Privacy policy

Who we are

Chalkplay (chalkplay.app) is run by Tetiana Herasymenko, an individual entrepreneur registered in Ukraine, who is responsible for the personal data described here, under the EU General Data Protection Regulation (GDPR). For anything about your data, write to support@chalkplay.app.

In short

• You can use Chalkplay without an account. Your activities then stay in your own browser and never reach us: we only hear that one was made, and with which template.
• If you sign in with Google, we keep your name, email address and profile picture, plus the activities you make and like.
• We email you a welcome when you sign up and a tip a few days later, and now and then we may write to ask how Chalkplay is working for you, about your account or about Pro. Each email has a link to stop them.
• Students don't need accounts. In a live game, the first name a student types and their score go to their teacher's screen, and nothing is saved. For homework, the first name and score are saved for the teacher who set it, until a year after the due date.
• If you buy Pro, our reseller Paddle takes the payment. We never see your card details.
• No ads, no selling data, no advertising profiles, and no training AI models on your activities.
• You can delete your account, with everything in it, from My activities → Account at any time.

What we collect

If you don't sign in

The activities you make, the activities you like and a few settings are saved in your browser's local storage on this device. They aren't sent to us. Clearing your browser's site data deletes them.

When you save a new activity, or reach the free plan's limit of activities, the page tells us that it happened and which template it was, with nothing that identifies you or what the activity says. If the limit stops you opening the editor, it also tells us the Chalkplay page, or the other website, you came to it from.

Your browser also keeps a note of how you first arrived at Chalkplay in its local storage: the page you landed on (its path only, such as /templates/quiz), the website that linked to it (its address only, such as facebook.com), any campaign tags in that link (utm_source, utm_medium, utm_campaign, utm_term, utm_content and ref) and when. It stays in your browser: it's sent to us only when you sign in with Google, and your browser then deletes it. A visit more than 30 days later replaces it.

If you sign in with Google

• From Google: your name, email address, profile picture and Google account ID. We ask Google for nothing else: not your contacts, files, calendar or anything in your Google account.
• What you make: your activities (title, content, subject, grade, language, and whether they're public or link-only) the activities you like, and the homework you set (a copy of the activity, its due date and its link). When you first sign in, the activities and likes saved in your browser move into your account.
• Sign-in records: when you signed in, and the IP address and browser used, to keep your account secure.
• Notes from support: if you write to us, we may keep a short note on your account about what we discussed, so we can help you next time. Only Chalkplay's admins see it.
• Where you came from: when you sign up, the note your browser kept of how you first arrived (see above): the page, the website that linked to it, the link's campaign tags and when. We keep it with your account to learn which links and pages bring teachers to Chalkplay, and only Chalkplay's admins can see it. If you sign in on a new device later, we don't keep that device's note.
• Usage records: a short record, with the time, when you sign up (with how many activities and likes moved from your browser into your account), make an activity (its template), start a live game (its template and how many players joined), reach the free plan's limit or open the Pro checkout (the plan). We use them to count, week by week, how many new teachers go on to each step. They hold nothing about your students and no IP address, and only Chalkplay's admins can see them.

If you buy Pro

Pro is sold by our reseller Paddle.com, the merchant of record. Your payment details, billing address and country go to Paddle, not to us. Paddle tells us about your subscription: its Paddle subscription and customer IDs, the plan and price, its status (for example active, cancelled or payment failed), and when it renews or ends. We also keep a short record of each message Paddle sends us (its kind, when it came and what we did with it).

Everyone

• Server logs: like any website, our hosting keeps short-lived logs of requests (IP address, time, page asked for, browser) to run the site and protect it from abuse.
• Error reports: if something breaks on a page in your browser, the page tells us the error, where in our code it happened, the page's address (without any codes in it) and your browser's name and version, so we can fix it. They hold nothing you typed, no names and no IP address, and aren't linked to your account.
• Problem reports: if you report a problem with an activity, we receive what you chose and wrote, the activity's link, and the email address you gave (or your account's, if you're signed in) so we can reply. It reaches us as an email.
• Visit counts: on public pages and library activities we count visits with Cloudflare Web Analytics. It sets no cookies, keeps nothing that identifies you, and doesn't follow you to other sites. It isn't used on the editor, your dashboard, the sign-in pages or the game join page.

