Privacy policy

Last updated 13 October 2026

1. Who we are

Thought Zoo is made by CANDESCO d.o.o., Marianijeva ulica 1A, 52100 Pula, Croatia, OIB 37641966427, registered at the Commercial Court in Pazin under MBS 040301785 ("we"). We are responsible for the data described here. For anything about privacy, write to privacy (at) candesco (dot) hr .

2. Made for children

Thought Zoo is a game for children aged 6 to 12 and is built to collect as little as possible. It asks for no name, email, age, photo or location, and there is no chat with other people. Explorers' names, if a grown-up types one, never reach our server. Purchases, links out of the game and the grown-ups' pages sit behind a parental gate, to keep children from them without a grown-up.

Professor Sammy is an AI character: AI services help decide her answers and write her clues, within limits we set (she only talks about the secret animal, and there is no free chat). Because children can say or type anything, a question could by accident contain something personal, like a name. Please help your child keep questions about the animal. We don't ask for personal details in questions, don't look for them and don't use questions to identify anyone. Sammy's clues are written never to repeat them.

3. What stays on the device

• Each explorer's name (if one was typed), their animal, stars, medals, and the notebook of games they played with their questions.
• Settings: language, Sammy's voice, the typing box, moving scenes.
• A random device code made on first start. It lets our server find this device's game in progress and what this device bought. It isn't made from the device's own or advertising identifiers and holds no name, but since it recognises the device, privacy law can treat it as personal data. Grown-ups find it under Settings, to quote if they write to us.
• Pictures the app downloads so it can draw them without the internet.

On iPad and iPhone, a family's explorers (names, animals, stars, medals and their settings, but not the notebook) can follow them to their other Apple devices through iCloud, when iCloud is on for the device. That is Apple's service, under the Apple Account signed in on the device: nothing of it passes through our server.

Deleting the app removes what it keeps on the device, and clearing a browser's site data removes the browser game's progress. Explorers already in iCloud stay there until removed on another device or in iCloud. Purchases are kept by Apple, Google, RevenueCat and our server, so they can be restored.

4. What our server receives, and for how long

Our server receives only what the game needs. It never sends the device code, a name or your internet address to the AI services in section 5: they get the text of a question or a clue, nothing that says whose it is.

Apple and Google sell the adventures and subscriptions in their own name and pay us in bulk. Their statements to us show totals per country and product, not who bought. We keep those statements and our books for 11 years, as Croatian accounting law requires; they contain nothing about you or your child.

The website's landing page sets one cookie, for the language you picked; there are no advertising or analytics cookies. The game in a browser keeps its progress in the browser's own storage, as the app does on the device.

5. Who else takes part

These services handle data for us, only to run the game, each under a data processing agreement as the GDPR requires (Article 28):

• TypeSafe (TypeSafe AI, Inc., USA) helps decide Sammy's answer: it receives a question's text (in English) and the facts about the secret animal. It runs its own AI model on servers in the United States and doesn't pass the text to another AI company. It keeps request data only as long as it needs to run its service, and may keep technical logs to prevent abuse.
• Anthropic (Anthropic, PBC, USA) translates Croatian questions into English and writes Sammy's clues: it receives a question's text, or the game's questions so far for a clue. It deletes them within 30 days, unless its automated safety systems flag them as breaking its usage rules (then they may be kept up to 2 years) or the law requires longer.
• ElevenLabs (Eleven Labs, Inc., USA) turns Sammy's clues into her voice: it receives the text of a clue, never a child's voice. We delete each spoken clue from our ElevenLabs account within two days.
• RevenueCat (RevenueCat, Inc., USA) checks purchases and subscriptions with the App Store and Google Play, and shows us purchase totals, for example per store. It receives the device code, the purchases made with it, and technical details its software sends with each request: the internet address, the device model, system and app version, language and the store's country, and on Apple devices Apple's identifier for our apps on that device (not the advertising identifier). It gets no names and nothing about the game. It stores this on Amazon Web Services in the United States while we use its service; when you ask us to delete a device's data, we delete its record at RevenueCat too.
• Hetzner (Germany) hosts our server and stores the pictures. Bunny (Slovenia) delivers the pictures and keeps a shortened internet address (the last part removed) in its logs for 3 days. Laravel Forge (Laravel Holdings, Inc., USA) manages the server: it receives no game data, but can reach the server to maintain it.
• Speech to text happens on the device where it can. On Android the game uses only the device's own recogniser. On iPad and iPhone, where the device can't (for example Croatian on some older iPads), Apple turns the speech into text on its servers. In a web browser, the browser's own speech service does it (Google's in Chrome, Apple's in Safari). These services handle the sound under their own privacy policies (Apple's Siri, Dictation and privacy, Google's privacy policy); it never reaches us.
• Buying goes through the App Store or Google Play, under their own terms and privacy policies. We never see payment details.

