Pemdazzle (“we,” “us,” or “our”) is an educational math practice application operated by Pemdazzle. We are committed to protecting the privacy of our users, especially children. This Privacy Policy explains our practices regarding the collection, use, and disclosure of personal information.

By using Pemdazzle, you agree to the collection and use of information in accordance with this policy. Because we serve young learners, we assume all users are under the age of 13and apply our most stringent privacy protections to every account by default.

How You Sign In

Pemdazzle gives you two ways to use the app. Pick whichever fits your family:

Continue with Google — you sign in through Google. We receive your email address and a unique identifier from Google. We never see your Google password.
Play without signing in — you can use Pemdazzle without an account at all. We don’t ask for an email, a name, or any other identifying information. Your game progress (energy, dazzles, scores, and settings) is saved by your browser, on your own device, and is never sent to us or anyone else. If you sign in later, your progress is preserved and synced to the cloud.

We plan to add Sign in with Apple in the future. When we do, this Privacy Policy will be updated in the same release.

If you Continue with Google, the moment you sign in Google Firebase Authentication records your IP address, an approximate geographic location derived from that IP (roughly the city or region), and your browser’s User Agent string (which describes your device and browser version). This happens automatically and is part of how Firebase protects accounts from abuse. We do not use any of this information for marketing, demographic profiling, or advertising. If you Play without signing in, none of this is collected.

Learn more about Google’s Privacy Policy, Google’s Terms of Service, and Firebase Privacy and Security.

Information We Collect

We’ve tried to keep this list short and specific. If a category isn’t named below, we don’t collect it.

Account information

When you sign in, we receive the items described in How You Sign In above: your email address from Google, your Google account’s display name (typically your first and last name as you set it on Google), a unique account identifier issued by Google Firebase (called a Firebase UID), and the IP / approximate location / User Agent that Firebase Authentication records at sign-in. If you play without signing in, none of this is collected.

Household owner name

When you first set up your household, we ask you to confirm a display name for the household owner(the adult who signed in). The field is pre-filled with the first word of your Google account’s display name — for example, if your Google account is “Jane Smith,” the field shows “Jane.” You can keep it, edit it to anything you want (a nickname, an initial, or one of our auto-generated silly names), or change it later from your profile settings.

This is the only place in Pemdazzle where a real first name is collected and stored on our servers.We seed the field from your Google name only because we already receive that name through Google sign-in — using it as the default doesn’t expand what we collect, it just makes the UI honest about what we already have. If you’d rather we not store a real name at all, edit the field to something else; whatever you type is what we keep.

If a co-parent joins your household, they go through the same setup — pre-filled with their own Google name, editable to anything. Children’s profiles never use this kind of field (see below).

Player profile information

Each player profile (one per child) stores:

A display name that Pemdazzle generates for you (an adjective paired with an animal or object, like “BraveOtter”). There is no text field where a real name could be typed. You can shuffle for a different generated name at any time. This rule applies to every player profile, regardless of the player’s age.
An emoji avatar you pick from a preset list.
A grade level, which we use to choose appropriate math content.
Game settings: things like which input method you prefer (hand camera, keypad, or stylus), preferred difficulty, music and sound preferences.
In-game currency and path state: your “Dazzles” balance, energy, experience points, and which quest node you’re on.
Per-mode engagement counters: small whole numbers, one per game mode, counting how many rounds ended in each outcome. We track eight outcomes per mode: Practice started, Practice completed, Practice exited early, Quest started, Quest cleared, Quest finished without advancing, Quest ended because energy ran out, and Quest exited early. We also keep two small maps that count how many times each quest path-node has been attempted and cleared. We use these counts to tell, in aggregate, which modes are popular, where players are getting stuck, and whether the energy economy is interrupting play. No per-session timestamps, no per-problem data, no individual session records, no cross-counter correlation. Separately, for quest path-nodes only, we keep two small numbers per node — the total time spent on cleared attempts and the count of timed clears — so we can compute an average time-to-clear per node (for example, “the average kid spends about 90 seconds on node 4”). Each clear’s contribution is capped at five minutes so a phone-locked or walked-away device can’t skew the average. Individual round durations are not stored, and no clock-time (“the user played at 3:47 PM”) is ever recorded.
Learning data that powers your Numeracy Report. As you play, your device records:
- How many problems you’ve answered, your highest streak, your daily streak, and your longest daily streak.
- How many minutes you’ve played each day for the last 90 days (older days are folded into a single all-time total).
- Per-mode session totals — high score, games played, best streak, best round at each difficulty.
- Per-skill-bucket attempts and correctness — for example, “single-digit addition: 42 attempts, 38 correct” or “true/false subtraction: 15 attempts, 14 correct.”
- Per-number mastery for the numbers 0–20 — how often you’ve answered correctly and your average response time.
- Your last 30 session summaries — one entry per round, with mode, difficulty, attempts, number correct, score, and timestamp.