Read more about local storage and cookies in our cookie notice.

Why we use it

• To run your account (sign-in, saving and showing your activities and likes). This is necessary to provide the service you asked for (GDPR Article 6(1)(b)).
• To give you Pro (your subscription's details from Paddle, and a message to us when you start, change or cancel Pro or a payment fails: your name and email address and the plan). This is necessary to provide the service you bought (Article 6(1)(b)).
• To keep Chalkplay secure and working (sign-in records, server logs, error reports, and a message to us when our server hits an error: the address asked for and the error). This is our legitimate interest in protecting the service and its users (Article 6(1)(f)).
• To know how Chalkplay is used (a message to us when a teacher signs up, with where they came from and how many activities (with their templates) and likes they brought from their browser, makes an activity or reaches the free plan's limit: the teacher's name and email address and the template, or only the template for someone not signed in, and, when the limit stops someone opening the editor, the page or website they came to it from; teachers' usage records, which we count week by week; and where each teacher came from when they signed up, to learn which links and pages bring teachers to us). This is our legitimate interest in running and improving Chalkplay and in knowing who to help (Article 6(1)(f)).
• To run live games (a student's name and score, passed to the teacher's screen and not saved). This is the teacher's and our legitimate interest in running the game the teacher started, kept to the least needed (Article 6(1)(f)).
• To run homework (a student's first name and score, kept for the teacher who set the homework). This is the teacher's and our legitimate interest in running the homework the teacher set, kept to the least needed (Article 6(1)(f)).
• To fix problems you report (your report and, if you give it, your email address). This is our legitimate interest in keeping activities correct and safe, and in answering you (Article 6(1)(f)).
• To support you and look after the service (your account's details and usage, notes from support). Chalkplay's admins can see each account's name, email address, when it joined and was last used, and how many activities, homework and likes it has. To fix a problem you tell us about, or to deal with misuse, an admin can open your account and see and change it as you would. Each time, we record who opened it and every change they made. This is our legitimate interest in supporting you and protecting the service (Article 6(1)(f)).
• To write to you about Chalkplay (your name and email address, and how you use Chalkplay, such as your plan and how many activities you have). A few go automatically, each once: a welcome when you sign up, a tip a few days later (how to make a first activity, or templates you haven't tried, which is why we look at how many activities you have and which templates they use), and, if you fill the free plan, a note about Pro and its free trial. Now and then we may also email you ourselves: to ask how Chalkplay is working for you and what you think of it, to tell you about your account (for example, that a free trial has started or is about to end) and to tell you about Pro. These come from us, not from a newsletter or a mailing list. To stop them, use the link at the end of any of them, or write to support@chalkplay.app. We'll keep a note on your account so we don't write again, except for the few emails we must send, such as telling you about a change to this policy. This is our legitimate interest in helping the teachers who use Chalkplay and in telling them about it (Article 6(1)(f)). You can object to it at any time (Article 21), and we'll stop.
• To understand which pages are useful (visit counts without cookies). This is our legitimate interest in improving the site, and it doesn't identify you (Article 6(1)(f)).

We don't use your data for advertising, we don't sell or rent it, and we don't use your activities or anything students type to train AI models.

Google user data

Chalkplay only receives the basic profile Google shares when you sign in (your name, email address and picture). We use it to sign you in, to show your name on your account and your shared activities, to tell us who has signed up and is making activities (your name and email address, in a message to us), and to write to you about Chalkplay (see above). We use it for nothing else. We don't share it with anyone except the providers listed below, who run Chalkplay for us. Chalkplay's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What others can see

• Public activities appear in the community library. Anyone can play them and see your name as the author.
• Link-only activities don't appear in the library, but anyone with the link can play them and see your name as the author.
• Your email address and profile picture are never shown to other people.

