Privacy Policy

Last updated: 8 October 2026  ·  Effective: 8 October 2026  ·  Version 1.2

1. Who we are

WonderSpy is a mobile game for families, published by [Legal entity name] ("WonderSpy", "we", "us"), registered in India at [registered address, Gurugram, Haryana, India]. For the purposes of the EU/UK GDPR we are the data controller; under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary.

You can reach us at support@wonderspy.app about anything on this page, or through our contact page.

2. Who this policy covers

This policy covers the WonderSpy iPhone app, the wonderspy.app website, and any support correspondence you have with us.

WonderSpy is designed for children and is intended to be used with a grown-up's knowledge and consent. Children do not create accounts and cannot enter contact details. The only thing a child can type is an optional spy name during the welcome steps (§4.1); every other text field in the app — feedback and the deletion request — sits behind the parent gate. We treat all in-app play data as children's data and apply the strictest rules to it.

3. The Explorer ID, and why there is no account

WonderSpy has no sign-up. When the app first runs it creates an anonymous Explorer ID — a random identifier issued by Firebase Authentication — and stores your child's progress against it. That ID is not linked to a name, an email address, a phone number, a device advertising identifier or any account you hold elsewhere, and it does not follow your child to any other app.

A grown-up can see the Explorer ID in the app, in the Grown-ups area, and tapping it copies it in full. It is the only way we can locate your records, so please quote it if you write to us about your own data.

Reinstalling the app or switching to a new phone generally produces a new Explorer ID, and the old progress is no longer reachable from that device. That is a consequence of holding no account — and it is the main reason optional accounts are planned for a later version. Section 17 says what that will change.

4. What we collect

We collect as little as we can make the product work with. Here is the complete list.

4.1 Play data, stored against the Explorer ID

What	Why	Where it lives
A spy name, if one is entered during the welcome steps	So the app can greet your child and a household can tell profiles apart. We encourage a made-up spy name such as "Agent Nova" rather than a real name.	On the device, and on our servers against the Explorer ID
An age band	A broad band, used to choose appropriate missions, language level and default safety settings. We do not ask for, and do not store, a date of birth.	On the device, and on our servers
Play progress	XP, Explorer Title, Wonder Badges, Adventure Log state, Wonder Book entries, the facts collected, Wonder Coins — so progress survives a reinstall of the game's own data.	Device cache, plus our servers
Play and safety events	Session start and end, and whether a safety interruption (a look-up reminder, a daylight check) was shown — so a grown-up's safety log tells the truth about what the app did.	Our servers

4.2 Feedback you choose to send

If a grown-up sends feedback through the app — a form that sits behind the parent gate — we store the message, the category chosen, the app version and build, the iOS version, the device model, the device locale, and the Explorer ID it came from. The form has no email field, deliberately: if you want a reply, write to support@wonderspy.app from your own mail client instead, and your address stays in your sent folder rather than in our database.

A feedback document never contains your child's name, a photograph, a mission or session identifier, or a location.

4.3 Deletion requests

If a grown-up asks for deletion from Grown-ups → Delete my data (behind the parent gate), the app asks for an email address so we can confirm when the deletion is done. We store it with the request and the Explorer ID, and use it only to process and confirm that request.

4.4 Technical information

Like any app, WonderSpy needs some technical data to deliver the service and keep it working:

• App configuration. The app downloads its settings (for example which features and safety options are switched on) through Firebase Remote Config, which uses a Firebase installation identifier to deliver them. The settings are the same for everyone and are not personalised.
• Protecting our servers. The app uses Firebase App Check with Apple's App Attest to prove it is a genuine copy of WonderSpy before it reads or writes our servers.
• Crash reports. WonderSpy contains no crash-reporting software. If you have chosen in iOS Settings to share analytics with app developers, Apple may pass us crash reports under Apple's own privacy policy.

None of this is used for analytics or advertising. Our website logs standard request data (IP address, user agent, referring page) for security and aggregate traffic counts, and uses no advertising or analytics cookies.

5. Limited usage data, and how to switch it off

WonderSpy records limited usage data about how the app performs, so that we can find what is broken and make the missions better. This is product analytics, and we want to be plain about it rather than bury it.

