Privacy Policy

1. Who we are

NeuroDinoWorld is run by a sole trader trading as NeuroDinoWorld (ABN 71 243 092 197), Mount Duneed, Victoria, Australia. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Privacy contact: hello@neurodinoworld.com.au

2. Who the app is for

NeuroDinoWorld is rated 4+ and is designed for young children, including neurodivergent children (for example ADHD and autism), using the app with a parent or carer. A parent or carer (18 or over) sets the app up, passes an adult check, and creates any account. Children do not create accounts.

3. Sensitive information

Because the app is designed for neurodivergent children, using it may suggest your child has a neurodivergent condition, which the Privacy Act treats as sensitive (health) information. By setting up the app you consent to us holding this implied information only to provide the app. We never use it for anything else and never share it for marketing or profiling.

4. What we collect, and why

Your account (if you create one). Your email address, and your name if your sign-in provider (Google or Apple) shares it, plus an account ID from Firebase Authentication. Passwords are handled by Firebase; we never see them. We also add your email (and first name, if given) to our own mailing list to send welcome and free-trial emails.

Without an account. The app creates a random ID on your device. That ID is used to save and restore your child's progress.

Your child's profile and progress. Your child's first name (and the first names of siblings you add), their chosen buddy character, interests, stars, badges, scores, game progress, feelings check-ins and energy log, journal and gratitude entries, the Toy Box choices you make in Parent View, and any personal stories or special messages you write for them. This is stored on the device and synced to our database (Google Cloud, Sydney, Australia), whether or not you have an account, so it can be restored and shared across your family's devices.

Personalised voice lines. Characters speak some lines using your child's first name (for example "Hi Zara!"), and can read personal stories or special messages you write. To make that audio, the text of the line is sent to ElevenLabs, which creates the voice, and the finished audio file is stored in our cloud storage in Sydney so it can be replayed without making it again. Audio files made before 13 September 2026 may also have the line's text saved with the file. These files cannot be browsed or listed by the public.

AI-written stories. In Voice Adventures, the world your child picks and the idea they speak or type are sent to Anthropic (Claude) to write the next part of the story. In Choose Your Own Adventure, an idea your child types is sent to Google Gemini. We do not save these ideas or stories in our database. Please help your child not to include personal details in their ideas.

Two-player games with siblings. Some games (such as Rock Paper Scissors and Dance Party) have a two-player mode. It only connects devices signed in to the same family account, so brothers and sisters in the same household can play together. There are no room codes to share, no chat, no friend lists, and no way to find or be found by anyone outside your family. While a game is running, the child's first name is shown to their sibling on the other device. Game rooms are held briefly in Google's Firebase Realtime Database (Singapore) and are not searchable.

Microphone. In Animal Sounds, the microphone level is measured on the device to score the sound. That audio never leaves the device and is never recorded. Other voice features (for example saying an answer or turning a story page by voice) use your device's built-in speech service (Google on Android and Chrome, Apple on iPhone and iPad), which may send audio to Google or Apple under their own privacy policies. We only receive the words, never the audio. The microphone is always optional and every voice feature has a tap alternative.

Motion sensor. Dance Party's Dance Off reads the device's motion sensor during a turn to score movement. This happens on the device only and is never recorded or sent anywhere.

Payments. Purchases are handled by Apple, Google Play, or on our website by Stripe, all through RevenueCat. We never see card details. We receive your subscription status, product, store, expiry date and the account ID or email linked to the purchase, so we can unlock premium.

Adult check record. When a parent passes the adult check, we store the time, the account or device ID, the IP address and the device/browser details, as a record that a parent gave consent.

Keeping the app working.

