Percy's Playroom — Privacy Policy
About this policy
This privacy policy explains how Percy's Playroom handles information in the official Android / Google Play app. It covers the touch games, parent dashboard and optional video features. Some features use external services, as described below. This policy does not describe private development builds that include additional tools.
An account with us is not required. We do not ask children to provide their name, email address, date of birth or a profile. A grown-up manages settings and optional connections through the parent dashboard.
Information kept on your device
The app stores settings, enabled activities, content filters, navigation history and playback positions. The parent dashboard stores activity records, including game or video identifiers and titles, session times, active play or playback duration and touch counts. These records help parents understand activity on this device. The full dashboard history is not uploaded; the limited YouTube recommendation records described below are sent separately.
Saved drawings and other supported creations, video metadata and thumbnails, speech audio, and copies downloaded from a family media server are stored locally. The app can read the film folder a grown-up chooses through the system file picker to list and play those files. It does not upload the chosen films or drawings to us.
The Android app writes the latest unhandled crash's technical stack trace to a local diagnostic file. It does not automatically send that file to us.
YouTube search and video playback
Using the YouTube feature sends search terms, pagination tokens and video identifiers to our video-search service, hosted by Supabase, and/or to Google's YouTube Data API. Our service caches search results for use across devices and keeps aggregate query-use and API quota counts. Search requests do not include the local parent-dashboard history.
After a video has been meaningfully watched, the app sends its video identifier, title, channel, thumbnail, duration and approximate watched duration with a randomly generated persistent app-install identifier. The service converts that identifier to a one-way keyed value before storage. It uses play counts to place favourites earlier for that installation and to suggest kid-verified videos enjoyed on installations with overlapping favourites. It does not receive a child's name, email address, advertising ID or device hardware identifier.
Viewing video thumbnails and playing an embedded YouTube video connects your device to Google / YouTube. Google receives the requested content identifiers and standard connection information, such as IP address, request time and browser or device information. The embedded player may also use cookies or similar storage and collect playback interactions according to Google's privacy policy. YouTube may display its own advertising. Disabling YouTube in the parent dashboard stops the child opening this feature; local games remain available.
A grown-up can optionally enter their own YouTube Data API key. The app stores that key in private app preferences and sends it to Google when that fallback is used. We do not receive the key through the video-search service.
Speech and sound
Spoken activity prompts and subject names are pre-recorded and bundled with the app. Playback uses those local audio files. The installed app does not call a speech-generation API, include a speech API key, or upload prompt text or microphone recordings to a speech-generation provider.
If a bundled recording is unavailable, the Android app can use an installed device voice that reports that it works offline. If no suitable offline voice is installed, the activity continues without that spoken line. Speech is supplementary to the pictured controls and visible reactions.
Some bundled speech recordings were created with AI during development. They are generated voices, not recordings of a person speaking live. Playing them does not send user or device data to the speech-generation provider.
Optional family media servers
If a grown-up connects Jellyfin, Emby or Plex, the app processes the chosen server address, account or user identifier, sign-in information, access token, media-library details and requested media. Jellyfin and Emby credentials are sent to the chosen server. Plex account credentials are sent to Plex for authentication, unless the grown-up supplies an existing token. Entered passwords are used for sign-in and are not saved by the app; access tokens and connection details are saved in private app storage.
A randomly generated, persistent app-install identifier is sent to these media services so they can recognize this app's connection. It is not the device's IMEI or advertising ID. A connected server receives requests for library information, images and films and can log those requests, account identifiers and connection information. These credentials and local media copies are not sent to our YouTube-search service. The chosen server operator and Plex, where used, handle their records under their own privacy practices.
Purposes, recipients and advertising
We use local information to save progress and creations, resume playback, apply parent controls and show the parent dashboard. Network requests supply requested searches, videos and media-server connections. Limited YouTube play records provide per-installation favourites and recommendations between installations with similar viewing. Technical request information may be processed to deliver these services, manage quotas, maintain security and diagnose failures.
Recipients include our hosting provider Supabase, Google / YouTube, and the family media-server operator or Plex when connected. Internet services receive connection information such as IP address when the device contacts them. An IP address can reveal an approximate location. The app does not request GPS location, contacts, camera access or the Android advertising ID.
We do not sell user information, include our own advertising SDK, or send the local parent-dashboard history to an analytics or advertising service. Third-party video services' own processing and advertising are described above. Information may also be disclosed when required by applicable law or to protect the security of the service.
Children and parent choices
Percy's Playroom is intended for young children with a grown-up managing settings. The games do not require children to submit identity or contact details. The app's local activity records describe use of activities on a device, rather than a registered child account. Parents can disable YouTube, individual activities and optional media sources through the parent dashboard.
Online features communicate with the external services listed in this policy. Parents should review those services' policies before choosing to use them. Please do not include a child's sensitive details in a support message. If you believe information about a child has been provided to us, contact us to request review and deletion where applicable.
Security
Local app records and access tokens are kept in app-specific storage protected by the operating system. The Android app disables Android's app-data backup. Internet API requests to Google, our Supabase service and Plex's sign-in service use HTTPS.
A family media-server address entered by a grown-up can use HTTP. Such connections are not encrypted; use an HTTPS server address when available, particularly outside a trusted home network. We cannot guarantee the security of a family's server, a device or an external service.
Retention and deletion
Local settings, activity history, saved creations and connection tokens remain until removed by available app controls, clearing the app's storage, or uninstalling the Android app. Temporary caches can be replaced or removed when space is needed. The latest local crash file is replaced by a later crash or removed with app storage. Clearing app storage removes saved progress and settings as well as tokens. Films in a separately chosen folder are not deleted by clearing the app's storage.
Our shared YouTube-result cache and recommendation display metadata refresh or expire within 29 days. Anonymous per-installation video counts and duplicate-event records expire after 365 days without activity. Frequently requested data may be refreshed. Clearing app storage creates a new random identifier, so the service cannot link the new installation to the old anonymous record. Hosting and external service providers may retain their own request or security logs under their service policies and configured retention. Deleting the app does not delete Google / YouTube, Plex or a family server's own records; contact the relevant provider or server operator for those requests.
If you contact us, we process your email address, message and information you choose to provide to respond to your inquiry. We retain correspondence for as long as needed to resolve the request and meet applicable legal obligations. You may contact us to request access, correction or deletion of personal information we hold, subject to applicable legal requirements. There is no account with us to delete.
Changes and contact
We will update this policy when the app's data practices change. The effective date identifies this version. The published webpage and in-app policy will be updated together.
Privacy policy website
The public privacy policy webpage is hosted by Cloudflare Pages. Opening that webpage sends standard connection information, including your IP address and requested page, to Cloudflare so it can deliver and protect the website. The policy page does not use analytics scripts, advertising, forms or tracking cookies. Cloudflare handles its infrastructure records according to its own privacy policy.
Contact
Published by Dave O'Donoughe. Privacy inquiries: support@davesrandomgames.com.