1. What we collect, and why
We collect as little as possible — only what a child needs to take part in a class. For each child we store:
- person A first name (children are roughly ages 8–12) — so the teacher and the story can speak to your child by name during the live class.
- badge A chosen job or role and one personal stat (for example, "brave" or "curious") — the playful details your child picks when they create their character.
- auto_stories Class activity during a session — things like votes, clues found, and which part of the town they're in, so the live classroom works.
We use that first name, chosen job/role, and personal stat to generate personalized story content with AI — for example, a townsperson who greets your child by name and reacts to the character they made. This is done only to make the class feel personal and welcoming.
We do not collect home addresses, birthdays, photos of children, phone numbers, or school records. Parents provide their own email when they sign up, which we use to contact the family and run the account.
What we never do
- block We never sell your or your child's data to anyone.
- smart_toy We never use your child's data to train AI models. A child's name and details are used only to create that child's own class content, in the moment.
- groups We never run unsupervised classes. Every session is led live by a teacher — children are never alone with strangers.
- child_care We never let a child create their own account. A parent always signs up on the child's behalf.
2. How it's stored and protected
Your data is stored using Supabase, a secure database service that runs on Amazon Web Services (AWS) — the same infrastructure trusted by major companies worldwide. Access is protected and limited to what's needed to run a class.
We keep session data for up to 30 days, then delete it. After a class, your child's session details are automatically removed within 30 days unless you've asked us to keep an account active for ongoing classes.
Because our servers are hosted on global AWS infrastructure, your data may be processed on servers outside your home country. We only work with providers that keep data secure, and we keep the amount of data tiny on purpose.
3. Parental consent
Hiso Town is for children, but it is bought and managed by parents and guardians. When you sign up, you are giving permission, as the child's parent or legal guardian, for your child to take part and for us to collect the small amount of information described above.
A child never signs up on their own. If you no longer want your child to take part, you can ask us to delete their data at any time (see below).
4. How to see or delete your data
You are in control. At any time you can ask us to show you what we hold about your child, correct it, or delete it completely. Just email:
Tell us your child's first name and the class or teacher, and we'll find the record and delete it. We aim to respond within a few days, and to complete deletions promptly.
5. Your rights where you live
We serve families across several countries, each with its own privacy law. Our promise is the same everywhere — collect little, protect it, never sell it, and delete it on request. Here's how that lines up with the law in your region.
🇹🇭 Thailand
Thailand's Personal Data Protection Act (PDPA) requires that we have a clear reason to collect personal data, that we ask for consent, and that we let you access or delete your data. Because our users are children, we rely on a parent or guardian's consent. You can withdraw that consent and request deletion at any time by emailing us.
🇸🇬 Singapore
Singapore's Personal Data Protection Act (PDPA), overseen by the PDPC, requires consent, a clear purpose, and reasonable protection of personal data. For young children, the law expects a parent or guardian to give consent on the child's behalf — which is exactly how our sign-up works. You may ask to access or delete your child's data at any time.
🇰🇷 South Korea
Korea's Personal Information Protection Act (PIPA), overseen by the PIPC, is among the strictest in the world. For children under 14, it requires the consent of a legal guardian. Since a parent always signs up on the child's behalf, this consent is built into our process. We collect the minimum information, store it briefly, and delete it on request.
🇹🇼 Taiwan
Taiwan's Personal Data Protection Act (PDPA) requires that we tell you why we collect data, use it only for that purpose, and honor requests to view or delete it. For a minor, we rely on the consent of a parent or legal representative. You can contact us any time to access or remove your child's information.
🇯🇵 Japan
Japan's Act on the Protection of Personal Information (APPI), overseen by the Personal Information Protection Commission (PPC), requires us to state our purpose for using data and to get consent before sharing it with others — which we don't do. For a child, a guardian gives consent. We keep data only as long as needed and delete it on request.
🇦🇪 United Arab Emirates
The UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) requires consent, a clear purpose, and your right to access or delete your data. For children, we rely on parental consent. We do not sell data or use it for advertising, and you may request deletion at any time.
6. Changes to this policy
As Hiso Town grows, we may update this policy. When we do, we'll change the "Last updated" date at the top. If we ever make a big change to how we handle children's data, we'll let parents know by email.
Questions about anything here? We're a small team and happy to help — email chase@hisotown.com.