Who handles it. We use one outside analytics service: Google Analytics for Firebase, provided by Google as our service provider. We use the version of it that has no support for advertising identifiers, and we have set it up as follows:

• Google's analytics-storage and all advertising consent settings are permanently set to denied. In this mode Google's software sends events without an app-instance, user or device identifier.
• It does not collect the device's advertising identifier (IDFA) or the identifier for vendor (IDFV), and automatic screen tracking is switched off.
• We never attach the Explorer ID, the spy name, the age band or any account, session or mission identifier to these events.
• Google signals, links to Google Ads or AdMob, audiences, remarketing and raw-data export are not used.

What it looks like. A small, fixed set of events, each holding only counts, broad ranges and fixed labels — for example: a mission was started and completed; the camera became ready, in a time range such as "1–2 seconds"; a capture was accepted; a reward was saved; a safety reminder was shown. The app's code rejects anything outside that fixed list, so these events can never contain your child's name, a photograph, what was photographed, any typed text, a location or an exact time of day.

What Google's software adds. Like any app request, the events reach Google from the phone's internet (IP) address, and Google's software attaches basic technical context such as the app version, iOS version, device model, and language and approximate country. Google states that Google Analytics does not log or store IP addresses.

What it is never used for. This information is never sold, never shared with advertisers, never used to build a profile of a child, and never used to change what an individual child sees in the game.

How to switch it off. In the app: Grown-ups → Privacy preferences → Share limited usage data. The toggle is behind the parent gate, takes effect immediately, clears the analytics data held on the phone, and survives restarts. It is on by default; turning it off stops every analytics event. Because these events carry no Explorer ID, they cannot be traced back to your child or retrieved and deleted for one person. Two things continue regardless, because they are the app working rather than analytics: your child's own play progress still saves, and the safety log — a grown-up's own record of what the app showed their child — still records.

6. Camera, photos, and where the checking happens

This is the part parents ask about most, so we'll be precise.

• The first check happens on the phone. When your child photographs something, the app examines the picture on the phone itself to judge whether it is the thing the mission asked for. Nothing leaves the phone for this.
• The second check also happens on the phone. When the first look is not certain, the app asks Apple's on-device Apple Intelligence model, built into iOS, whether the photograph matches what the mission asked for. WonderSpy uses only that on-device model — not Apple's Private Cloud Compute servers, and not any other company's AI — so the photograph stays on the iPhone, and the check works even in Airplane Mode. Phones without Apple Intelligence simply skip this step.
• The photograph is never sent anywhere. We never receive, store or see a photograph your child has taken, and neither does Apple or Google. All the app uses is a yes or no, and a hint to show if it was a no.
• Photos are not kept. A capture is held in the phone's memory only for as long as the check takes, then discarded. It is not saved to the app's storage, to your camera roll, or anywhere else. The Wonder Book and WonderCards use the game's own pictures, not your child's photographs.
• Nothing is uploaded to us without an explicit choice. If we ever offer a feature that would send an image to our servers — for example to help improve recognition — it will be off by default, will require a grown-up to turn it on from behind the parent gate, will say in plain language exactly what is uploaded, and will be revocable at any time.
• Camera permission. iOS asks for camera access the first time a mission needs it. You can withdraw it at any time in iOS Settings; the rest of the app, including the Wonder Book, keeps working.

7. What we do not collect

Stated positively, because the absences matter as much as the list above. WonderSpy does not collect:

• a phone number or postal address — from a child or from a grown-up;
• an email address from a child — the only email we hold is one a grown-up chooses to give when asking us to delete data (§4.3);
• a date of birth or an exact age;
• a password, or any credential for another service;
• location of any kind — the app requests no location permission, and holds no location data;
• contacts, calendars, photos from the camera roll, or the microphone;
• a device advertising identifier (IDFA), or any persistent cross-app identifier;
• your child's photographs — they are checked on the phone and never leave it (§6);
• any text a child has typed, other than the optional spy name (§4.1).

