Privacy policy
CurlyScript is a game for learning JavaScript. We collect as little information as we can. We don’t sell it, and we don’t use it to track you across other apps or websites. The only ads are optional ones that players aged 13 and over can choose to watch in the apps, to get a heart back (see Ads).
Playing without an account
You can play every lesson, the Dojo and the Code Lab without an account. Everything stays on your device: your name, progress, coins, badges, hearts, streak, settings and saved programs. Nothing is sent to us. Deleting the app, or clearing your browser data, deletes it.
When you start, the game asks everyone when they were born. It doesn’t keep the date, only an age range (under 13, 13 to 17, or 18 and over), so it can follow the rules for younger players. The age range stays on your device unless you make an account.
The website
On the CurlyScript website you can play without an account, and the game itself has no ads. Without an account, your progress stays in your browser, on your device, and isn’t sent to us. Players aged 13 and over can make a free account to keep their progress and carry on on other devices; Accounts explains what we keep.
To learn whether people find CurlyScript useful, the website may count a few anonymous things with GoatCounter: visits to the front page and the game, the website a visitor came from, screen size, which buttons on the front page are tapped, how far players get (like finishing the first lesson, or coming back on a second day), which extra features get used, and whether the share button or “Put CurlyScript on your phone” gets used. GoatCounter uses no cookies and doesn’t store anything that identifies you. Names, answers, code and anything else you type are never sent.
If you share your progress, the message goes through the app you pick, like WhatsApp or X, and that app’s own privacy policy applies. We don’t see what you send or who you send it to.
Accounts (for players aged 13 and over)
Accounts are optional. When you make one we ask for your birth month and year to check that you’re 13 or older. We don’t keep your birth date. We only keep the age range (13 to 17, or 18 and over) in your save, so the game can follow the rules for younger players. With an account, our server stores:
- your username (used to log in, never shown to other players) and your display name (shown to friends who follow you, so please don’t use your full real name)
- your password, stored only as a scrambled hash that can’t be turned back into the originals
- your game progress: lessons, XP, coins, badges, streaks, hearts, daily quests, practice schedule, Professor Curly’s outfit and your settings
- the friends you follow, the players you block, and any reports you send about a player, a question or an ad
- your email address. It’s used for one thing: sending you a code to confirm the address, and a code to reset your password if you forget it. We don’t send newsletters or marketing, don’t show it to anyone, and you can change it any time in Account (deleting your account deletes it). The emails are sent by Resend, which receives the address and the email’s text to deliver it.
- the date your account was created, and login tokens (also stored as hashes) that keep you signed in. Tokens stop working after 90 days without use.
We don’t ask for your phone number, location, contacts, photos or microphone. Your internet (IP) address is used for a short time to stop people guessing passwords, and isn’t stored in our database.
Signing in with Google
If you choose “Continue with Google”, Google tells us your Google account’s ID number, your email address (which Google has already confirmed), and your name, which we only use to suggest a display name. We keep the ID number, so you can sign in again, and the email address, as above. We don’t get your Google password, contacts, or anything else in your Google account, and we don’t post anything. Google’s own privacy policy covers what Google does when you use its sign-in button. You can add a password in Account, and deleting your account deletes the Google ID too.
Who can see your information
- Friends who follow you (they need your friend code) can see your display name, Professor Curly’s outfit, your level, your weekly XP and your streak.
- CurlyScript has no public leaderboards or leagues at the moment. If we add them later, we’ll update this policy first, and they will show only your display name, Professor Curly’s outfit, your level and your XP.
- Our moderators can see reports, and can reset a rude name, hide a player from public lists, or remove an account that breaks the rules.
Nobody else gets your information, except service providers that help us run the game (below) and where the law requires it.
CurlyScript Plus (subscriptions)
Plus is sold through the App Store and Google Play. Apple or Google handle the payment, so we never see your card or bank details. We use RevenueCat to check purchases with Apple and Google. RevenueCat receives a random player id (not your name or username), the plan you bought, and your purchase and renewal history. Our server keeps whether Plus is active and when it renews or ends.
Certificate links
If you make a link for a certificate, our server keeps the certificate's code, your display name, the grade and the date you passed it. Anyone with the link can see those four things, and nothing else about you. Deleting your account deletes your certificate links too.
Ads
The Android and iPhone apps have one kind of ad: if you run low on hearts, you can choose to watch a short video ad to get a heart back, a few times a day. There are no ads between lessons, no banners and no pop-ups, and the website has no ads at all.
- Only for players aged 13 and over. Players under 13, and players whose age we don’t know, are never offered ads. For them, the ad service is never even started, so nothing is sent to it. CurlyScript Plus members never see ads either.
- Who shows the ads: Google AdMob. When you choose to watch an ad, Google receives what it needs from your device to show the ad, count it and stop fraud: your IP address (which shows roughly where you are), information about your device and the app, whether you watched the ad, and identifiers that Google’s ad service sets for this app. We don’t give Google your name, username or progress. Read how Google uses this information at policies.google.com/technologies/partner-sites.
- Never personalized: we ask Google for ads that aren’t based on your interests or on what you do in other apps, and only for ads suitable for all ages. The Android app doesn’t use your advertising ID, and the iPhone app never asks to track you.
- Your consent: where the law requires it (for example in the EU and the UK), Google’s consent form asks you before your first ad. You can change your answer any time in Settings → Ads → Ad privacy choices.
- Report an ad: if you see an ad that isn’t OK, use “Report an ad” in Settings → Ads or on the hearts screen. Your report comes to us, with your account if you’re logged in.
Reminders
If you turn on daily reminders in the app, they are scheduled on your device. Nothing about them is sent to us. You can turn them off in Settings at any time.
Your choices and rights
- See and download your data: Me → Account → Download my data.
- Change your name: on the Me page. Change your password: Me → Account.
- Delete your account: Me → Account → Delete my account, or use the account deletion page. Deletion is immediate and permanent. A Plus subscription is managed by Apple or Google: cancel it in your store account too.
Depending on where you live (for example in the EU, the UK, California or Brazil), you may have more rights, such as objecting to how we use your data or complaining to your data protection authority. Contact us to use them.
Keeping it safe and how long we keep it
Everything between the app and our server is encrypted (HTTPS). Passwords, login tokens and the codes we email are stored only as hashes. When you delete your account its data is removed from the database straight away. Copies in server backups are overwritten within 30 days.
Children
CurlyScript is made for learners of all ages. Players under 13 can play everything without an account, and we don’t collect personal information from them. They never see ads, and the ad service is never started for them. If you’re a parent or guardian and think a child under 13 has made an account, contact us and we’ll delete it.
Changes and contact
If this policy changes, we’ll update the date at the top of this page, and tell you in the app if the change is important. Questions? Contact the publisher of this app at privacy@example.com.