Off You Play | Privacy Policy
Off You Play Privacy Policy
How Off You Play handles parent account and child-profile information
Operator |
Master Data Marvel Ltd (HE471464) |
Last updated |
25 August 2026 |
Privacy at a glance: Parents control the account and may create multiple child profiles. Off You Play uses Firebase Authentication, Firebase Analytics, Firebase backend services, and RevenueCat. It does not use personal data for third-party advertising or cross-app tracking. Any activity photos are designed to remain only on the device. |
Master Data Marvel Ltd, registration number HE471464, of Charalampou Mouskou, 20 ABC CENTER, 3rd Floor, Flat/Office 306, 8010 Paphos, Cyprus, is the controller of personal data described in this Privacy Policy (Off You Play, we, us, or our).
Privacy questions and requests may be sent to privacy@offyouplay.com. General support requests may be sent to support@offyouplay.com.
This Privacy Policy applies to the Off You Play mobile application, website, and related services. Off You Play is designed around a parent-managed account. Children may use the child-facing play experience selected by a Responsible Adult, but children do not create or control accounts, manage subscriptions, follow external links, or change privacy settings.
The parent or legal guardian is responsible for creating and managing child profiles and for providing information about a child only where authorized to do so. A parent account may contain more than one child profile.
We use Firebase Authentication to create and protect parent accounts. Depending on the sign-in method, Firebase Authentication and Off You Play process the parent's email address, password or authentication credential, Firebase user identifier, account status, sign-in provider, user-agent information, IP address, and authentication and security metadata. Firebase uses IP addresses and user-agent information to help secure sign-up and sign-in and prevent abuse.
If you choose Sign in with Apple or Google, we receive the identifier and account details that the provider makes available according to your choices, which may include your email address and display name. We do not receive your Apple or Google password. Email/password credentials are handled by Firebase Authentication rather than stored in readable form in our own application database.
A parent may provide a child's nickname, age or age range, interests, activity preferences, and other selections needed to tailor suggestions. We do not require a child's email address, phone number, postal address, precise location, school, or government identifier. Please use a nickname rather than a full legal name and do not enter information the app does not request.
We may process activity filters and selections, activities shown, started, completed, skipped, or saved, duration choices, audio and timer settings, feature settings, and limited timestamps. This helps provide the requested experience, maintain progress, and avoid repeatedly suggesting the same content.
We use Firebase Analytics, a Google analytics SDK, to understand how the Service is used, measure feature performance, identify problems, and plan improvements. Firebase Analytics may collect automatically generated events and properties relating to app launches, sessions, screens or features viewed, buttons or functions used, activity and subscription events, and the timing and frequency of interactions.
Firebase Analytics may also process technical and pseudonymous information such as a Firebase installation or app-instance identifier, device category or model, operating-system and app version, language, time zone, general country or region information derived from network information, and related app and device information. Analytics data may be associated with the parent account or another identifier where the app configuration connects those records.
We do not intentionally send a child's name, photographs, precise location, health information, or free-form child content to Firebase Analytics as event names, event parameters, or user properties. We do not use Firebase Analytics for third-party advertising, data-broker disclosure, or tracking a user across apps or websites owned by other companies. Where consent is required, analytics collection must be enabled only after the Responsible Adult has been given the relevant choice.
Apple or Google processes payment-card and store-account information. We do not receive full card details. RevenueCat, an integrated subscription-management SDK and service, administers subscriptions, validates receipts, grants entitlements, prevents purchase fraud, and provides subscription analytics. RevenueCat may process a pseudonymous, anonymous, or account-linked app user identifier, product and subscription status, purchase history, transaction information, store receipt or purchase token, last-seen time, device type, operating system, app version, locale, and currency. Purchase history is used for App Functionality and Analytics. We do not provide RevenueCat with child-profile names or photographs.
