Pomble Privacy Notice
Effective 18 August 2026
Pomble has no adverts, behavioural tracking or sale of personal information. Account data exists to provide the family account and protect access—not to profile a child for marketing.
Who is responsible
Pomble is responsible for the personal information described here. Privacy requests can be sent to francesca@thebaileywheelers.co.uk.
What is stored online
Grown-up accounts and household access
For each grown-up: first name, surname, date of birth, email address, confirmation time and method, acceptance of the Terms and this notice, optional marketing choice and account timestamps. Pomble also records which household the grown-up belongs to, whether they are its owner or an invited grown-up, and pending invitation email addresses and expiry times. Password accounts include a salted verifier. Google and Apple connections include the identifiers described below. Pomble receives no readable provider or Pomble password.
Household profiles
Each profile’s display name, whether it is an adult, child or memory profile, and the starting settings chosen by the grown-up—including a child’s age and puzzle preferences where supplied. Children do not provide an email, password, surname, full birth date, photograph, school or location.
Security records
Short-lived email confirmation, password-reset, Google and Apple replay-protection and account-linking tokens, login sessions and temporary anti-abuse counters. One-time Pomble tokens are stored as one-way digests. The web host also processes ordinary request information such as IP address for security and delivery.
What stays on the device
Detailed play history, time spent in games, children’s drawings and Studio work, and the grown-ups’ four-digit PIN remain in that browser. They are not included in account synchronisation. Clearing the browser can remove them.
Why the information is used
- To create and secure each grown-up’s account, recognise a returning Google or Apple account, confirm the adult’s email where applicable and allow password recovery.
- To send and verify invitations from a household owner and give invited grown-ups access to the shared family profiles.
- To show the same family profiles after login on another device.
- To choose suitable starting settings for each profile.
- To protect the service from automated abuse.
- To send optional Pomble updates only where the grown-up actively chooses them.
Development confirmation
During the current family-testing release, email sign-up attempts to send a confirmation message and also shows a one-time fallback link immediately after a new account is created. Using the fallback does not prove that the grown-up controls the email address. It is not shown again for an existing account. Password-reset links remain email-only.
Where it is processed
Cloudflare hosts the site and account store. Resend handles transactional account email. If the grown-up chooses Google sign-in, Google Identity Services processes the sign-in and provides Pomble with the Google account identifier, verified email and basic name information. Pomble requests no access to Gmail, Drive, Calendar, contacts or a child’s Google account. If the grown-up chooses Apple, Apple processes the sign-in and provides Pomble with an account identifier and verified email; name is supplied only on the first approval. The grown-up may choose Apple’s private email relay instead of sharing a personal email. Loading either provider’s sign-in may also give that provider ordinary technical request information. No advertising or analytics provider receives account or child-profile information.
How long it is kept
An unconfirmed signup expires after seven days. Confirmation links, reset links and household invitations expire after 24 hours, 30 minutes and seven days respectively. Login sessions expire, normally after 30 days. A verified account and its household membership remain until access is removed, the grown-up asks for deletion or the account is closed.
Your choices and rights
You may ask to see, correct or delete server-held information, or withdraw optional marketing consent, by emailing the address above from the account email. You may also complain to the UK Information Commissioner’s Office. Device-local play history and artwork can be erased from the grown-ups’ room on that device.
Children
A grown-up aged 18 or over creates the household and decides which profiles and other grown-ups to add. Every invited grown-up can see and change the shared household profiles, so the owner should invite only adults they trust to care for that household. Children never receive account credentials. Pomble uses child-profile information only to provide the requested household service; it is never used for advertising, social comparison or public profiles.
Changes
If the account system, email provider or data use changes materially, this notice will be updated and the grown-up will be told in plain language.