Galaxy Defender

COPPA Compliance Statement

Last updated: July 30, 2026

Galaxy Defender is designed for children and built to comply with the U.S. Children’s Online Privacy Protection Act (COPPA). We collect no personal information from or about children — no names, no photos, no birthdates. There are no adverts and no third-party tracking of any kind.

This statement describes how AI Canadian Solutions complies with COPPA (16 CFR Part 312) in the Galaxy Defender game. It supplements our Privacy Policy.

1. What we collect from children

We do not collect children's names. A pilot profile is a number and an emoji the grown-up picks — “Pilot 1”, “Pilot 2” — never a name or nickname. We do not ask for a birthdate, an address, a phone number, or any free-text about a child.

The optional pilot photo is processed in the browser's memory only. It is never uploaded, never stored on our servers, and disappears when the game is closed. The alternative to a photo is a cartoon pilot, which is just a picture we supply.

Learning data — which math facts have been practised, how the difficulty should adapt, high scores — is kept on the child's own device so the game works without any account.

2. What reaches our servers

Two things, and we describe both plainly:

Anonymous play summaries. When a mission ends the game sends the game played, how long it lasted, the score, how many math questions were answered correctly, and which channel the game was opened from (browser, installed app, or an app store). This carries no name. It carries a random device identifier so we can tell one device playing ten times from ten devices playing once.
Optional parent account data. If a grown-up chooses to create an account, we store their email address and password, an age band for each pilot, and that pilot's play and math results so the grown-up can see progress across devices.

3. The random device identifier

The device identifier is a random string generated on the device. It is not a phone number, an advertising ID, or a fingerprint, and it tells us nothing about who is using the device.

We use it solely to understand how the game is used and to keep it working — what COPPA calls support for internal operations. We do not use it for advertising, we do not build profiles, and we do not combine it with anything from outside the game.

Guest play records, including the device identifier, are deleted automatically after 90 days by a scheduled job.

4. Parental consent

Because we collect no personal information from or about a child, there is nothing here that requires verifiable parental consent to gather. We have designed it that way on purpose.

An account belongs to the grown-up, not the child. Creating one sits behind a parent gate — a multiplication question intended for an adult — and requires an explicit confirmation that the person signing up is the parent or guardian and is over 18. That confirmation is recorded with a timestamp.

5. No advertising, no third-party tracking

There are no adverts in the game. There are no advertising SDKs, no analytics SDKs, no social plugins, and no cross-site tracking. We do not sell or rent anything we hold, to anyone, ever.

6. Who else touches the data

Only service providers acting on our instructions, and only as much as the job needs:

Hosting and storage — DigitalOcean and Amazon Web Services (Canada region).
Email delivery — SendGrid, used only to email a grown-up about their own account (for example, confirming a deletion). Never used to email a child.
Coarse location for security — when a grown-up signs in we record their IP address, and an administrator may look up the approximate city to spot suspicious sign-ins. This applies to the adult's sign-in only.

7. Parental rights

A grown-up may at any time:

Review everything held for their pilots — the Parent Zone shows the report card and a question-by-question answer log;
Refuse further collection by not creating an account, or by signing out — the game plays fully without one;
Delete everything with one tap. “Delete My Child's Data” in the Parent Zone permanently removes the account, every pilot profile, every play session, every math result and every sign-in token. There is no backup copy and it cannot be undone.

Open the Parent Zone with the gear icon in the game, or contact us below. We confirm a request comes from the account holder before acting on it.

8. Security & retention

Everything travels over HTTPS. Passwords are stored hashed, never in readable form. We keep only what is described above, and:

guest play records are deleted after 90 days;
account data is kept while the account exists and is deleted immediately on request;
a deletion is confirmed by email to the grown-up, listing exactly what was removed.

9. Operator & contact

The operator of Galaxy Defender for COPPA purposes is:

AI Canadian Solutions
Email: games@aicanadiansolutions.ca

If you believe a child has given us information we should not hold, contact us and we will delete it promptly.