Privacy for pupils, parents and schools.

Roles: who decides what

When a school uses Kolonia with a class, the school decides why and how the game is used. Tot Academy acts on the school’s behalf as processor, under a data-processing agreement (Article 28 GDPR) that we sign on request.

When a pupil plays on their own, Tot Academy is the controller. Our legal basis is our legitimate interest (Article 6(1)(f) GDPR) in running a free game that the pupil chose to use, with the small amount of data listed below. Pupils under 14 are asked to play with the knowledge of a parent or teacher.

What the Kolonia game stores

A pupil’s profile is called an "organism": a crew of one to three pupils. The system creates a random 5-digit ID and a 6-digit PIN. This is everything that is stored.

What we do not collect

• real names, email addresses, phone numbers or photos;
• dates of birth or location;
• device fingerprints;
• cookies, analytics, advertising or social-media widgets;
• requests to any third party: neither the game nor the pages under /interactives load anything from anyone but totacademy.app.

Storage in the browser

The game sets no cookies at all. It keeps a few items in the browser itself. They are needed to provide the game the pupil asked for, and none of them is used for tracking.

The public leaderboard

Anyone can see the leaderboard without signing in. It shows exactly this:

• the bacterium name, its shape and colour;
• the class label (for example 7а);
• the rank and the total biomass.

It does not show class register numbers, the ID, the PIN, credits, designs or activity times.

Retention and deletion

• Automatic: a profile is deleted 12 months after its last activity.
• By the pupil, at any time: "Delete my profile" in the game, with the ID and PIN.
• By the teacher: delete selected pupils, or the whole class group, in the teacher panel.
• Rate-limit data: at most 24 hours for failed log-ins and 1 hour for request counters.
• In the browser: the stored session is cleared on log-out and on deletion.

Security measures

• PINs and teacher group codes are stored only as hashes (bcrypt for PINs), so they cannot be read back.
• IP addresses are pseudonymised with a keyed hash that changes every day, so they cannot be linked across days. The raw IP address is never written to the database.
• Repeated wrong PINs are rate-limited.
• Bacterium names pass a word filter, and a teacher can rename or hide a name.
• The game has its own database. It is not shared with Tot Academy accounts or with website analytics.
• All traffic uses an encrypted HTTPS connection.
• The pages send a Content-Security-Policy that only lets the browser talk to totacademy.app (see "How a school can verify this").
• Data minimisation: no real names, no contact details, no tracking.

Sub-processors

Not used on the interactives, ever:

• PostHog or any other analytics;
• Google (Maps, Analytics, Tag Manager and the like);
• advertising networks;
• fonts, scripts or images from third-party servers or CDNs: fonts are served from totacademy.app itself.

International transfers

The game’s data is stored in Frankfurt, Germany, and its functions run there. Vercel Inc. and Neon, Inc. are companies based in the United States. Where data is transferred to them, the transfer relies on the EU–US Data Privacy Framework, where the provider takes part, and otherwise on the European Commission’s standard contractual clauses. The only other place data goes is Anthropic, and only the text a pupil sends in the AI Context Builder (see that section). Data is not sent anywhere else.

Data-subject rights

• A pupil can delete their own profile in the game, with the ID and PIN.
• A teacher can export a class group’s data and rename pupils’ bacteria, and can delete pupils or the whole group.
• Parents and anyone else can contact us to ask for access, correction, deletion, restriction or to object. When the school is the controller, we pass the request to the school and help it answer.

We hold no names, so to find a profile we need its 5-digit ID. The pupil can always use the game’s own deletion with the PIN. You have the right to complain to the Commission for Personal Data Protection (Комисия за защита на личните данни), www.cpdp.bg.

How a school can verify this

You do not have to take our word for it. The pages under /interactives send a Content-Security-Policy header with connect-src 'self' and similar rules, so the browser can only talk to totacademy.app.

• Open the browser’s developer tools and the Network tab, then load the pages and play. Every request goes to totacademy.app.
• Open the Application (or Storage) tab. There are no cookies, and the only items are the ones in the browser-storage table above (plus, if the same browser has visited our homepage, the website's own tot-academy-analytics-consent choice, which is never read on these pages).
• Check the response headers of any page under /interactives for the Content-Security-Policy.

The ESAT Distractor Guide

The ESAT Distractor Guide has no accounts and runs entirely in the browser. It stores nothing: no profile, no progress, no data.

Thin Lenses (IGCSE Physics)

Thin Lenses has no accounts and runs entirely in the browser: it makes no request to any other site and sets no cookies. By default it stores nothing, and progress lasts only while the tab is open.

If the student presses Keep it on this device, the page saves their progress in the browser’s own localStorage: the answers given (which question, how many marks, which misunderstanding was flagged), which lesson cards were reached and the result of the check-in. It is never sent to us or to anyone else. The student can erase it with Erase all my progress on the Skills map, or by clearing the browser storage. (The buttons in the interactive are in English.)

AI Context Builder (Grade 10)

AI Context Builder has no accounts and sets no cookies, but unlike the other tools it is not offline: when the student presses Send, the pieces of context they chose, the model and the effort are sent through our server to Anthropic’s Claude, which writes the answer. Anthropic is a sub-processor (see above).

We do not store the message or the answer, and we do not send the student’s name, IP address or any identifier to Anthropic. After each run we keep one anonymous line for the leaderboards: the model, the effort, the scores, the token counts, the cost, the time and an animal nickname. The nickname is one of 50 animal species, worked out from a one-way hash of the visitor’s IP address each time it is needed (the IP address and that hash are not stored for it), so many visitors share each one and it identifies no one; the leaderboards show it so that students can find their scores. The line holds no text and nothing that identifies the student. To stop misuse we can also keep a counter per hour for a one-way hash of the visitor’s IP address (currently switched off), and to keep track of the cost we keep one running total of what the feature has spent, which holds no personal data. Nothing is stored in the browser. (The buttons in the interactive are in English.)

Carboxylic Acids (IGCSE Chemistry)

Carboxylic Acids has no accounts and runs entirely in the browser: it makes no request to any other site and sets no cookies. By default it stores nothing, and progress lasts only while the tab is open.

If the student presses Keep it on this device, the page saves their progress in the browser’s own localStorage: the answers given (which question, how many marks, which misunderstanding was flagged), which lesson cards were reached, the Core or Core + Supplement choice and the result of the check-in. It is never sent to us or to anyone else. The student can erase it with Erase all my progress on the Skills map, or by clearing the browser storage. (The buttons in the interactive are in English.)

Contact and data-processing agreements

To ask for a data-processing agreement, or with any question, write to us or call us.

Controller

Tot Academy

Address

48 Gen. Skobelev Boulevard, Sofia

Phone

+359 885 076 024