Privacy policy
Last updated 8 October 2026
Draft: this text is still being checked and is not yet in force.
In short
- Thought Zoo has no ads, no tracking and no accounts. We don't sell or share anyone's data for advertising.
- Progress, explorers' names and their animals stay on the device. We never learn a child's name.
- To answer, the game sends each question's text to our server and to the AI services that answer it. A game is kept for at most two hours.
- The microphone is on only while the big button is held. Speech becomes text; no recording reaches us or is kept.
1. Who we are
Thought Zoo is made by [name or company, address, OIB], Croatia ("we"). We are responsible for the data described here. For anything about privacy, write to hello@thoughtzoo.app.
2. Made for children
Thought Zoo is a game for children aged 6 to 12 and is built to collect as little as possible. It asks for no name, email, age, photo or location, and there is no chat with other people. Explorers' names, if a grown-up types one, never leave the device. Everything a grown-up may want to change, like buying or settings, sits behind a parental gate.
Because children can say or type anything, a question could by accident contain something personal. Please help your child keep questions about the animal. We don't look for personal information in questions and don't use them to identify anyone.
3. What stays on the device
- Each explorer's name (if one was typed), their animal, stars, medals and the games they played.
- Settings: language, Sammy's voice, the typing box, moving scenes.
- A random device code made on first start. It identifies the device to our server for a game in progress and, after buying, for what was bought. It isn't linked to a person, an account or the device's own identifiers.
- Pictures the app downloads so it can draw them without the internet.
On iPad and iPhone, a family's explorers can follow them to their other Apple devices through iCloud, under the parent's Apple ID. That is Apple's service: nothing of it passes through our server. Deleting the app (or clearing the browser's site data) deletes everything on the device.
4. What our server receives, and for how long
| What | Why | Kept |
|---|---|---|
| The device code, a random code for the explorer playing, the questions and guesses of a game in progress | To play the game: Sammy needs the game so far to answer the next question | Up to 2 hours after the last question, then deleted |
| A Croatian question's English translation, with no device code or anything else attached | So the same question needn't be translated again | Until we clear it |
| The internet address (IP) and the time of each request | To limit how often one device may ask (so the game stays affordable) and to keep the server safe | Up to 14 days in error logs |
| After buying: which adventures or subscription the device code owns, as the App Store or Google Play confirm it | To open what was bought | While it is owned, and as long as the law requires for purchases |
The website's landing page sets one cookie, for the language you picked. The game in a browser keeps its progress in the browser's own storage, as the app does on the device.
5. Who else takes part
These services handle data for us, only to run the game, under contracts that bind them to that purpose:
- TypeSafe decides Sammy's answer: it receives a question's text (in English) and the facts about the secret animal. [where it processes, how long it keeps text]
- Anthropic translates Croatian questions into English and writes Sammy's clues: it receives a question's text, or the game's questions so far for a clue. [retention under our contract]
- ElevenLabs turns a clue into Sammy's voice: it receives only the clue's text, written by Sammy, never a child's words.
- Hetzner (Germany) hosts our server and stores the pictures; Bunny delivers the pictures; Laravel Forge manages the server.
- Speech to text happens on the device where it can (Apple's or Google's own recognisers). Where the device can't, for example Croatian on some older iPads, Apple turns the speech into text on its servers under Apple's privacy policy. In a web browser, the browser's own speech service does it (Google's in Chrome, Apple's in Safari).
- Buying goes through the App Store or Google Play, under their own terms and privacy policies. We never see payment details. [RevenueCat, once purchases are built]
Some of these companies are outside the European Union. Where data goes there, it is protected by the European Commission's standard contractual clauses or an adequacy decision.
6. What we never do
- No advertising, and no third-party analytics or tracking.
- No selling or renting of data, and no profiling of children.
- No recordings of voices.
- No using children's questions to train AI models. [confirm with each provider's contract]
7. The legal basis
We process this data because it is needed to provide the game a grown-up chose for the child (performance of a contract), and, for the request logs, our legitimate interest in keeping the service safe and affordable. We don't ask children for consent and don't rely on it.
8. Your rights
You may ask us for access to data about you or your child, to correct or delete it, to restrict it, or to object, and you may complain to the Croatian data protection agency (AZOP, azop.hr) or your own country's. Since we hold no names or accounts, most data can't be linked to a person: deleting the app removes everything on the device, and a game in progress disappears from our server by itself within two hours. Write to us and we'll help with anything else.
9. Changes
If this policy changes, we'll update it here with a new date, and for important changes say so in the game's grown-ups' pages before they apply.