The last two bullets — the per-mode engagement counters and the learning data behind the Numeracy Report — are what your Numeracy Report and our product-engagement counts are built from. If you Play without signing in, all of that stays on your device and is never sent to us. If you Continue with Google, the same data is also mirrored to your account on our servers so you can see the same report on every device you sign in to, and so a co-parent in your household can see the report. We never use this data for advertising, profile-building, demographic targeting, sale, or sharing with any third party.

We do not collect ages, birthdays, addresses, phone numbers, school names, photos, or contact lists.

Marketing attribution

If you arrive at Pemdazzle through a link that has utm_source, utm_medium, or utm_campaign in the URL (these are standard marketing tags — for example, a link in a blog post or an ad), we record those three values once on your first visit and store them on your household record. That lets us know which outside channels are sending people our way (e.g. “a parenting blog,” “a search ad”) in aggregate. We capture them only on your first landing — later visits with different tags don’t overwrite the original. We never share these values with any third party, and they are deleted along with the rest of your household data when you delete your account. If you sign in without ever clicking a tagged link, nothing is captured.

How the camera works

If you choose hand-camera mode, Pemdazzle uses your device’s camera to count fingers you hold up as your answer. The image processing is done by Google’s MediaPipe library, running entirely inside your browser, on your own device. The video stream is never uploaded, never recorded, never sent to any server we run, and never sent to Google or any third party. There is no code path in Pemdazzle that transmits camera data, and we will never add one. See Sharing or Transferring Data to Others below for why this commitment is permanent.

In the camera viewfinder, we cover detected faces with a friendly emoji so kids aren’t distracted by seeing themselves. This is a comfort feature, not a privacy mechanism. Your real privacy protection is that the camera stream never leaves your device.

MediaPipe is bundled inside the Pemdazzle app itself at a specific frozen version— your browser never downloads it from a third party, and no one (not even Google) can change the copy you run. Before we ever upgrade that version, we review the change history and inspect the new files for any network behavior, because anything touching the camera deserves a careful look.

Where the data lives

When you sign in with Google or Apple, your account and profile information is stored in Google Firestore, a database managed by Google Firebase. When you Play without signing in, everything stays on your own device in your browser’s local storage. We do not have a copy. Learn more at Firebase Privacy and Security.

What we don’t use

No third-party analytics. We do not use Google Analytics, Facebook Pixel, Mixpanel, Amplitude, PostHog, Hotjar, or any other analytics provider. To understand product engagement, we look at first-party sign-in timestamps that Firebase Authentication already records, and the per-mode round counts described under Profile information. Nothing is shared with an outside analytics company.
No behavioral tracking. We do not build profiles of children for advertising, recommendation, or any other purpose.
No advertising of any kind. Pemdazzle is monetized through optional subscriptions. We do not show ads — not banner ads, not video ads, not "contextual" ads, not anything. This is a commitment, not a hedge.
No tracking cookies. Pemdazzle does not set tracking cookies. Firebase Authentication uses tokens stored locally on your device to keep you signed in — these are not shared with any other site.

How We Use Your Information

We use what we collect for five purposes — and only these five. Each one is named below with what it actually does in the product.

