Who we are
Wizard's Magic Scales is operated by [Spottybear: exact legal name, company number if any, contact address]. We are the data controller for the personal data described here. Contact: privacy@wizardscales.co.uk.
What we collect
| Category | What | When |
|---|---|---|
| Account | Email address and a hashed password | When an account is created |
| Game progress | Stars and best move counts per puzzle, puzzle attempts, total spells cast, Infinite Spellcast sessions and personal bests, chosen background | While playing signed in |
| Accessibility settings | Text size, dyslexia font, colour mode, reduced motion | When changed while signed in |
| Purchases | Order reference, date and status | When the full game is bought |
| School link | The school matched to the account's email domain | When signing up with a school email |
| Website analytics | [To confirm once PostHog is configured: anonymised page and click events] | When visiting this website |
Playing as a guest: progress and settings are stored only in the browser on that device. Nothing is sent to us.
We do not collect a name, date of birth, photo, location or contacts. The game has no chat and no public profiles.
Children's privacy
Wizard's Magic Scales is designed for ages 8 to 14. Children can play the free world without an account, and no personal data is collected when they do.
A child aged 13 or over can create an account themselves. An account for a child under 13 must be created by a parent or guardian, or through a school licence. If we learn that a child under 13 has an account without this, we will delete it.
We collect the minimum needed to save progress. We do not show advertising, and we do not use children's data for marketing or profiling.
Why we use it, and our legal basis under UK GDPR
| Purpose | Legal basis |
|---|---|
| Running the account and saving progress | Contract |
| Processing a purchase and giving access | Contract |
| Keeping purchase records | Legal obligation |
| Keeping the game secure and fair | Legitimate interests |
| Understanding how the website is used | [Legitimate interests or consent, depending on the analytics setup] |
| School accounts | We act as processor for the school, under a data processing agreement |
Who we share it with
| Service | Purpose | Data shared |
|---|---|---|
| Supabase | Database and sign-in | Account data, progress, settings, purchase status. [Confirm storage region; Volt Racers states EU] |
| Lemon Squeezy | Web payments | Email address and purchase details |
| PostHog | Analytics | [To confirm. Not yet connected in the game] |
| [Email provider] | Account emails such as confirmation and password reset | Email address only. [Confirm provider; Volt Racers uses Resend] |
We do not sell personal data.
How long we keep it
| Data | Kept for |
|---|---|
| Active accounts | Until the account is deleted |
| Deleted accounts | Personal data removed within 30 days |
| Purchase records | 7 years, as UK law requires |
| Analytics | 24 months, then deleted. [Confirm; taken from Volt Racers] |
Your rights
Under UK GDPR you have the right to be informed, to access your data, to have it corrected, to have it erased, to restrict its use, to receive a copy you can take elsewhere, to object, and not to be subject to decisions made solely by automated means. We make no such automated decisions. A parent or guardian can use these rights for their child. Email privacy@wizardscales.co.uk and we will reply within one month.
Complaints
You can complain to the Information Commissioner's Office at ico.org.uk. We would welcome the chance to put things right first.
Changes and date
Last updated: [date]. We will post changes here and, for significant ones, tell account holders by email.