Privacy policy

Last updated August 2, 2026

QuillQuest is a learning game for kids. We built it to be private by design. There is no account, no login, and nothing that identifies your child. We do not collect names, ages, email addresses, phone numbers or precise location — none of that ever leaves the device.

If a grown-up switches on syncing, game progress is stored on our server so a second device can pick it up. That is the only thing we ever store about your child, and it is off by default. The details are in Syncing across devices below. (Downloading the optional extra audio is a separate thing and stores nothing — see "The optional audio download".)

The short version

• No accounts, ever. You don't sign up, log in, or give us a name or email. There is no login and no user record — not for you, not for your child.
• If you turn on syncing, the only thing that syncs is game progress — levels, stars, XP, badges, streaks and practiced words, stored under an anonymous code. No name, no age, no email. It's off unless a grown-up switches it on (see "Syncing across devices").
• The game plays without a network. The full game — every level, every subject, your default voice — works with no internet. Optionally, extra voices and recorded example-sentence audio download once from a content host and are then saved on the device. That request carries no personal information — see "The optional audio download" below for exactly what it does and does not reveal.
• No ads. No tracking. No analytics. There are no advertising networks, no third-party trackers, no analytics SDKs, and no cookies.
• No personal data goes to anyone. We don't collect or share personal information. The optional audio download is an ordinary request for an audio file — the same file for everyone — that identifies no one.

Deleting your data

You do not have to ask us — everything is erasable from inside the app, and each control says exactly what it removes.

• Settings → Reset all progress clears that player's game progress and disconnects syncing, so the progress cannot come back from another device. It also deletes that player's synced save from our server. It leaves the player's name, avatar and settings in place.
• Settings → Manage players → Remove player deletes that player completely — name, avatar, settings and progress — and deletes their synced save from our server too.
• Deleting the app removes everything held on the device.
• In a browser, clearing your browser data clears everything, because that is where it lives.

What is kept, and for how long: if syncing was never switched on, nothing about your child exists off the device and there is nothing for us to delete. If it was, the synced save (game progress only — never a name or an age) is deleted immediately by either control above, and any copy not deleted that way expires automatically one year after the last activity. We keep no backups of it beyond that.

If something does not work as described, write to contact@malcom.io and we will erase it for you.

What's stored on your device (and only your device)

To make the game work, QuillQuest saves the following locally on the device, using the operating system's on-device storage. None of it is uploaded unless a grown-up turns on syncing, and even then only the game progress goes — never the age or the name:

• A player's chosen age (used only to pick a starting level).
• An optional first name and avatar (emoji, color, accessory) you choose.
• Game progress — levels, stars, XP, badges, streaks, and which words were practiced.
• Settings — theme, voice, sound/haptics, and reminder preferences.

See Deleting your data below for how to erase any of it.

The optional audio download

The core game is built into the app and needs no network. To keep the initial download small, some extra audio — additional voices, and the recorded "use it in a sentence" clips — is fetched once, on demand, from a content-delivery host (Cloudflare R2) and then cached on the device, so each clip downloads only a single time.

• The request is a plain fetch of an audio file. It carries no name, no account, no advertising identifier, and no identifier for your child, and it never says whether an answer was right or wrong.
• Being precise about one thing, because it would be easy to overclaim: each clip is stored under the word it speaks, so the request for a clip names that word. On a phone or tablet the extra audio is fetched ahead of time over Wi-Fi, so by the time your child plays there is usually nothing left to request. Until that finishes — and always in the browser version, which streams clips as it needs them — the sequence of requests reflects the words being practised. It never reflects how your child did.
• If the device is offline, the game simply uses the device's built-in voice for that clip instead — nothing breaks.
• The host (Cloudflare) serves the file over a standard, cookie-free request. There is no ad network, no analytics SDK, and no advertising or per-child identifier involved — just a request for the audio file.

Because these files are identical for every user and contain no personal data, this is content delivery, not data collection — nothing about your child is stored or shared, and no profile of any kind is built. The one thing a request does reveal is described above: the word the clip speaks.

Playing in a web browser

QuillQuest is also playable in a web browser. The browser version is the same game with the same rules: no accounts, no ads, no tracking, no analytics, no cookies. Progress is saved in your browser's local storage on your own device, exactly as the app saves it on a phone or tablet, and it is not uploaded unless syncing is switched on.