When the Service communicates with our systems, Firebase services such as Authentication, Firestore or database services, Cloud Functions, hosting, App Check, and related infrastructure may process IP address, Firebase or installation identifiers, device and operating-system information, app version, language, time zone, request timestamps, authentication and security tokens, attestation or integrity signals, function-invocation metadata, diagnostic logs, and similar information needed to deliver and secure the Service. The precise data depends on the Firebase modules and features enabled in the released app.
If you contact us, we process your contact details, message, and any information you choose to provide.
Off You Play may allow a parent or child to take or select a photograph of a completed activity. When this feature is available, photographs are stored locally on the device. They are not uploaded to Master Data Marvel Ltd, Firebase, RevenueCat, or another Off You Play cloud service.
We do not receive, view, analyse, share, sell, use for advertising, or use for artificial-intelligence training those photographs. They are not available to other Off You Play users. The device operating system or a personal backup service, such as iCloud or Google backup, may separately back up local files according to the device owner's settings; Off You Play does not control those services.
Off You Play does not intentionally collect precise location, address-book contacts, a child's microphone recordings, health or biometric data, or the Apple advertising identifier (IDFA). The Service does not display third-party advertising, sell personal data, or use collected data for behavioural advertising or cross-app tracking.
Where the EU General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:
Contract: to create and administer the parent account, provide profiles and tailored activities, save settings and history, and manage subscription access.
Legitimate interests: where permitted, to keep the Service secure and reliable, prevent fraud and abuse, provide support, measure product performance using limited analytics, and establish or defend legal claims. We weigh these interests carefully, particularly where child-profile data is involved.
Legal obligation: to meet accounting, tax, consumer-protection, regulatory, and lawful-request obligations.
Consent: for Firebase Analytics where required, optional marketing, device permissions, or another purpose where consent is required. Consent may be withdrawn at any time without affecting earlier lawful processing.
We do not use acceptance of this Privacy Policy as blanket consent. Where a specific consent is needed, we ask separately and explain the choice.
Off You Play is not designed for a child to submit account information directly. A Responsible Adult creates the account, provides child-profile information, selects activities, and controls Parent Mode. Purchases, external links, account management, and privacy controls are placed in Parent Mode or behind a parental gate.
Under Cyprus law, where an information-society service offered directly to a child relies on the child's consent, a child aged 14 or older may provide that consent; for a younger child, consent must be given or authorized by the holder of parental responsibility. Off You Play's parent-managed design does not rely on a young child accepting this Policy or entering into a contract. If we introduce an optional feature that requires consent for a child's data, we will obtain any legally required parental authorization.
If you believe that a child provided personal data without appropriate authority, contact privacy@offyouplay.com. We will investigate and delete or otherwise address the data as required by law.
We disclose personal data only as needed for the purposes described here:
Google service entities through Firebase Authentication, Firebase Analytics, Firestore or database services, Cloud Functions, hosting, App Check, and other enabled Firebase modules. These services provide authentication, analytics, storage, hosting, security, integrity checks, and backend infrastructure. Google generally processes Firebase customer data on our behalf, while Google Analytics data is also governed by the applicable Google Analytics terms and settings;
RevenueCat, whose integrated SDK and service provide subscription analytics, receipt validation, entitlement management, fraud prevention, and related purchase administration;
Apple and Google, when you use their sign-in, app-store, purchase, or device services;
professional advisers and contractors bound by confidentiality where reasonably necessary for legal, accounting, security, or technical support;
public authorities or other recipients where required by law or necessary to protect rights, safety, users, or the Service; and
a purchaser or successor in a genuine corporate transaction, subject to appropriate confidentiality and continued protection of personal data.
Collection performed automatically by an integrated SDK is treated as collection through Off You Play even when the information is transmitted directly to, or retained by, the SDK provider rather than stored in our own application database. The principal production SDKs and services currently covered by this Policy are Firebase Authentication, Firebase Analytics, other enabled Firebase backend and security modules, RevenueCat, Apple sign-in and App Store services, and Google sign-in and Google Play services. Before adding an SDK that introduces materially different collection or use, we will assess its practices and update this Policy and applicable app-store privacy disclosures as required.
