Privacy Policy

Roll & Read is a phonics reading game for young children. Grown-ups (parents, guardians and teachers) create the account and set up a “reader” for each child; children only play. This policy explains what information we collect, why, who we share it with, how long we keep it, and the rights parents and teachers have. It includes our notice of children’s information practices under the Children’s Online Privacy Protection Act (COPPA).

The short version

• Only adults can create an account. Children never give us an email address, a last name, a photo, their voice or their location.
• For each child we keep a first name or nickname, an avatar, and their game progress, so the game can teach at the right level and grown-ups can see how reading is going.
• No advertising, no selling or renting of information, no tracking across other websites, no chat and no public profiles.
• Parents and teachers can see, change and delete a child’s information at any time. Readers nobody has played for two years are deleted automatically.

1. Who we are and how to reach us

Roll & Read is operated by NMT Direct INC, doing business as Roll & Read. We are the only operator that collects or keeps children’s information through Roll & Read, and we answer all questions from parents and schools about it.

• Email: support@rollandreadgame.com
• Website: rollandreadgame.com

2. Who uses Roll & Read

An account can only be created by an adult, at least 18 years old, who is the parent or legal guardian of the children they add, or a teacher using Roll & Read for school with the authority to do so. The account holder adds one “reader” per child. Children play through their reader; they cannot create an account, sign in on their own, buy anything, or change settings. Grown-up areas (Settings, Billing and the Teacher dashboard) can be locked with a grown-up PIN.

3. Information we collect

From the grown-up who holds the account

• Sign-in details: your email address and, if you choose one, a password (stored only by our sign-in provider, Clerk, never by us in readable form). Clerk also records the device and browser used to sign in, to protect your account.
• Grown-up PIN: if you set one, we store only a scrambled (hashed) version.
• Billing: if you subscribe, Stripe collects your payment details. We never see or store your card number; we keep a Stripe customer reference, your plan and its status.
• Messages you send us, such as support emails.

About each child, entered by the grown-up

• A first name or nickname (we ask for no last names), an avatar picked from a set of emoji, a starting reading level, a word setting and a color theme.

Created as a child plays

• Game progress: which words were read and how many tries each took, words that need more practice, reading level and level-ups, coins, stickers, streaks, and session summaries (date, length, accuracy).

Collected automatically when anyone uses Roll & Read

• Device and connection information: the device’s IP address, browser type and the pages requested, which our hosting and delivery providers receive with every request, and a sign-in cookie that keeps the grown-up’s session open.
• Anonymous visit counts and page speed (Vercel Web Analytics and Speed Insights). These use no cookies and do not identify anyone.
• Crash reports: if the app breaks while someone is signed in, we record the error, the page it happened on, the browser type and the account it happened in, so we can fix it. Reader names, words and answers are not included.

Under COPPA, an IP address or similar identifier from a child’s device counts as personal information. We use these identifiers only to support the internal operations of Roll & Read: to deliver pages, sounds and images, keep the grown-up signed in, keep the service secure, count visits anonymously, and find and fix problems. They are never used for advertising, to contact a child, to build a profile of a person, or to track anyone across other websites. We make sure of this by using no advertising or tracking services at all, and by using only providers that process this information for us and for no purpose of their own.

What we never collect from children

No last names, email addresses, phone numbers, home addresses, photos, video, voice recordings, precise location, or any government ID. Roll & Read does not use a microphone or camera, has no chat or messaging, and gives children no way to make any information public.

4. How we use information

• To run the game: say each word aloud, choose words at the right level, bring back missed words for practice, award coins and stickers, and save progress.
• To show grown-ups how each child is reading (Progress page, word bank and Teacher dashboard).
• To run accounts and subscriptions, answer support requests, and send account emails such as sign-in codes and payment receipts. We do not send marketing email to children, ever.
• To keep Roll & Read secure, prevent abuse, and fix problems.
• To meet legal obligations.

We do not show advertising (contextual or targeted), sell or rent personal information, “share” it for cross-context behavioral advertising, build profiles of children for any purpose other than teaching reading in the game, or use children’s information to train artificial intelligence.

5. Parental notice and consent

Roll & Read is designed so that a grown-up is involved before a child plays. The adult who creates the account is shown this policy at sign-up, confirms they are the child’s parent, guardian or teacher, and then adds each reader themselves. Adding a reader is how a parent agrees to the collection and use described here. A parent who does not agree can delete the reader (or the whole account) at any time, and we will stop collecting and delete the child’s information.

