Android and iOS | Parent and school portals update
Effective date: [insert publication date for this portal release]
Who we are and what this policy covers
A Collection of Hope Ltd is responsible for the HOPE app. This policy applies to HOPE on Android and iOS, including versions distributed through Google Play and the Apple App Store. It covers painting, levels and tasks, parent and child profiles, friend requests, school/classroom tools and online drawing sessions.
Our contact details are: A Collection of Hope Ltd — registered in England and Wales, company number 12026927 Unit 25, 8 Hornsey Street, London, N7 8EG, United Kingdom Email: corporate@humanitarianoperations.org
Privacy at a glance
Single-player painting and its level, task and day-progress records are stored on the device. Online parent accounts and friend features send information to our online service. School records currently remain on the device, except for information transmitted when online classroom or multiplayer features are used. Other participants can see the display name and drawing content shared in their session.
We do not sell personal information. Parents and authorised school staff should manage children's profiles and supervise online participation. Please use a nickname where possible and avoid including a home address, contact details or other private information in a display name or drawing.
[Confirm for this release: single-player painting remains available without an account; no advertising, behavioural tracking or third-party analytics has been added. The earlier policy's blanket claim that the app collects no data no longer applies.]
Parent accounts and child profiles
When an adult uses the parent portal, we process their email address, account identifier, sign-in/authentication information and their relationship to the child profiles they manage. The service also processes session records needed to keep the adult signed in and authorise account actions.
Child profiles include profile identifiers, friend codes and the profile information supplied by their parent. These records allow us to associate a child with their parent, identify the correct recipient of a friend request and apply parental decisions.
[Confirm the exact profile fields sent to AWS: adult name, child name/nickname and date of birth. List only fields actually collected, and explain the specific need for date of birth if retained. Confirm password handling; do not publish a claim that passwords are hashed or encrypted until verified.]
Parent account and friend-service records are stored using Amazon Web Services (AWS). The configured parent-portal backend uses the London region (eu-west-2). This does not mean all multiplayer, support, operational or backup processing occurs in the UK.
Friend requests and parental decisions
The friends service processes the relevant child identifiers or friend codes, parent-child links, requests, approval or rejection decisions, friendship status and related operational records. The friend approval flow requires the sending child's parent and the receiving child's parent to approve before a friendship becomes active.
This information is used to deliver requests to the appropriate adult, enforce permissions and show the status of a request or friendship. Friend notifications appear within the app.
[Verify the final release enforces both approvals on the server. Specify exactly which profile details the other child and each parent can see; confirm parent email addresses and children's dates of birth are not exposed in profiles, lookup responses or multiplayer payloads. Describe the available remove-friend, block/report and social-feature controls without promising controls that are not implemented.]
School and classroom portal
The school portal processes teacher name, email and sign-in information, class names and automatically generated class identifiers, and student names, dates of birth and student identifiers. Students use their student identifier to access the relevant school experience. The app can remember the teacher's email on the device for a later sign-in.
In this release, school account and class records are stored on the device rather than synchronised through our parent-portal AWS database. Local records are not automatically available on another teacher's device. Deleting local app data or uninstalling the app can remove these records, subject to device backup and restore behaviour.
Online classroom sessions are different from local record storage: information needed to identify participants and run the shared activity is transmitted through the multiplayer service as described below.
[Confirm school/student date of birth is necessary and whether it ever leaves the device. Confirm whether any progress is copied into portal records. Where a school decides why and how pupil data is used, document its role and our role, any processing agreement, and how parents exercise their rights through the school. A teacher account alone is not evidence of parental consent.]
Online multiplayer and shared drawings
HOPE uses Photon to operate live multiplayer drawing sessions. These sessions transmit participant display names, session/room identifiers, drawing actions and session state needed to display the shared activity. Other participants, including adults admitted as spectators, can see the names and artwork made visible in the session.
Drawing content can itself contain personal information. Do not put private information into shared drawings. Participants may be able to take screenshots or otherwise keep what they see; deleting an account cannot necessarily remove copies held independently by other people.
[Confirm the actual Photon payloads and connection metadata, including user IDs, IP addresses, device information and diagnostic logs; which are retained and for how long; selected hosting regions; and whether drawings, events or room state persist after a session ends. Confirm whether chat, voice or photo sharing exists. Do not describe all data as local or all multiplayer processing as temporary unless verified.]
Painting, tasks and day progress
Single-player paintings, preferences, unlocked levels, completed tasks, level start dates or day counts and unlock status are processed on the device. They support painting tools, show progress and determine when the next level can unlock. The app uses the device's date/calendar for day progression. Multiplayer activity does not count towards single-player tasks.
Local information can be lost when app data is cleared, the app is uninstalled or a device is reset or replaced. Device backups may restore some information. Online parent/friend records are separate: uninstalling HOPE does not delete those server records.
[Confirm these progress records are not uploaded or synchronised by the new portals. If they are, add the precise uploaded records, recipients, purpose and retention here.]
