privacy Policy

Last updated October 26, 2026

Small Mighty Words is a learning game operated by Storyfaire LLC, an Oregon limited liability company. This policy covers our website, apps, parent accounts, player profiles and related support services. It explains information collected about adults and about players, including children.

1. Parents and children

An adult manages the family account. A parent or legal guardian should manage a child's participation. Players can use a nickname and a character avatar; please do not enter a child's full name, school, address or contact details as a player name or public name. Children do not need their own email address or Google account.

We collect gameplay information when children play, as described below. We do not sell personal information or use children's learning records for targeted advertising. We do not ask children to upload personal photos, provide a date of birth or record their voice. A parent account, Google sign-in or parent PIN is an account-security feature, not a substitute for verifiable parental consent where required. Agreeing to our Terms does not waive children's privacy rights.

Parents can contact us to review, correct or delete a child's information, or refuse further collection or disclosure. We may verify account ownership and parental authority before releasing information or making changes. Contact us promptly if a child has created an adult account or provided identifying information without authorization. Removing information necessary for cloud progress or community participation may prevent those features from working; we will explain the available options.

2. Information we collect

• Adult accounts: email address, account identifier, verification and sign-in history, account settings and a hashed password for email/password accounts. We cannot retrieve your original password. Google sign-in supplies an account identifier, email address and, when supplied, your display name. We do not receive your Google password.
• Players and learning: player nickname, public game name, selected avatar, lessons and words visited, answers, mistakes, completed definitions, scores, streaks, unlocked levels and settings. These records support saved progress, synchronization and parent reports.
• Purchases and referrals: transaction identifiers, products, amounts, payment status, access rights, invitation identifiers and qualifying referral events. Payment providers handle card details; we do not store full card numbers or card security codes. A provider may retain a payment method when you authorize it.
• Community features: public game names, avatars, friend requests and connections, team or rally membership, scores and reward records when these features are used.
• Technical and usage records: IP address, broad device/browser and operating-system information, requested pages, sign-in times, active time, gameplay events, error and security logs, entry pages, referring sites and campaign tags. Approximate country or region may be inferred from an IP address. This is not precise GPS tracking.
• Support: messages and attachments you choose to send. Please avoid unnecessary information about children or sensitive documents.

3. Why we use information

We use information to operate accounts, authenticate adults, save progress across supported devices, show learning reports, provide paid or earned access, process referrals, deliver requested community features, answer support requests, recover accounts, diagnose bugs, measure usage and protect against fraud and unauthorized access. Purchase records also support accounting, refunds and legal obligations. We do not use learning reports to make medical or developmental diagnoses.

4. Analytics and session replay

We use PostHog for usage and diagnostic analytics, including page visits, sign-in and activity events, campaign attribution and approximate location. Events may be associated with a parent-account identifier. An identifier is not the same as anonymous information. Our analytics configuration uses account identifiers rather than player names for identification and removes query strings from captured URL fields.

Session replay is currently disabled for the website and apps through our shared configuration. We are not starting new recordings of screen activity. This does not disable ordinary gameplay records, security logs or usage events. Previously collected beta recordings are not automatically deleted by switching recording off; contact us about access or deletion requests. If we introduce replay again, we will explain its scope and obtain any required permission before recording. Replay does not provide permission to access your microphone or camera.

Our website honors the browser Do Not Track setting for PostHog collection. Essential account, purchase, security and saved-progress operations continue. Device-storage controls may also limit analytics, but clearing storage can remove settings or unsynchronized progress.

5. Information other players can see

Optional community features display a public game name, avatar, score and level. The public name can be selected by the account holder or generated by the game. It may be searchable by other players, so use a non-identifying nickname. Friend requests require acceptance. Community features do not display the parent's email address. We do not offer player chat or precise-location player search. Simulated competitors are labeled as demo players.

Invitation links contain a referral identifier. People you share a link with, and the platform you use to share it, can see that link. We do not require you to upload your address book. Share invitations only with people who would welcome them.

6. Email

We send verification, password-reset, purchase, security and other service messages to the adult account email. As disclosed on our current signup screen, a free parent account also adds that address to Small Mighty Words game-news updates. The mailing list uses adult email addresses, not children's names or learning records. Marketing messages include an unsubscribe link; you can also email support to stop them. Unsubscribing does not delete your account or stop necessary service messages. Where applicable law requires prior marketing consent, that permission must be obtained separately; this policy is not a substitute for it.

7. Providers and other disclosures

Our providers process information needed to perform their services:

• DigitalOcean: server hosting and storage for account and game services.
• Cloudflare: domain, network security and content-delivery services.
• PostHog: usage and diagnostic analytics.
• Resend: account emails and the separate SMW marketing audience and sender.
• Google: Google authentication when you choose that sign-in method.
• Stripe: website checkout and payment processing. Apple and Google process purchases made through their stores when those purchase options are available.

Authorized Storyfaire staff access information for support, administration, security and service improvement. We may disclose information to professional advisers, where legally required, to address fraud or safety threats, or during a business transfer subject to applicable privacy protections. Providers and external websites may also have their own privacy terms. Contact us for information about providers handling your child's data.

8. Cookies, local storage and international processing

Session cookies keep accounts signed in. Browser or app storage saves preferences, player data awaiting synchronization and cached media. Authentication and analytics providers may use cookies or similar identifiers. Signing out does not necessarily remove local progress. Clearing app or website data can remove unsynchronized progress.

Storyfaire operates in the United States. Our providers may process information in the United States and other countries, whose laws can differ from those where you live. Where applicable law requires safeguards for international transfers, those safeguards must apply; use of the service alone does not waive those requirements.

9. Retention, deletion and security

Account and learning records are retained to maintain the family account, synchronize progress and provide reports. Community records support participation and reward history. Transaction records support access rights, accounting, disputes and fraud prevention. Support and diagnostic records are retained for the issues and operational purposes they serve. We retain information only for its stated purposes or applicable legal obligations, not for unrelated future uses.

The account-deletion process requires email confirmation and provides a 30-day cancellation window before scheduled deletion of the family account and associated cloud player data. For a child's data request, refusal of further collection or an urgent privacy issue, contact support directly instead of relying only on that workflow. We handle statutory requests within applicable deadlines.

Deletion of cloud data does not erase copies on your own devices. Necessary accounting, security, legal and unsubscribe-suppression records may remain for their limited purposes. Backups and provider copies may persist temporarily under their retention processes. Contact us for information about the retention applicable to your records. Switching off replay does not itself erase historical recordings.

We use HTTPS, password hashing and restricted administrative access. No security measure guarantees absolute protection. Please report suspected unauthorized access to support.

10. Privacy rights

Depending on applicable law, you may request access, correction, deletion or a portable copy of information, object to or restrict processing, withdraw consent, or complain to your local privacy regulator. We may need to verify your identity or authority, but will not ask for your password. We do not charge for ordinary privacy requests or discriminate against you for exercising applicable rights.

For users in the EEA, United Kingdom or Switzerland, applicable processing grounds can include providing the adult's requested contract, legitimate interests in security and service operation where appropriate, compliance with legal obligations, and consent where required. These grounds do not override special protections for children or consent requirements for tracking or marketing.

11. Contact and changes

Storyfaire LLC is responsible for the SMW information described here. Email support@storyfaire.com, or write to Storyfaire LLC, Small Mighty Words Privacy, 5020 NE M L King Jr Blvd, Portland, OR 97211, United States. A particular subject line is not required.

We will update this policy when practices change and provide additional notice or request consent where required. The date at the top identifies this version.