Hetzner and Bunny are in the European Union, though Bunny may deliver pictures from a server near you if you are outside Europe. The others are in the United States, so data goes there. ElevenLabs and Laravel are certified under the EU-US Data Privacy Framework, which the European Commission recognises as adequate. For TypeSafe, Anthropic and RevenueCat we rely on the European Commission's standard contractual clauses, part of their data processing agreements. Anthropic may also run its models in other countries. Write to us to get a copy of these safeguards.

6. What we never do

• No advertising, no advertising trackers and no third-party analytics.
• No selling or renting of data, and no profiles of children for advertising or anything else.
• No voice recordings on our server.
• No using children's questions to train AI models. TypeSafe and Anthropic promise this in their contracts with us, and we have switched off training use in our ElevenLabs account.

7. Why we may use this data

• To play (the questions, the game in progress, the device code, the cached translations): our legitimate interest, which is the same as the child's: giving children the game they and their family chose. We weighed it with the child's interests first, which is why we collect as little as possible, keep games for at most two hours after the last question, send the AI services no code or address, and never use questions for advertising, profiles or training. You can object at any time (section 8). Without the questions the game can't be played.
• To keep the game safe and affordable (request logs): our legitimate interest in protecting the service and limiting misuse.
• To provide what a grown-up bought (purchases and restoring them): the contract with the grown-up who made the purchase. Buying is optional.
• To meet our legal obligations (accounting records, answering privacy requests): the law that applies to us.

We never rely on a child's consent.

8. Your rights

You can ask us what data we hold about you or your child, and ask us to correct or delete it, to limit how we use it, or to object to a use. Where it applies, you can ask for a copy to take elsewhere. You can also complain to the Croatian data protection agency (Agencija za zaštitu osobnih podataka, Ulica Metela Ožegovića 16, 10000 Zagreb, azop.hr) or your own country's.

We have no accounts or names, so to find a device's data, send us its device code from Settings in the grown-ups' pages. A game in progress is gone from our server within two hours by itself; we can delete the device's purchase records on request, after which they can no longer be restored.

9. For parents in the United States (COPPA)

Thought Zoo is directed to children under 13, so the US Children's Online Privacy Protection Act applies. This section adds to the rest of the policy.

• What we collect from children: the device code and the internet address, which the law counts as persistent identifiers, and the text of the questions a child asks, which could by accident include a name or other personal information. We don't ask for any personal information, and a child can play the whole game without giving any.
• Why: only to support the internal operations of the game: running the game in progress, answering questions, limiting how often a device may ask, keeping the service secure, and unlocking and restoring purchases. We never use the device code or the internet address to contact a child, to build a profile, for advertising or for anything else.
• Who receives it: only the service providers in section 5, to run the game for us, under contracts that limit them to that and require them to keep it secure. We don't sell children's information or disclose it to anyone else.
• How long we keep it: a game up to 2 hours after its last question, a translation 30 days, request logs up to 14 days, purchase records while they can be restored; then it is deleted. These periods are our written data retention policy, and we keep a written information security program.
• Your rights: you can ask to review the information we hold about your child, have it deleted, and refuse further collection (deleting the app stops all collection). Write to privacy (at) candesco (dot) hr with the device code from Settings in the grown-ups' pages, or by post to CANDESCO d.o.o., Marianijeva ulica 1A, 52100 Pula, Croatia.

10. Changes

When this policy changes, the date at the top changes too. Before an important change applies, we'll say so in the game's grown-ups' pages.