Images, sharing and device permissions
When a user selects an image from the device or saves artwork, HOPE uses the selected content and any permission granted for that action. Any selected image transmitted into a shared session becomes visible to the participants in that session. Using the device's sharing interface sends the selected item to the destination chosen by the user, whose own privacy terms apply.
Parents should supervise sharing and check that images do not reveal private information. Device permissions can be managed in Android or iOS settings. Declining a permission may prevent the feature that needs it from working.
[Verify the final builds' camera, microphone, photo/storage and other permissions. If MediaPipe/body/face/iris/hand tracking and audio classification have been removed, verify no remaining SDK or runtime feature performs them before adding a definitive statement to that effect.]
Purposes and lawful bases
We use the information described above to provide accounts and requested online features, associate children with responsible adults, process friend decisions, run shared activities, protect accounts and users, respond to support requests and meet applicable legal obligations.
[Before publication, confirm a lawful basis for each purpose. Specify contract where necessary to provide a service to an adult account holder; consent for any processing actually based on valid consent; the particular legitimate interests relied upon for proportionate security/support processing; and applicable legal obligations. Do not assume an adult's contract covers every use of a child's data. Explain withdrawal where consent is used and its effect on the relevant feature.]
Children and adult oversight
HOPE is intended for children, families and educational use. Adults should receive clear information about the data used by portal and social features before supplying a child's information or enabling online participation. Children should receive a short explanation suitable for their age.
Parental approval of a friend request is a control over that friendship. It is not, by itself, a substitute for any consent or parental verification required for collecting a child's personal information. School use must also have the necessary authorisation and information for families.
[Describe the implemented adult verification/authorisation and consent process, applicable ages and countries, how consent can be withdrawn, and how an adult disables social features. Confirm privacy defaults and child-facing notices before publication.]
Service providers, disclosures and international processing
AWS provides the infrastructure for our parent-account and friend service. Photon provides multiplayer connectivity. Communications providers process support messages. We disclose information within the app to the parents, authorised educators and session participants who need it for the relevant feature, as described above.
We may disclose information where required by law or where necessary and lawful to protect users, investigate abuse or defend legal rights. Apple, Google, device providers and separately selected sharing destinations also process information under their own terms.
[Confirm the providers' legal entities, processing locations and contractual roles. Specify any processing outside the UK/EEA and the applicable transfer mechanism, such as adequacy regulations or approved contractual safeguards. Do not claim all processing is in London merely because the AWS database is there.]
Retention and account deletion
Local paintings and school records remain subject to device storage, deletion and backup controls. Online accounts, child profiles, friend records and sessions require separate server-side deletion. Removing the app does not erase them.
To request deletion by email, write to corporate@humanitarianoperations.org from the email address registered to your HOPE parent account. Use the subject HOPE Account Deletion Request and state whether you want to delete the whole account or a particular child profile. We may request proportionate information to verify account ownership or parental authority. Do not send passwords or unnecessary identity documents. You can request deletion even after uninstalling the app.
For a verified account deletion request, we will delete the parent account and associated online data, including child profiles managed by that account, parent-child links, friend codes, friendships, pending requests, approval records, account lookup records and authentication sessions. We will confirm completion by email. Information retained for a lawful reason is described below. Removing the app alone does not make this request.
[Insert the published account-deletion webpage URL and the implemented in-app deletion route for Android and iOS. The iOS route must let users initiate deletion without requiring a support email. Confirm the treatment of shared child profiles and any associated information held by providers.]
[Insert actual retention periods or clear criteria for active/inactive accounts, requests, session tokens, logs, support messages and backups; the deletion completion timeframe; and any narrowly justified legal/security exceptions and their durations. Do not promise immediate or complete deletion until the backend and provider procedures support it.]
Security
We use measures appropriate to the personal information handled by the service. Users should protect their devices and sign-in details and should not share account passwords.
[Verify and describe the measures actually in place: authenticated access, server-side parent/child permissions, protected credential storage, access restrictions, and encryption of every relevant network connection, including Photon. Do not claim end-to-end encryption or “all data encrypted in transit” based only on an HTTPS AWS endpoint.]
Support and your rights
If you contact us, we receive your email address, message and any information you provide. We use it to respond and address the issue. Avoid sending a child's personal information unless needed for the request.
Depending on applicable law, you may have rights to access, correct, erase or restrict personal information, object to processing, receive a portable copy, and withdraw consent where we rely on it. A parent or guardian may make an appropriate request on behalf of their child, subject to verification and the child's own rights. Contact corporate@humanitarianoperations.org. Where school records are held and controlled solely by a school on its device, contact the school as well; we cannot remotely retrieve records we do not hold.
People in the UK can complain to the Information Commissioner's Office at https://ico.org.uk/. You do not need to contact us first to exercise that right.
Changes
We will update this policy when HOPE's features or data practices change. The current policy and effective date will be available in the app and on our privacy-policy webpage. Where necessary, we will provide additional notice or obtain consent before introducing a new use of personal information