8. Why we process it, and our legal basis

Purpose	Data used	Legal basis (GDPR / DPDP)
Running the game and saving progress	Explorer ID, profile, play progress	Performance of a contract; consent of the parent
Safety interruptions and their log	Play and safety events	Legitimate interest in child safety
Fixing problems, improving missions and difficulty	Limited usage data (§5)	Consent — the toggle in §5 — with our legitimate interest in a working product, balanced against the minimal, non-identifying nature of the data
Answering feedback and support	Feedback document, your correspondence	Legitimate interests; performance of a contract
Carrying out deletion requests	Explorer ID, the grown-up's email address	Legal obligation
Fraud, abuse and security	Technical data, App Check, server logs	Legitimate interests; legal obligation

Where we rely on consent, you may withdraw it at any time, and withdrawal does not affect processing carried out before you withdrew.

9. Who we share data with

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not disclose it to data brokers. We use a small number of service providers, each bound by contract to process data only on our instructions:

Provider	What it does	What it receives
Google Firebase (Google LLC / Google India)	Signing in anonymously (Authentication), storing progress, settings, feedback and deletion requests (Cloud Firestore), delivering app configuration (Remote Config), protecting our servers (App Check), and limited usage measurement (Google Analytics for Firebase, §5)	Explorer ID, spy name, age band, play data, safety log, feedback, deletion-request email. Separately, usage events that carry no Explorer ID or device identifier. No photographs.
Apple Inc.	App distribution through the App Store	Standard App Store download and diagnostic data, governed by Apple's own privacy policy.

We may also disclose information where we are legally required to, to establish or defend legal claims, or to protect the safety of a child or another person. If WonderSpy is ever acquired, data may transfer as part of that transaction — it would remain subject to this policy, and we would notify users before any material change.

10. Advertising and profiling

There is no advertising in WonderSpy and there never will be. The app contains no advertising or tracking software, and the one outside analytics service it uses (§5) runs with every advertising feature switched off. We do not build advertising profiles, we do not permit retargeting, and we do not use any child's information to train advertising systems or any general-purpose AI model.

We do not carry out automated decision-making producing legal or similarly significant effects. The app adjusts mission difficulty from play history — ordinary game balancing, affecting nothing outside the game.

11. How long we keep things

Data	Retention
Profile and play progress	While the Explorer ID is in use. Deleted within 30 days of a deletion request.
Captured photographs	On the device only, under your control. Removed when the app is deleted.
Limited usage data	Google Analytics is set to keep event-level data for 2 months. Google's standard aggregated reports (totals with no individual records) are kept by Google beyond that; summary exports we make ourselves are deleted after 13 months.
Deletion requests (including the grown-up's email)	As long as needed to complete and confirm the request and to show it was carried out.
Feedback documents	24 months.
Support correspondence	24 months from the last message.
Dormant Explorer IDs	Deleted after 24 months with no activity.

12. Your rights, and how to delete your data

Depending on where you live, you have some or all of the following rights, which a parent exercises on a child's behalf: access to the data we hold, correction of anything inaccurate, deletion, portability, restriction of or objection to certain processing, and withdrawal of consent at any time.

To delete from the app, go to Grown-ups → Delete my data. We carry out the deletion after 7 days, and you can stop it from the same screen until then; the phone then starts fresh.

To exercise any right by email — including deletion, write to support@wonderspy.app and quote your Explorer ID — you'll find it in the app under Grown-ups, and tapping it copies it in full. Because there are no accounts, that ID is the only way we can find your records; without it we cannot identify which data is yours, and we will have to say so rather than guess. Limited usage data (§5) carries no Explorer ID, so it cannot be found or deleted for one person.

We acknowledge requests within 7 days and complete them within 30 days, confirming when it is done. Backups containing the data are overwritten on our normal cycle, within 90 days. Deleting the app removes the local copy on that phone immediately; it does not by itself remove the server copy, which is what a deletion request is for.

If you would rather raise a formal grievance, our Grievance Officer is named in section 17 and reachable at the same address. You can also complain to your data protection authority: in India the Data Protection Board; in the EEA your national supervisory authority; in the UK the Information Commissioner's Office. We do not charge for any of this, and we will not make the app worse for you because you asked.