Run the app for you.Save your profiles and progress, refill energy on a schedule, unlock achievements as you earn them, and sync between your devices when you’re signed in.
Personalize what comes next. Remember your grade level and your settings, and route the next problem at the right difficulty using the mastery data your device records. This is also how your Numeracy Reportworks — your device tallies your progress over time, and if you’re signed in that tally is mirrored to your account so you (and a co-parent in your household) can see the report on any of your devices.
Keep your account safe.Firebase Authentication uses the IP address and User Agent it records at sign-in to detect abuse — for example, blocking a sign-in attempt from an unrecognized location. We don’t use this information for anything else.
Understand which features get used. For each signed-in profile, we keep per-mode engagement counters (eight outcomes per mode plus two node-level maps) and a per-input-mode round counter (all described under Profile information) so we know whether anyone is playing, say, the Exponents mode, and whether the hand-tracking input is actually being used. No individual session records, no timestamps, no per-problem data, and no data at all from guests. These are the only product analytics we keep.
Communicate with you when something changes about your account. If you’re signed in, we may email you to confirm an account deletion you requested, or to let you know when a co-parent joins your household. Those are the only kinds of messages we may send. We never send marketing email.

We do not use any of this information for behavioral advertising, profile-building, demographic targeting, or sale to anyone. The five uses above are the only purposes.

Sharing or Transferring Data to Others

We care deeply about our users’ privacy. We do not sell or rent your personal information to anyone. We share data only as needed to run Pemdazzle, and only with the parties named below.

Vendors who help us run Pemdazzle

We rely on one vendor: Google. Specifically:

Google Firebase Authentication — handles sign-in when you Continue with Google. This is what records the IP address, approximate location, and User Agent described in How You Sign In.
Google Cloud Firestore — the database where your account and profile data is stored if you sign in.
Google Firebase App Hosting — serves the Pemdazzle web app to your browser.
Google’s MediaPipe library — the hand-detection code that runs locally in your browser. It is bundled inside the Pemdazzle app and served with it by App Hosting — there is no separate connection to Google to fetch it, and no camera data ever goes back. See Camera and microphone data below.

Google is bound by its own terms to handle this data securely. Learn more at Firebase Privacy and Security.

We do not use any other vendor for hosting, analytics, email, advertising, support tooling, or anything else that would touch your data. The domain name pemdazzle.comis registered through Squarespace, which acts only as our registrar — they do not host the app, see user traffic, or have access to any user data.

Camera and microphone data

Camera frames are never shared with anyone — including Google — because, as described in How the camera works, they never leave your device. There is no code path in Pemdazzle that transmits camera or microphone data, and we will never add one. Treating children’s video as a transferable asset is a line we will not cross, full stop.

Aggregate or de-identified data

Some companies reserve the right to share aggregate, anonymized data with outside parties. We do not.Even aggregate counts derived from how children use Pemdazzle stay with us — we do not publish them, sell them, share them with researchers, or transfer them to any third party.

If Pemdazzle is ever sold or merged

If Pemdazzle is acquired, merges with another company, or goes through bankruptcy or a similar transaction, your data may be transferred to the new owner. If this happens, we will notify you before the transfer takes effect so you have the chance to delete your account first under the terms of this Privacy Policy.

When we may be required to disclose information

We may disclose personal information if we have a good-faith belief that doing so is reasonably necessary to:

(a) satisfy any applicable law, regulation, legal process, or enforceable governmental request;
(b) enforce our Terms of Service, including investigation of potential violations;
(c) detect, prevent, or otherwise address fraud, security, or technical issues;
(d) protect the rights, property, or personal safety of Pemdazzle, our users, or the public; or
(e) as otherwise required or permitted by law.

Communications

This section explains when we’ll email you, how we tell you about new things in Pemdazzle, and how we promote the app to people who aren’t users yet.

Email is transactional only

If you’re signed in, we may email you for one of these reasons, and only these reasons:

To confirm an account action you requested, such as deleting your account.
To let you know when a co-parent joins your household.
To notify you about a security issue or a material change to this Privacy Policy or our Terms of Service.

We do not send marketing email.No newsletters, no promotional campaigns, no “we miss you” re-engagement emails, no announcements of new game modes or features by email. You will never need to unsubscribe from us, because we will never put you on a list.

How we announce new features

When we add a new game mode, a new feature, or anything else worth knowing about, we’ll tell you inside the app— for example, a small “What’s new” note the next time you open Pemdazzle. We do not use email, push notifications, or any other channel for product announcements.

How we promote Pemdazzle

We may tell the world about Pemdazzle through ordinary marketing channels — posting on social media, publishing blog posts, asking journalists or educators to write about us, buying search ads (for example, “math game for kids”), or buying ads on social platforms targeted by general interest categories like “parents of elementary schoolers.”