• Crash reports (Sentry): error details, device and browser type, app version, the account or device ID, and the IP address the report came from. Sentry is never sent your email, your child's name or journal entries.
• Our own usage counts: simple events such as "app opened" (once a day), sign-up, reaching the end of the free trial, purchase, a subscribe screen being shown, premium access ending, and whether a voice line played in the right voice. These are linked to the account or device ID and used only to improve the app. We do not use third-party analytics or advertising trackers.
• Android only: a Google Play Integrity check result, to confirm the app is a genuine copy.
• Server logs: our hosting providers (Google Cloud and Cloudflare) keep standard request logs, including IP addresses, for about 30 days.

On the device. The app uses the device's local storage for settings, progress, free-play counts and cached content. We do not use advertising cookies or tracking pixels.

We do not collect your location, contacts, photos or camera, advertising identifiers, or browsing history.

5. How we use information

• To run the app, personalise it for your child, and save and restore progress
• To manage your account, subscriptions and free trial
• To send account and free-trial emails (via Resend)
• To answer support requests
• To find and fix faults, and to keep the service safe and prevent misuse

We do not use information for advertising, profiling or automated decisions about you or your child, and we never sell, rent or trade it.

6. Services we use

We share information only with these providers, only as needed to run the features described above:

• Google Cloud: our servers, database and file storage (Sydney, Australia)
• Firebase (Google): sign-in (global) and two-player game rooms (Singapore)
• Google Gemini: Choose Your Own Adventure ideas (United States)
• Anthropic: Voice Adventure stories (United States)
• ElevenLabs: character and narration voices (United States)
• RevenueCat, Apple, Google Play and Stripe: purchases and subscriptions (United States and global)
• Resend: account and trial emails (United States)
• Sentry: crash reports (United States)
• Cloudflare: hosting the app and website (global)
• Google Fonts: text fonts, which means Google sees the device's IP address when fonts load (United States)

7. Overseas transfers

Our main database and file storage are in Australia. Some of the providers above are overseas (mainly the United States, and Singapore for game rooms). We take reasonable steps to use providers with privacy protections consistent with the Australian Privacy Principles.

8. Security

• All data is sent over encrypted connections (HTTPS).
• When you are signed in, our servers check your sign-in token before reading or changing your data, so only you can access it.
• Without an account, the random device ID is the only key to your child's saved progress, so keep the device secure.
• We never store payment card details, and access to our systems is restricted.

If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

9. How long we keep information

• Account, child profile, progress, adult check records and usage counts: until you delete your account. Deleting your account in the app removes these from our database straight away.
• Progress saved without an account: until you ask us to delete it.
• Saved voice audio and pictures: kept in cloud storage until you ask us to remove them. They are not removed automatically when an account is deleted.
• Crash reports: up to 90 days. Server logs: about 30 days.
• Payment records: kept by Apple, Google, Stripe and RevenueCat as the law requires.
• On the device: until you clear the app's data or uninstall it.

10. Your rights and choices

You can ask to access, correct or delete the information we hold about you or your child, or withdraw your consent by deleting your account.

• Delete in the app: sign in, open your account (Manage Account) and tap Delete my account.
• Everything else (including progress saved without an account, and saved voice audio or pictures): email hello@neurodinoworld.com.au. We will reply within 30 days.

11. Children's privacy

• A parent or carer sets up the app and passes an adult check before a child uses it.
• We do not knowingly let children create accounts or give us information without a parent.
• There is no advertising and no chat with strangers.
• Parents can review or delete their child's information at any time (see section 10).

United States (COPPA): if you believe we hold a child's information without a parent's consent, email us and we will delete it promptly. EU and UK (GDPR): you also have rights to data portability, to restrict processing, and to object. We process data to provide the service you asked for, and for AI and voice features, with your consent.

12. Changes to this policy

We will update this policy when the app changes. The date at the top shows the latest version. For significant changes, we will let you know in the app or by email.

13. Contact and complaints

NeuroDinoWorld (ABN 71 243 092 197), Mount Duneed, Victoria, Australia. Email hello@neurodinoworld.com.au.

If you are not happy with how we handle a privacy concern, you can contact the Office of the Australian Information Commissioner: oaic.gov.au, phone 1300 363 992.