Privacy & COPPA
Built for children's privacy
Lucas Academy is a non-profit community serving kids and families. This page explains what the live site and game backend collect today, how we keep kid data minimal, and how parents or adults can ask us to delete it. It is a plain-language operational summary, not a lawyer-reviewed formal legal policy.
Adult accounts and contact email
Saved progress uses an adult email sign-in. We send a six-digit one-time code, store the verified adult email in our user table, keep the temporary code as a short-lived hash in KV, and use an HttpOnly session cookie so families do not need to sign in every visit. Public newsletter and interest forms also ask for an adult email only.
Kid profiles, progress, and bot code
When an adult creates a kid profile, the backend stores an auto-generated display name, a PIN hash, the adult-to-kid link, level progress, ranking scores, Monkey Republic dial settings and class-ranking results, and the latest student bot code. Bot code is stored in private Cloudflare R2 storage; D1 keeps only its pointer, hash, size, language, and timestamps. We do not ask kids for email, real name, birthdate, address, phone, or school.
No ads or behavioral tracking
We do not show ads to children, use advertising trackers, or build behavioral profiles. Rankings use generated display names, not real names. The site uses local storage for language, game drafts, and device progress, and an HttpOnly cookie only for signed-in sessions. No analytics script is installed today.
Newsletter & marketing email
If an adult opts in to our newsletter, we store their email address and language preference to send occasional news about camps, classes, and programs. This is for parents and educators only — it is never offered inside the kids' app, and we never email children. We use confirmed opt-in (you click a link in a confirmation email before anything is sent), every message includes an unsubscribe link, and you can opt out at any time.
Interest forms
If an adult asks for camp dates, art openings, volunteer next steps, or general contact, we store the adult email address, selected program, language, source page, and any optional note so we can reply. These forms are for adults only and do not ask for child information.
Retention and deletion
We keep account, progress, bot-code, newsletter, and interest-form records while they are useful for the program or until deletion is requested. A parent, teacher, or adult subscriber can ask what we have, request deletion, or unsubscribe from email at any time.
Contact
Questions about privacy? Email hello@lucasacademy.org.
Last reviewed July 17, 2026. Current backend storage includes adult user emails and sessions, adult newsletter and interest rows, kid display names, PIN hashes, adult-kid links, progress summaries, ranking scores, Monkey Republic saved settings/results, and private R2 student bot code.