Please don't put students' personal details, such as full names or photos, into activities you share.

Students and children

Accounts are for teachers and other adults. Students never need an account, an email address or a password. When students play an activity on their own from a shared link, nothing they type or answer is sent to us. Homework is the exception, below.

Live games

When a teacher runs a live game, students join with the game's code and a first name or nickname they choose. While the game is open:

• The name they typed is shown to the teacher and to the other players in that game.
• When they finish, their score (for example "7 / 10") goes to the teacher's screen, and the top scores and names are shown to the players at the end. Their answers stay on their own device.
• The name and score pass through Supabase's real-time service between the teacher's and students' devices. We don't save them: they're gone when the teacher closes the game.

Teachers: please ask students to use a first name or nickname only.

Homework

When a teacher sets homework, students open its link and type a first name or nickname. When they finish the game:

• Their name and score (for example "7 / 10", with how many they got right, how many tries they took and when they finished) are saved in Supabase's database in Frankfurt for the teacher who set the homework. Nobody else sees them, unless a Chalkplay admin opens the teacher's account to help them (see Why we use it). Their individual answers stay on their own device.
• Their browser keeps the name they typed and a random code for that homework in its local storage, so another try counts as the same student. No cookie is set.
• The results are deleted a year after the due date, or sooner if the teacher removes a result, deletes the homework or deletes their account.

Who else handles your data

We use a few companies to run Chalkplay. They process data only on our instructions, under data processing agreements where they offer one.

Your account and activities are stored in the EU. Vercel, Google, Cloudflare, Resend and ImprovMX are US companies and may process some data, such as server logs, outside the EU. Where that happens, it is protected by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. Paddle is a UK company, and the UK has an EU adequacy decision. Telegram keeps the messages it delivers to us in its own data centres, which may be outside the EU.

The log-in and sign-up pages show Google's own sign-in button, which loads from Google, so Google can see that you visited those pages. No other Chalkplay page loads anything from Google.

How long we keep it

• Your account, activities and likes: until you delete them. Deleting your account removes your profile, every activity in it (including ones you shared) and your likes straight away.
• Your Pro subscription: until your account is deleted, which you can do once Pro is cancelled. Records of Paddle's messages: a year. Paddle keeps its own records of your payments, as tax law requires, under its privacy notice.
• Sign-in records: only as long as we need them to keep accounts secure.
• Notes from support: until your account is deleted. The record of admins opening your account and what they changed: a year.
• Usage records: a year, or until you delete your account if that's sooner.
• Where you came from: with your account, until you delete it. The note in your browser: until you sign in, or until a visit more than 30 days later replaces it. Clearing your browser's site data deletes it too.
• Live games: not kept. Names and scores exist only while the game is open. A student's browser tab remembers the code and their name until the tab is closed, so a reload rejoins the game.
• Homework: until a year after its due date, when a nightly job deletes it with every result in it, or sooner if the teacher deletes it or their account.
• Server logs: a few days at most. Error reports: 30 days.
• Emails between us, and problem reports you send us: as long as we need to answer you, then up to a year in case you write again. A request to stop our emails: until your account is deleted, so we keep honouring it. Which of our automatic emails we've sent you, and when: until your account is deleted, so none goes twice.

Our providers' backups may hold deleted data for a short time until they're overwritten.

Your rights

You have the right to see the personal data we hold about you, correct it, delete it, get a copy in a portable format, and object to or restrict how we use it.

• To delete everything, use Delete my account. You can delete single activities from My activities.
• To stop our emails, use the link at the end of any of them. For that or anything else, such as a copy of your data, email support@chalkplay.app. We reply within one month.

If you think we've handled your data wrongly, please tell us first. You can also complain to the data protection authority in the country where you live or work.

Changes to this policy

When we change this policy, we update the date at the top. If a change affects how we use the data of people with an account, we'll tell them by email before it takes effect.