Privacy policy

Last updated: 21 June 2026

This privacy policy explains how [DEVELOPER NAME PLACEHOLDER] ("we," "us," "our") collects, uses, and protects personal information when you use FishyFractions (fishyfractions.co.uk and play.fishyfractions.co.uk). Please read it carefully.

We are the data controller for the purposes of UK GDPR and the Data Protection Act 2018. [ICO REGISTRATION NUMBER PLACEHOLDER — to be added on completion of ICO registration].

What information we collect

If you play without an account

  • No personal information is collected. Your progress is stored in your browser's local storage on your device only. We do not receive it.
  • Anonymous analytics events may be sent to PostHog (see Analytics below) to help us understand how the game is being used. These events do not include personal identifiers.

If you create a free account

  • Email address — used to verify your account, send transactional emails (verification, password reset), and allow you to sign in.
  • Game progress data — topic progress, coin balance, aquarium state. Stored in our Supabase database (EU region).

If you purchase premium

  • Payment details are handled entirely by Lemon Squeezy. We do not see or store your card number. We receive a notification of a successful purchase and your order ID from Lemon Squeezy.
  • Purchase records (amount, date, email address) are stored for 7 years as required by UK law.

If your child plays under a school licence

  • Student account data (email address, progress) is held under a Data Processing Agreement with the school. The school is the data controller for student data.

How we use information

  • To provide the game and save your progress across devices
  • To verify your email address and enable sign-in
  • To process and verify your purchase
  • To respond to support requests
  • To send transactional emails (account verification, password reset, purchase confirmation) via Resend
  • To improve the game using anonymised usage data

We do not use your data to send marketing emails. We do not share your data with third parties for marketing purposes.

Legal basis

  • Contract — processing your account and purchase to provide the service you have requested.
  • Legal obligation — retaining purchase records for 7 years.
  • Legitimate interests — anonymised analytics to improve the game, fraud prevention.
  • Consent — [PLACEHOLDER — if we add any consent-based processing e.g. optional marketing, update here].

Third-party services

Supabase

Our database and authentication provider. User accounts, progress data, and purchase records are stored in Supabase. Data is held in the EU. Supabase is a processor under our instruction and operates under a Data Processing Agreement. Supabase privacy policy →

Lemon Squeezy

Our payment processor. All payment card data is handled by Lemon Squeezy. We do not see or store card numbers. Lemon Squeezy acts as a Merchant of Record for purchases, which means they are responsible for tax compliance. Lemon Squeezy privacy policy →

Resend

Our transactional email provider. We use Resend to send account verification, password reset, and purchase confirmation emails. Your email address is shared with Resend only for the purpose of sending these emails. Resend privacy policy →

PostHog

We use PostHog for game analytics. PostHog receives events describing gameplay actions (e.g. "question answered correctly," "topic started") and purchase funnel events. Events are tied to an anonymous or pseudonymous session ID. If you have an account, events may be associated with your account ID (not your email address) for the purpose of understanding player progression. PostHog privacy policy → [AUDIT PLACEHOLDER — data retention period in PostHog: confirm and add here]

Children's privacy

FishyFractions is designed for ages 11–14. We do not knowingly collect personal information from children under 13 without parental consent. If a child under 13 creates an account, we ask that a parent or guardian provides consent. If you believe a child under 13 has provided us with personal information without consent, please email support@fishyfractions.co.uk and we will delete that information.

Under a school licence, the school is responsible for ensuring appropriate consent under their own data policies.

Cookies

We use the following cookies:

  • Authentication session cookie (Supabase) — keeps you signed in. Session cookie, deleted when you close your browser or sign out.
  • PostHog analytics — a persistent cookie containing an anonymous session ID, used to aggregate analytics across visits.
  • [AUDIT PLACEHOLDER — list any additional cookies set by Lemon Squeezy embed or other third parties]

We do not use advertising cookies or tracking cookies for third-party advertising.

How long we keep data

  • Account data and progress — for as long as your account is active, plus 30 days after deletion to allow recovery if deleted in error.
  • Purchase records — 7 years, as required by UK law.
  • Support emails — 2 years from resolution.
  • Analytics events — [AUDIT PLACEHOLDER — confirm PostHog retention period].

Your rights

Under UK GDPR you have the right to:

  • Access a copy of the personal data we hold about you
  • Correct inaccurate or incomplete data
  • Delete your data (subject to legal retention obligations)
  • Restrict or object to processing in certain circumstances
  • Data portability — receive your data in a machine-readable format
  • Withdraw consent where processing is based on consent

To exercise these rights, email support@fishyfractions.co.uk. We will respond within 30 days. If you are not satisfied with our response, you can complain to the Information Commissioner's Office (ICO).

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page will change when we do. We will notify users of material changes by email where we hold your email address.

Contact

Questions about this policy: support@fishyfractions.co.uk

← Back to Fishy Fractions