None of that uses information about you. We do not upload our user list to ad platforms, we do not build “lookalike audiences” from our users, and we do not share anything about who plays Pemdazzle — in aggregate or otherwise — with advertising networks. Anyone who sees a Pemdazzle ad sees it because of what they searched for or what that platform already knows about them, not because of anything Pemdazzle told the platform.

We don’t use your activity for advertising

We do not use your activity in Pemdazzle to target ads on Pemdazzle (there are none) or anywhere else. We do not share information about your use of Pemdazzle with advertising networks, data brokers, or social platforms. We do not place tracking pixels in Pemdazzle, and we do not run interest-based advertising of any kind.

Children’s Privacy (COPPA)

Pemdazzle is a child-directed service. We comply with the Children’s Online Privacy Protection Act (COPPA) and apply COPPA-style protections to everyaccount by default, whether or not the user is under 13. We do not ask users to disclose their age, and we do not treat older users differently — the protections below apply to everyone.

Pemdazzle is intended to be used by children under 13 only with the consent and oversight of a parent or guardian. The grown-up sets the app up; the child plays. If you believe a child has used Pemdazzle without a parent’s knowledge, contact us at pemdazzle@gmail.com and we will help you delete the data.

How a parent sets things up

There are two ways a child can use Pemdazzle, and a parent chooses which one:

Play without signing in. Everything stays on the device in the browser’s local storage. We never receive any of it. No account, no email, no parental setup step is required — the privacy posture is the default.
Continue with Google. The parent signs in with their own Google account. Google requires its account holders to meet the minimum age set by law in their country (in the United States, 13), and routes under-age users to Family Link supervised accountsthat are managed by a parent’s own Google account. We treat the signed-in Google account holder as the parent of record for any child profiles created in that household.

We do not impose a separate adulthood quiz (such as a math problem) before sign-in. In a math game for children, that kind of gate is not meaningful, and we believe Google’s own age policies plus the data-minimization commitments below are a stronger protection. For the specific in-app actions that do deserve an extra friction step (account deletion, future paid features), see Data Retention & Deletion and How Pemdazzle Is Funded.

What information we collect from a child

For each child profile the parent creates, we store only what is needed to run the game and show the Numeracy Report:

A display name generated by Pemdazzle (an adjective paired with an animal or object, like “BraveOtter”). The parent can shuffle for a different generated name; there is no free-text field where a real name could be typed.
An emoji avatar from a preset list.
An optional grade level used to choose appropriate math content.
Game progress: energy, Dazzles balance, experience points, quest path position, total stars, achievements, and game settings.
Learning data that powers the Numeracy Report (per-skill attempts and correctness, per-number mastery 0–20, daily minutes for the last 90 days, last 30 session summaries, per-mode engagement counters across Practice and Quest, per-input-mode round counts). See Profile information above for the full breakdown.

We do not collect a child’s age, birthday, address, phone number, email address, school name, photo, contacts, or any other personal identifier. We never collect camera frames or audio (see How the camera works). If a category isn’t in the list above, we don’t have it.

If the parent chose Continue with Google, the child’s profile data is associated with the parent’s Google account (specifically, the parent’s Firebase UID and household ID). If the parent chose Play without signing in, the child’s data is associated with nothing at all — it sits in the browser’s local storage and is not linked to any identity.

How we use a child’s information

We use it only to operate, personalize, and improve the gameplay experience — the five uses listed in How We Use Your Information above. We do not use a child’s information for marketing, advertising, behavioral profiling, demographic targeting, or recommendation systems of any kind.

Our legal basis for relying on the parent’s SSO sign-in — rather than running a separate verifiable-parental-consent process — is that the data we collect from children falls within COPPA’s “support for the internal operations of the service”exception (16 CFR § 312.5(c)(7)): we use it to run the app, render the Numeracy Report to the same parent on another device, and improve the product, and we do not use it for advertising, behavioral profiling, or sharing with third parties. If we ever change what we collect or how we use it in a way that falls outside that exception, we will update this Privacy Policy and add a verifiable-parental-consent step before doing so.