We do not share local activity photographs because we do not receive them. We do not sell or rent personal data, share child profiles with advertisers, or allow third-party behavioural advertising.
Some providers may process data outside Cyprus or the European Economic Area. Where required, we use an approved transfer mechanism, such as an adequacy decision or the European Commission's standard contractual clauses, together with supplementary safeguards where appropriate. You may contact privacy@offyouplay.com for information about the relevant safeguards.
We retain account, profile, activity, and settings data while the account is active and for only as long afterward as reasonably needed to complete deletion, maintain security, resolve disputes, enforce agreements, or comply with law. Firebase Analytics and RevenueCat records are retained according to our configured retention settings, the purpose for which they were collected, and applicable provider and legal requirements. We delete or anonymize personal data when it is no longer needed for those purposes.
Purchase and accounting records may be retained for the period required by tax, accounting, consumer, and fraud-prevention laws. Security logs and backups are retained on limited cycles and are then deleted or overwritten, unless preservation is required for an incident or legal obligation. Support correspondence is retained only as long as needed to address the request and related obligations.
Local photographs remain on the device until the device user deletes them, removes the app or its data, or a device or backup service handles them according to the user's settings. We cannot delete a local or personal-cloud copy that we do not control.
Subject to the GDPR and applicable conditions, you may have the right to:
ask whether we process your personal data and obtain access to it;
correct inaccurate or incomplete data;
request deletion of personal data;
restrict processing or object to processing based on legitimate interests;
receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller where the portability right applies;
withdraw consent at any time where processing relies on consent; and
lodge a complaint with a supervisory authority.
The parent account holder may review or delete child profiles and may initiate deletion of the entire account within the app. To make another request, email privacy@offyouplay.com. We may request information reasonably necessary to verify identity and authority, especially for a request concerning a child. We will respond within the period required by law.
You may complain to the Office of the Commissioner for Personal Data Protection, Kypranoros 15, 1061 Nicosia, Cyprus, commissioner@dataprotection.gov.cy, or to another competent supervisory authority in the country where you live or work.
You can initiate deletion of the Off You Play account from within the app. Deletion covers the account and associated child profiles and service data unless we must retain limited information by law. We may ask you to re-authenticate or confirm the request to prevent unauthorized deletion.
Deleting the account or app does not automatically cancel an App Store or Google Play subscription. Subscriptions must be cancelled through the applicable store settings.
We use technical and organizational measures designed to protect personal data, including access controls, authenticated access, security rules, encryption in transit, service-provider safeguards, and data minimization. We design the child-facing experience to avoid unnecessary data entry and keep adult functions in Parent Mode or behind a parental gate.
No system is completely secure. Protect your account credentials, device passcode, and parental gate, keep software updated, and contact support@offyouplay.com if you suspect unauthorized access.
Off You Play may use profile selections and activity history to rank or suggest activities. This tailoring does not make a decision that produces legal or similarly significant effects. We do not use child-profile data for advertising profiles or cross-service tracking.
Marketing email, if offered, is optional and requires the choice or other legal basis applicable in your location. You can unsubscribe using the message link or by contacting us. Service messages about security, accounts, purchases, or material policy changes are not marketing.
Device notifications are optional and controlled through device settings. We will explain the purpose when requesting permission and will not use child-profile data for behavioural advertising.
Parent Mode may contain links to third-party websites or services. Their privacy practices are governed by their own notices. External links and purchasing opportunities are intended to remain behind the parental gate, but the Responsible Adult should still review third-party practices before using them.
We may update this Policy to reflect changes in law, technology, providers, or the Service. We will publish the revised version and change the date above. If a change materially affects how we use personal data, we will provide additional notice and seek consent where required.
Master
Data Marvel Ltd
Registration No. HE471464
Charalampou
Mouskou, 20 ABC CENTER, 3rd Floor, Flat/Office 306
8010 Paphos,
Cyprus
Privacy: privacy@offyouplay.com
Support:
support@offyouplay.com
Master
Data Marvel Ltd |