Privacy Policy

Effective Date: March 6, 2026

Expedition Code is a collaborative coding game designed for kids. We take privacy seriously, especially for young players. This policy explains exactly what data we collect, why we collect it, and how it's used.

1. Who We Are

Expedition Code is operated by Sean Clark (me@seanclark.dev). If you have any privacy questions, please reach out directly at that address.

2. What Data We Collect

We collect only what's necessary to run the game. Here's exactly what that is:

Display name (chosen by the player) To identify you to teammates in a game room

Emoji avatar (chosen by the player) To represent you visually in the game

Secret phrase (stored as a one-way hash) To let you log back in without a password or email. The phrase itself is never stored — only a secure hash.

Anonymous device ID (a UUID stored in your browser) To keep you logged in between sessions on the same device

Code you write in the game To run your game, generate feedback, and track your score. Code is sent to our AI provider for processing (see Section 4).

Game scores and outcomes To show leaderboards and personal progress

Last active timestamp To manage inactive sessions

Anonymous usage events (via PostHog) To understand how the game is used and improve it. Events contain no names, code content, or personal data. IP addresses are not collected.

Page views and performance metrics (via Vercel Analytics) To monitor site performance. No cookies, no fingerprinting, no personal data.

We do not collect email addresses, real names, phone numbers, location data, photos, or any other personally identifiable information.

3. Children's Privacy (COPPA)

Expedition Code is designed for players aged 9 and up, including children under 13. We comply with the Children's Online Privacy Protection Act (COPPA).

We do not require children to provide any personally identifiable information to play. Display names are player-chosen and do not need to be real names.

When Expedition Code is used in a school setting, we rely on the school acting as the consent intermediary on behalf of parents, consistent with COPPA's school official exception. Schools that wish to use Expedition Code should contact us at me@seanclark.dev to establish a data use agreement.

If you are a parent and believe your child has provided information beyond what is described above, please contact us and we will delete it promptly.

4. Analytics

We use PostHog for product analytics to understand how players use the game — for example, which buttons are clicked, which games are played, and where players drop off. This helps us improve Expedition Code over time. PostHog is configured to not record sessions and not collect IP addresses. Autocapture is enabled for click and navigation patterns. No player names or personal data are included in analytics events.

We also use Vercel Analytics for basic web performance monitoring (page load times, visitor counts). Vercel Analytics uses no cookies and collects no personally identifiable information.

Neither analytics service receives player names, code content, or any other personal data.

5. Third-Party Services

To run the game, we use several third-party services. Each receives limited data necessary for its function. See our full third-party disclosure for details on each provider.

We do not sell student data to any third party. We do not use student data for advertising purposes.

6. Advertising

Expedition Code contains no advertisements. We do not serve ads, display sponsored content, or engage in behavioral tracking for advertising purposes.

7. Data Security

All data is stored securely through Convex, our backend provider. Secret phrases are stored as SHA-256 hashes — the original phrase is never saved. Player code runs inside an isolated JavaScript sandbox (QuickJS), meaning it cannot access your device or browser outside the game.

8. Data Retention and Deletion

We retain game data (scores, code history, play sessions) while your account is active. If you would like your data deleted, email us at me@seanclark.dev with your display name and we will remove your account and all associated data within 30 days.

Schools requesting deletion of student data will receive priority handling and confirmation of deletion.

9. Changes to This Policy

If we make material changes to this privacy policy, we will update the effective date at the top of this page. For significant changes affecting schools or children, we will provide direct notice where possible.

10. Contact

Questions about this policy? Reach us at me@seanclark.dev.