How we share a child’s information

We share a child’s information only with the Google services that store and serve it (Firebase Authentication, Cloud Firestore, App Hosting). These are listed in Sharing or Transferring Data to Others. We do not share a child’s information with any third party for that third party’s own purposes— not advertisers, not analytics companies, not researchers, not data brokers. Camera and microphone data is never shared with anyone, including Google, because it never leaves the device.

How a parent controls a child’s information

A parent can manage a child’s information at any time, directly in the app, without contacting us:

Shuffle the child’s display name, change the emoji, or update the grade level — in the profile editor. The display name is always one of Pemdazzle’s generated Adjective+Noun names; there is no free-text field.
Delete a single child’s profile — removes that profile’s name, settings, achievements, game progress, and learning data from the device and (if signed in) from our servers.
Delete everything — the Delete this household and all data action (see Data Retention & Deletion) wipes every profile in the household, the parent’s sign-in record, and all linked data.
Switch to guest mode — signing out and using Play without signing in keeps all subsequent activity on the device, with nothing sent to us.

If a parent has trouble doing any of the above, or wants confirmation that data has been deleted from our servers, they can email us at pemdazzle@gmail.com.

How Pemdazzle Is Funded

Today, Pemdazzle is free to use. In the future, we may introduce optional features — such as a subscription, or optional in-app purchases for cosmetic items or extra game energy — that would be available behind an adult-confirmation step (for example, a typed confirmation or a payment-platform checkout that requires an adult account).

We may, from time to time, tell you about Pemdazzle’s own paid features inside the app — for example, when you run out of energy, we may suggest a subscription that removes the energy limit. That is the only kind of in-app message about a paid product you will see.

We do not show third-party advertising of any kind, and we never will.No outside company pays to reach you, your child, or your attention through Pemdazzle — not banner ads, not video ads, not “contextual” ads, not sponsored content, not anything. Our business model is, and will remain, parents paying for a clean experience for their child — not advertisers paying for their child’s attention.

Data Retention & Deletion

You can delete your data at any time, yourself, from inside the app. There is no form to fill out, no email to send, and no waiting period. Deletion is immediate, self-service, and complete— we keep nothing behind for “business records,” “fraud prevention,” or aggregate analysis.

What “delete” means depends on how you use Pemdazzle. There are three paths, listed below. Every deletion action requires an in-app confirmation step— designed so a child can’t wipe a household by tapping the wrong button.

If you Play without signing in

In your profile settings, choose “Clear all Pemdazzle data on this device.” After you confirm, every profile, every game setting, every score, every minute of play time, and every entry behind your Numeracy Report is erased from your browser’s local storage. Because we never received a copy in the first place — see How You Sign In and Where the data lives— there is nothing to delete on our end. The slate is genuinely clean.

This is also a useful feature on shared devices. If a child plays Pemdazzle on a classroom tablet, a library computer, or a borrowed phone, the adult can clear the device before handing it back.

If a co-parent is leaving your household

The multi-adult household features described in this subsection — invitations, the co-parent role, the two removal paths, and ownership transfer — are not built yet. Today every signed-in account stands alone, and the “Delete this household” path described further down is the only way to remove a signed-in account. The paragraphs below describe how these features will work once they ship. We will update this section to present-tense in the same release that turns them on.

A Pemdazzle household will be a shared workspace: it will hold the profiles for the kids in your family. Every household will have one owner (the adult who created it), and the owner will be able to invite other adults to join as co-parents. The owner will manage who has access. When this is in place, there will be two ways a co-parent’s access ends, and both will produce the same cleanup:

The owner removes a co-parent. In the owner’s profile settings, “Manage co-parents” will show the list of invited adults with a remove button next to each. When the owner confirms a removal, we will:

Remove that co-parent’s Firebase UID from the household’s member list.
Delete that co-parent’s personal account record (users/{their-uid}), which contains their email address and a pointer to the household.
Flip a server-side authentication claim that will invalidate their existing session immediately. Any tab they have open will be signed out within seconds — not whenever the device next happens to talk to our servers.

A co-parent removes themselves. A co-parent who wants out will be able to use “Remove myself from this household” in their own profile settings. They will not have to ask the owner. The cleanup will be identical to the owner-initiated path above: member list updated, users/{your-uid}deleted, session invalidated, signed out. There will deliberately be no separate “leave the household” ceremony — signing yourself out of the household will just be an option in settings, not an event.