13. Security

We protect information with measures appropriate to how sensitive it is: it is encrypted both while it travels and while it is stored, our servers only let a phone read and write its own records, access to live data is restricted, and every write is checked against a list of the fields it is allowed to contain, so nothing unexpected can be stored by accident. The strongest protection here is architectural: the most sensitive thing in this product — a photograph taken by a child — is never sent to our servers at all, so it cannot be exposed by a breach of them. How captures are checked on the phone is set out in section 6.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to anyone's rights, we will notify the relevant supervisory authority and affected users without undue delay, within the timeframes our applicable laws require (72 hours under the GDPR; as prescribed under the DPDP Act).

14. International transfers

We are based in India and our service providers operate globally, so data may be processed in India, the United States and the European Union. Where we transfer personal data out of the EEA or the UK we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), with additional technical measures. You can request a copy of the relevant safeguards from support@wonderspy.app.

15. Region-specific notices

India — Digital Personal Data Protection Act, 2023

We process the personal data of children only with the consent of a parent or lawful guardian. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children, and we do not process children's data in a way likely to cause any detrimental effect on their well-being. You may write to our Grievance Officer (below) and, if unsatisfied, complain to the Data Protection Board of India.

United States — COPPA

WonderSpy is a child-directed service under the Children's Online Privacy Protection Act. We collect from children only the limited information listed in section 4, never condition a child's participation on disclosing more than is reasonably necessary, and never disclose a child's personal information to third parties for advertising. A parent may review what we have collected, refuse further collection (by switching off usage data and by deleting the data), and require deletion by writing to support@wonderspy.app — see section 12. The operator responsible is named in section 1.

EEA and UK — GDPR, and the Age Appropriate Design Code

Where processing is based on consent and the user is below the age of digital consent in your country (13–16 depending on the member state; 13 in the UK), that consent is given and can be withdrawn by the holder of parental responsibility. We apply data protection by design and by default and follow the UK Age Appropriate Design Code as our baseline: high-privacy defaults, no nudge techniques toward weaker privacy settings, no profiling for advertising, and no geolocation collected at all.

California — CCPA/CPRA

We do not sell or share personal information as those terms are defined under California law, and have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16 under any circumstances.

16. Changes to this policy

If we change this policy we will update the date and version at the top. Where a change is material — particularly any change to what we collect from children, or to who we share it with — we will surface it in the app before it takes effect and, where the law requires, seek fresh consent. We keep previous versions and will provide one on request. Section 17 names the changes we already know are coming.

17. Planned changes: accounts and purchases

This policy describes WonderSpy as it works today. Two changes are planned, and we would rather name them here than have them appear one day without warning. Neither is live now, and this policy will be updated — and, where the law requires it, fresh parental consent sought — before either one ships.

17.1 Optional accounts

A later version will let a grown-up create an account, so that progress survives a reinstall or a new phone and can be shared between a household's devices. When it arrives it will be optional — playing anonymously with an Explorer ID will remain possible — and it will be created and controlled by a grown-up from behind the parent gate, never by a child. An account will mean we hold a contact identifier we do not hold today (most likely an email address, or a Sign in with Apple identifier which may be a relay address). We will say exactly what is collected, why, and for how long, before the feature is enabled.

17.2 Purchasable Wonder Coins

Wonder Coins are earned through play today and cannot be bought. A later version is expected to allow buying them as an in-app purchase. When it arrives:

• Purchases will be made through the Apple App Store. Apple is the merchant of record and processes the payment. We will never receive or store your card number, bank details or billing address — we receive only a record that an entitlement was granted.
• Every purchase screen will sit behind the parent gate, and no price or store will be reachable from a child-facing screen.
• We will hold a purchase and entitlement history against the Explorer ID or account, and keep it as long as tax and accounting law requires.
• Nothing about advertising changes: there will still be no ads, no advertising software from other companies, and no use of what anyone buys to target them.

Until those features ship, nothing in sections 4 to 11 is affected by them.

← Back to WonderSpy  ·  Terms & Conditions  ·  Contact us