Privacy policy

1. This policy is about children's data

Skill Ride is used by children aged about four to nine, so this policy is written to be read by the adult who sets it up, and to be short enough to actually read. Alternativepurple, Unipessoal Lda, NIPC 516357948, Rua da Mata de São Mateus, Nº 34, Alto de Santa Catarina, 1495-735 Cruz Quebrada - Dafundo, Portugal ("AlternativePurple", "we") is the data controller and can be reached at hello@mudacorp.com.

The legal basis for storing a child's practice record is the consent you give as their parent or guardian when you set the app up (GDPR Article 6(1)(a) and Article 8; COPPA verifiable parental consent). You can withdraw it at any time by deleting the child, or the whole account, in the app.

2. What we store about a child

A nickname you choose, an age, a country, a school year, which subjects are switched on, a rough starting level, the sport and the colours they pick for their rider, and the gear they have unlocked.

Their practice record: which skills they have met, how many questions they got right, how long a spot took, their XP, coins, streak and the bonus-game scores.

That is all. We do not ask for or store a child's real name, surname, date of birth, address, photograph, voice recording, contacts, precise location or any identifier from their device.

3. What a practice record does NOT contain

When a child answers a question, we store the identifier of the question template and whether the answer was right — never the question's text and never anything the child typed or said. Nothing a child produces is kept.

Skill Ride contains no advertising, no advertising identifiers, no analytics SDK, no session recording and no third-party tracker of any kind. Nothing a child does inside the app is used to profile them, to target them, or to build an audience.

4. What we store about you

Your email address, so you can sign in and so we can send you the weekly report; which relation you said you are; the goals you picked; your app-lock preferences; and a one-way hash of the four-digit grown-up code.

If you sign in with Apple or Google we receive the email address they give us — which may be a relay address — and nothing else. We never receive your password.

If you subscribe, the store tells us that the subscription is active. We never see your card.

5. Where it is, and who can see it

Your family's data is stored in the European Union (Supabase, on AWS in Ireland) and is isolated per family at the database level: a query from your account can only ever return your family's rows.

The processors we use are Supabase (database, sign-in), Apple and Google (sign-in and payment, if you use them), RevenueCat (subscription status) and Resend (the sign-in and report emails). Each is bound by a data-processing agreement. We never sell data, never share it with advertisers, and never share one family's data with another.

Curriculum content and Ollie's voice are built before the app ships and are the same for every child. The app makes no AI call: nothing a child does is ever sent to a model.

6. How long we keep it

For as long as the account exists. Delete a child and that child's profile and practice record are removed; delete the account and everything goes, including the sign-in itself unless the same email is used for another of our products. Backups roll off within 30 days.

7. Your rights, and your child's

You can see, correct, export or delete your family's data, and withdraw consent, from inside the app or by writing to hello@mudacorp.com. We answer within 30 days. You can also complain to your national data-protection authority.

Because a child here has no account of their own, you exercise these rights on their behalf.

8. Changes

If we change what we collect or who processes it, we will update this page and tell account holders by email before the change takes effect. The date at the top is when this page last changed.