In both paths, the household itself and the kids’ profiles inside it will not be deleted — they will remain available to the owner and any remaining co-parents. The owner will not be able to use these paths to remove themselves: an owner who wants to step away will need to either transfer ownership to another co-parent (see below) or delete the whole household.

If you want to delete the entire household

Choose “Delete this household and all data” in your profile settings. This option is only available to the household’s current owner. We chose this rule so that a single co-parent cannot, on their own, erase a year of a child’s learning progress. Co-parents who want to disconnect should use one of the paths above instead.

If you’re the owner and you don’t want to delete — you just want to hand the household to someone else (for example, after a separation, or because the household was set up under the wrong account): once the co-parent features described above ship, the owner’s settings will include a “Transfer ownership”action. It will promote one of your co-parents to owner and demote you to a co-parent, in one step. After the transfer, the new owner will be able to remove you using the path above, or you can remove yourself. We will keep this separate from deletion on purpose: handing off a household and erasing it are very different decisions, and we don’t want a frustrated owner to reach for the wrong button.

After you confirm, we permanently delete:

Every profile in the household — display names, emojis, grade levels, settings.
All learning data behind the Numeracy Report — daily play minutes, per-mode session totals, per-skill-bucket attempts, per-number mastery, and the last 30 session summaries, for every profile.
All in-game state — Dazzles, energy, experience points, quest progress, achievements, per-mode and per-input-mode round counters.
The household record itself, including its member list, creator, and settings.
The personal account record (users/{your-uid}) of every member, including the creator.
Once co-parents are supported, every co-parent will be signed out the next time their device tries to sync.

The deletion is immediate and unrecoverable by us. We do not keep a copy, a backup, or a “tombstone” record of the deleted household for our own purposes, and we have no admin tool that can bring a deleted household back. (See What may still exist after deletionbelow for the narrow exceptions that live on Google’s side of the line and that we cannot reach.) Please be sure before you confirm.

Confirmation by email

When the email infrastructure described in Communicationsis in place, we will send a one-time confirmation email to each affected account after a deletion action — so that if someone other than you triggered the deletion, you find out about it. Until that infrastructure is live, the in-app confirmation screen is the only notice. We do not delay the deletion itself while waiting on email; the data is gone the moment you confirm in the app.

What may still exist after deletion

We aim to keep nothing, but we are honest about two narrow exceptions that are outside our control:

Sign-in records held by Google. Firebase Authentication, run by Google, keeps its own short-term record of sign-in events (IP, approximate location, User Agent) for abuse-prevention purposes, as described in How You Sign In. When we delete your users/{your-uid} record, we also delete the corresponding Firebase Authentication user, which tells Firebase to purge those records on its own schedule. We do not control that schedule, but we do not retain or use the data for any purpose ourselves.
Web server access logs. The Google service that serves pemdazzle.com to your browser keeps short-lived access logs (IP, URL, timestamp) the way any web server does. These are not linked to your profile data and are aged out by Google on its own schedule. We do not query, retain, or analyze them.
Google’s platform-level operational copies of the database. Like every major cloud database, Google Cloud Firestore maintains internal disaster-recovery copies of its data — the kind of copies that exist so that an entire data center failing does not lose customer data. We cannot see, query, restore from, or otherwise reach these copies. They age out on Google’s own schedule, without our involvement. We have not enabled any optional Firestore recovery feature that would give us the ability to restore deleted data — specifically, we have not turned on Firestore Point-in-Time Recovery and we have not configured Firestore managed backups. We commit to updating this Privacy Policy before ever enabling either of those features, because doing so would change what “unrecoverable by us” means and you deserve to know.

Outside of these three narrow exceptions, deletion is complete.

Retention while your account is active

For as long as your household exists, we retain the data described under Information We Collect — because that data is the product (your Numeracy Report, your progress, your in-game state). We do not automatically expire active accounts or quietly purge inactive ones. If you want your data gone, use one of the paths above; otherwise it stays available so your child can pick up where they left off.

Changes to This Policy

We may update our Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Last updated” date.

Contact Us

If you have any questions about this Privacy Policy, please contact us at:
Email: pemdazzle@gmail.com