Two things are unavoidably different when a game is served over the web, and we would rather say so plainly than imply the browser version is identical:

• A web host serves the page. Loading a website means a server sends it to you, and like every web server it records ordinary technical request logs — IP address, time, browser type. We do not use these to build a profile, they are not linked to any player, and there is no account for them to be linked to. They are a by-product of the web working at all; an installed app has no equivalent.
• Recorded audio is fetched from a content host as it is needed, and then cached by your browser. The request is for a plain audio file, identical for every player, and carries no name, no account and no identifier for your child. Note that the browser version fetches clips on demand rather than ahead of time, so — as described under "The optional audio download" — the sequence of requests does reflect the words being practised. It never reflects how your child did, and nothing is stored.

Speech spoken by your browser's built-in voice is restricted to voices your device synthesizes locally, so practice words and sentences are not sent to a cloud speech service.

Clearing your browser data clears the saved progress, since that is where it lives.

Notifications

The daily "come practice" reminder is off by default and optional. If a parent turns it on, it schedules a single local notification on the device at a chosen time. It uses no servers and no push tokens — nothing about it leaves the device.

Syncing across devices

There is no account and no login. We never ask for a name, an email or a password, and there is nothing to sign into. The only thing that syncs is game progress — the same progress listed above, nothing else.

Syncing is off unless a grown-up turns it on, in Settings, behind a question a young child can't answer. Your child is never asked to set it up and cannot get through that question, though they can see the Settings row like any other.

When it's on, the device stores that player's game progress under a short sync code (ten characters, shown grouped like K7M2-QX9F-4K) so another device can pick it up. What that means precisely:

• What's stored: levels, stars, XP, badges, streak days, and which words are being practiced — the same game progress listed above.
• What is never stored: no name, no age, no email, no password, no phone number, no location. There is no account and no user record. We cannot tell who a save belongs to, and we have no way to contact you. — The player's avatar (a cartoon buddy) is included so a parent can confirm they're

connecting the right child's progress before anything is combined. A chosen first name is not included, and never leaves the device.

• A child's age is never sent. Only the starting level it implies is sent.
• The code itself is not stored. The server keeps a one-way scramble (a hash) of it, so even we cannot list codes or read a save without being given the code.
• A save also carries two random identifiers — one for the player's save and one for each device writing to it. They exist so two devices can be told apart and merged correctly. They are random, are not derived from anything about your child or your hardware, and are meaningless outside QuillQuest.
• The contents of a save are never logged. As with any internet service, our server sees the IP address a request comes from; it is used only to limit how often a code can be tried, and it is never stored alongside a save.
• Saves are deleted after a year with no activity.
• Turning sync off in Settings stops it immediately. The device keeps everything it has, and the stored save stops being updated.
• Deleting a synced save: Settings → Reset all progress removes it from our server.
• Sync is never required. The full game still plays with no internet.

We use Cloudflare Workers KV to store saves. Cloudflare processes the request on our behalf and receives no personal information from us.

How long anything is kept

On the device: progress stays until you erase it — Settings → Reset all progress, Remove player, or by deleting the app. In a browser, clearing your browser data clears it, because that is where it lives. We set no expiry, because it isn't ours to expire.

On the sync server (only if a grown-up turned syncing on): a save is deleted automatically after one year with no activity. Turning syncing off stops the device writing to it; the copy then ages out on that same one-year clock.

Everything else: nothing is kept, because nothing is collected. There are no accounts, no profiles on our systems, no analytics records, no logs of what your child practised, and no backups of any of it.

Children's privacy

QuillQuest is designed for children (roughly ages 8–14, grades 3–8). The app collects no personal information about a child — no name, no age, no email, no phone number, no location, no advertising identifier — and there is no account, so there is nothing that identifies a child to attach anything to.

Two things leave the device, and neither identifies anyone: an anonymous request for an audio file, and — only if a grown-up switches syncing on — that player's game progress under an anonymous code. We cannot tell whose progress a save is, and we have no way to contact you. We do not knowingly collect personal information from children or anyone else.

Changes to this policy

If this policy ever changes, the updated version will be posted at this URL with a new effective date. The commitments that won't change: no accounts, no ads, no tracking, no analytics, and nothing collected that identifies a child.

Contact

Questions? Email contact@malcom.io.