We do not disclose children’s information to third parties other than the service providers listed below, who handle it only so Roll & Read can work. If we ever wanted to share children’s information with anyone else, we would first ask for the parent’s separate consent, and a parent could say no and still use Roll & Read. If we ever change how we collect, use or share children’s information in a meaningful way, we will notify account holders and ask for consent before the change applies.

6. Schools and teachers

When a teacher or school uses Roll & Read for classroom learning, the school may consent on behalf of parents, as the Federal Trade Commission allows, but only for the school’s educational purpose and never for any commercial use. In that case we act as a service provider to the school, under the school’s direct control of the data, and:

• use student information only to provide Roll & Read to the school;
• never sell it, use it for advertising, or build profiles for any non-educational purpose;
• delete it when the school asks, or when the teacher deletes the readers or the account;
• help the school answer a parent’s request to review or delete their child’s information.

Schools remain responsible for giving parents any notices their own policies or laws (such as FERPA and state student-privacy laws) require. Parents of students can contact their teacher or us at support@rollandreadgame.com.

7. Who we share information with

We use these service providers. Each processes information only on our behalf, under written terms that require them to keep it confidential and secure:

• Clerk (sign-in): the grown-up’s email, password and sign-in device details.
• Convex (our database): account, reader and game-progress information.
• Vercel (website hosting): device and connection information needed to deliver the site, short-lived server logs, and anonymous visit counts and page speed.
• Cloudflare (sticker image delivery): the device’s IP address, needed to deliver the images.
• Stripe (payments, grown-ups only): billing details for subscriptions.

We may also disclose information if the law requires it, to protect the safety of a child or anyone else, or to protect Roll & Read from fraud or abuse. If Roll & Read were ever sold or merged, this policy would continue to apply to information collected under it, and we would notify account holders first.

8. How long we keep information (our data retention policy)

We keep children’s information only as long as it is reasonably needed to provide the game, and never indefinitely:

• Reader information and game progress are kept so a child can pick up where they left off and grown-ups can see progress. They are deleted right away when a grown-up deletes the reader or the account, and automatically when nobody has played that reader for 2 years (unless the account is on an active paid plan, in which case we keep them until the reader or account is deleted).
• Crash reports are kept for 90 days to find and fix problems, then deleted automatically.
• Server logs (device and connection information) are kept by our hosting providers only for short periods, typically days and never more than 30 days, for security and troubleshooting.
• Grown-up account information is kept until the account is deleted. When an account is deleted, its readers and their data are deleted at the same time and any subscription is canceled.
• Billing records are kept by Stripe for as long as tax and accounting laws require. They contain no information about children.

Deleted information may remain in our providers’ routine backups for a short time before it is overwritten; it is not used during that time.

9. Your rights: review, change, delete, and stop collection

A parent, guardian or teacher who holds the account can, at any time:

• Review what we have about a child on the Progress, Words and Stickers pages and the Teacher dashboard.
• Change a reader’s name, avatar, level and settings in Settings.
• Delete a reader and all of their data in Settings (the delete button next to the reader).
• Delete the whole account from the account menu (Manage account, then Delete account). All readers and their data are deleted, and any subscription is canceled.
• Stop further collection by deleting the reader; nothing more is collected about that child.

You can also email support@rollandreadgame.com to ask for a copy of a child’s information or for deletion. To protect children, we act on requests that come from the account holder’s email address or that we can otherwise verify come from the child’s parent or school, and we respond within 30 days. Depending on where you live, you may have further rights to know, correct or delete personal information; we honor them for every user, and we will never treat you differently for using them.

10. How we protect information

We keep a written information security program, which we review at least once a year. It includes: encrypted connections (HTTPS) everywhere; data stored with providers that encrypt it at rest; checks on every request so an account can only reach its own readers; hashed PINs; limiting who can access production systems; choosing providers that commit in writing to keep information secure; and automated tests for these protections. No system is perfectly secure. If a breach ever affects your information, we will tell you and the authorities as the law requires.

11. Cookies and storage on your device

Roll & Read uses only the cookies needed to keep the grown-up signed in. It saves a few things in the browser itself, such as the color theme, sound settings and a board in progress, so they survive a reload. We use no advertising cookies and no third-party tracking. Our visit counts use no cookies.

12. Where information is stored

Roll & Read is intended for families and schools in the United States. Our database and sign-in records are stored in the United States; content delivery and payment providers may process requests on servers closer to you.

13. Changes to this policy

When we update this policy we change the “Last updated” date above. For meaningful changes we will email account holders before they take effect, and where COPPA requires it we will ask for consent again before using children’s information in a new way.

14. Contact us

Questions about this policy or a child’s information? Email support@rollandreadgame.com. We answer within 30 days, usually much sooner.