We've written this in plain language rather than legalese, but it covers what the law requires. For the friendlier version of how we look after your child, see Trust & safety.
| Data controller | Pedro Javier Criado Serrano |
|---|---|
| Activity | PequeMissions — educational practice app for children aged 3 to 8, currently in a pre-launch validation phase |
| Contact | hola@ |
| Website | https:// |
We are not required to appoint a Data Protection Officer and have not done so: we do not process data on a large scale or handle special categories of data.
| What | Why | Legal basis | How long |
|---|---|---|---|
| Your email address and, if you fill them in, your child's school year, whether you'd pay and your comment (waiting list) | To notify you once when we launch, and to understand what families need | Your consent (Art. 6(1)(a) GDPR), given via the form checkbox | Until launch or until you unsubscribe; 24 months maximum |
| The adult's email address, only if you choose to link it to your family (it is optional). It is verified with a 6-digit code we send to that address | To recover the parents' access if you forget the PIN, and to prove the family is yours (no passwords). It is stored by Supabase's account system in the European Union, apart from your child's data: the family is only tied to an internal identifier | Performance of the service you request when linking it (Art. 6(1)(b) GDPR) | While the account exists; deleted on request by writing to hola@pequemisiones.com |
| Family code (such as NUBE-K7M2-Q4RT), profile alias (the name or nickname you choose), year/level, chosen world and activated games, whether their school is bilingual (yes or no only: never which one), exercises completed, results, badges and minutes of use. We recommend a nickname. The name you give your family (“Our house”) does not travel here: it stays on your devices. | So missions sent by the adult reach the child's device, so the adult can follow their progress, and so the child's card is the same on every family device | Performance of the service requested by the adult (Art. 6(1)(b) GDPR) | While you use the app; deleted on request, and automatically after 24 months of inactivity |
| That an adult accepted this policy: the family code, the date and the version accepted. Nothing else: not who you are, not your email, not the name you give your family, nothing about your child | To be able to demonstrate that consent was given by the holder of parental responsibility, as the law requires, without having to identify anyone | Legal obligation to be able to demonstrate consent (Art. 7(1) GDPR) | Deleted with the family; and on its own after 24 months if there was never any data behind it |
| Message text written by the adult in a mission | To read it aloud to the child and check it is appropriate before they hear it | Legitimate interest in protecting the child (Art. 6(1)(f) GDPR) | With the mission; removed when completed missions are deleted |
| Exercise wording when the child asks for a hint (generated by the app; contains no personal data) and the hint returned | To give a hint about the method, and so the adult can see it in their panel | Performance of the service (Art. 6(1)(b) GDPR) | 12 months |
| App errors: which engine, which screen, the error message, browser and OS type and screen size (no family code, no nickname, no page address) | To find out something is broken and fix it | Legitimate interest in keeping the app working (Art. 6(1)(f) GDPR) | 90 days; deleted automatically |
Data we never ask for: surnames, date of birth, photos, voice recordings, location, phone contacts or school details. Your child has no account and no password.
PequeMissions is designed for children aged 3 to 8, but the account holder is always an adult. Processing the data of a child below the applicable age of digital consent (14 in Spain, 13–16 depending on the country) requires the consent of the holder of parental responsibility. Therefore:
We don't sell data, don't share it for commercial purposes and don't run advertising. To make the app work we rely on these providers, acting as data processors that only process the data on our instructions, under their data processing terms:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and server functions | European Union (Ireland) |
| Anthropic | Checking messages before the child hears them, and generating the helper's hints | United States |
| GitHub Pages | Website hosting | United States |
We're upfront about this because it's the right thing to do, and because European AI rules require it:
This website uses no analytics, advertising or third-party cookies. No Google Analytics, no social media pixels, no profiling. That's why you won't see an annoying cookie banner.
The app does use your browser's local storage to remember profiles, gems and settings on your own device. This is strictly necessary for the app to work and doesn't require consent. You can clear it by clearing your browsing data (you'll lose local profiles).
The fonts are hosted on our own domain: loading any page makes no request to third parties. In the syllables game for younger children, the "Record yourself" button asks for microphone permission: the recording lasts two seconds, plays back on the device itself and is never sent anywhere; the microphone is closed when it finishes.
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time, and withdraw your consent where that is the legal basis. Write to hola@pequemisiones.com telling us what you need and, if relevant, your family code. We reply within one month at most.
Since we hold no identifying data about the child, the fastest way to erase all their progress is to ask us to delete a specific family code: it is removed completely.
If you believe we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es), C/ Jorge Juan 6, 28001 Madrid, or to the supervisory authority in your own country.
Data travels encrypted (HTTPS) and the database enforces row-level access rules: without the family code, nothing belonging to that family can be read or modified. Even so, no system is infallible; if a security breach affected your data we would inform you and notify the supervisory authority within 72 hours, as the GDPR requires.
Site owner: Pedro Javier Criado Serrano · Contact: hola@pequemisiones.com (Art. 10 of Spanish Law 34/2002, LSSI-CE). PequeMissions is an independent project: any mention of the ABN methodology is a descriptive reference to the "open calculation based on numbers" method and implies no affiliation with its authors or publishers.
Intellectual property. © 2026 Pedro Javier Criado Serrano. PequeMissions is the English name of PequeMisiones. The texts, exercises, illustrations, design and code of this website and the app belong to their owner, except as noted below. They may not be copied, distributed or transformed without written permission; you are welcome to use the app, link to it and quote it with attribution.
If we change anything significant we'll update the date above and, where it affects you directly, tell you by email. The current version is always on this page.