Privacy notice

Summi is made by Stormzaak, a sole trader in the Netherlands run by Michel. Stormzaak is the controller of the personal data in Summi (in the United States: the operator).

• Email: [email protected]
• Phone: +31 6 82 45 36 66
• Post: Van Haersmasingel 76, 9062 GC Oentsjerk, The Netherlands

UK representative. Because we are not based in the UK, we have a representative there under Article 27 of the UK GDPR. You and the Information Commissioner’s Office can contact them about anything in this notice. We are appointing our UK representative; their name and address will appear here before Summi opens to families in the UK.

We don’t have a separate data protection officer. Questions about privacy go straight to Michel at [email protected].

Summi has two parts, and we treat them differently.

The game and the parent area

This is Summi itself: the app for iPhone, iPad and Android, and everything you do in a browser after logging in.

• No analytics and no tracking. We don’t record which screens your child looks at or taps, or how long the app is open.
• We keep only what is needed to play and to show you how your child is doing. The details are under What we keep about your child.
• If something breaks, we get a technical error report: what went wrong, on which screen, and on what kind of device and browser. No name, email address or answers. We use it only to fix the error.

The website

These are the public pages you can see without logging in, such as the home page and this notice.

• We count visits with PostHog to see which pages are read and what could be better: which pages are viewed, which site you came from, where you click, your type of device and browser, your country and how fast the page loads.
• This works without cookies and without storing anything on your device. To count visitors, PostHog makes a code from your IP address and browser on its server, and that code changes every day. Your IP address itself is not stored. So we can’t follow you across days, and we don’t know who you are.
• We don’t record your screen.
• On summigame.com we don’t use advertising cookies or pixels. If we ever want to, we will ask you first and update this notice.

• Your email address, so you can log in.
• Your password if you choose one, and the PIN for the parent area if you set one. We only keep these as a one-way code (a hash), never readable.
• When you gave consent for your child to use Summi, and which version of this notice you saw.
• Whether and when you confirmed your email address.
• Your language, country and time zone.
• Whether you signed up on the website or in the app (iOS or Android), for our own figures only.
• Your settings, such as whether timed games are allowed and whether you want the weekly summary and the reminder by email, plus which week we last sent the summary and which quiet period we last sent a reminder about, so you only get each one once.
• Whether you want a notification when your child challenges you to a duel and, if you allow notifications in the app, the push address of that device (see Notifications).
• Short-lived codes for the links in our emails (reset password, login link, confirm email address), stored only as a hash.
• Which kind of email we sent you and when (for example “login link” or “weekly summary”), so we can check whether it arrived. Not the subject or content.
• Feedback you send us from the parent area: the message, its type and the date.
• Your purchase: the date, the amount, the currency, who handled the payment and its reference number. We never see or keep card or bank details.

• A first name or nickname (a nickname is fine) and the school year. We don’t ask for a surname, date of birth, address, school or photo.
• The avatar your child builds, and a PIN if you set one (as a hash).
• All answers to questions: which question, the answer given, whether it was right, how long it took and whether a hint was used.
• What the game works out from that: the level for each skill and which common mistakes come up (for example adding both the tops and the bottoms of fractions).
• Progress in the game: XP, coins, items bought for the avatar, badges, unlocked islands, daily missions and records.
• When your child played, for how long, which game, and whether on the website or in the app. For the Arcade also each round: which game, the score and how long. In the Arcade children see how often each game was played that week across all children, without names.
• The daily rhythm: active minutes per day and whether the daily goal was reached. Active minutes are only thinking time on questions, not time the game is just open.
• The weekly quest, and the rhythm and optional reward you set (for example “bake pancakes together”). You write that text, not your child.
• Only if you turn on friends: the friend name of your child (such as Fox 384), the friends and requests, duels with friends, and the emoji, stickers and gifts between friends. Only if you also turn on online status: the last moment one of your child’s devices was in touch with Summi, updated at most every 20 seconds and with no history. See Friends.
• Ideas from the Idea Bottle: your child can send us an idea for Summi. We keep the text, its type and the date, and our short reply. Only Michel reads it. The game asks your child not to include a name, address or phone number. You can see the ideas in your child’s settings. Other children never see them.
• Only if you turn on notifications for your child: whether a notification went out for a challenge, and the push address of the device (see Notifications).

We don’t collect your child’s precise location, voice, photos, contacts or any advertising identifier.

• To fit the maths to your child: the next question is chosen from earlier answers, so it is not too easy and not too hard. This is the core of Summi and can’t be switched off, but it is only used inside Summi, for learning.
• To show you how it’s going: how much was practised, which skills go well, where your child gets stuck, with tips for home.
• To make Summi better: which games are played a lot or a little, and where children often get stuck. Only we look at this, inside Summi.
• Only if you turn them on: to let your child play with approved friends, and to send a notification when someone challenges your child to a duel.

We email you only when it is needed for your account (confirming your address, a new password or login link, a receipt), and, as long as you leave them on, a weekly summary and one reminder if a child hasn’t practised for two weeks. You switch both off in Settings. No newsletters, no marketing.

This applies under the UK GDPR, and the EU GDPR for families in Ireland.

• Your child’s data: your consent as their parent or carer. Summi is for children under 13, so we always ask a parent. You give consent when you create the account and add a child. You can withdraw it at any time by deleting your child’s profile.
• Friends and notifications: a separate choice. They are off until you turn them on for a child, and you can turn them off again whenever you like.
• Your own account and purchase: performance of our contract with you.
• Family members in a duel: our legitimate interest in making the duel work. They can stop the emails with one button, and you can remove them.
• Website visits and error reports: our legitimate interest in making the website and game work and improving them. That is why we keep this so limited, without cookies.
• Bookkeeping: a legal obligation. Dutch tax law requires us to keep purchase records for 7 years.

Following the UK Age Appropriate Design Code (the Children’s Code), every setting that makes your child visible to others or sends your child a message starts switched off for a child added outside the Netherlands:

• Friends with children from other families: off.
• Showing friends that your child is online: off.
• Notifications to your child when someone challenges them to a duel: off.

You can turn each one on in the parent area, in your child’s settings. Your child can’t change them. In the United States, you can turn on friends only after you have bought Summi yourself, because that payment is how we confirm that you are the parent (see Notice to parents in the United States).

Summi doesn’t show your child’s location, has no public profiles and no public leaderboards, and uses no adverts or notifications to lure children back. The parent area shows you your child’s progress; please tell your child that you can see it.

Once you turn friends on, your child can add a friend from another family, such as a classmate.

• Friend name. Summi gives your child a friend name: an animal and three digits, such as Fox 384. Nothing about your child is in it. If it travels too far, you can make a new one; existing friends stay.
• Adding. Only by typing the exact friend name. There is no search and there are no suggestions, so your child isn’t in any list that others can browse.
• Approval. Only the parent of the child who receives a request can approve it. Children never approve anything. To decide, that parent sees the friend name, nickname and avatar of the child who asked. If your child sends a request themselves, you get an email (at most one a day) and can withdraw it.
• What a friend sees. Only the friend name, nickname and avatar, the badges from the last 7 days, base camp when visiting, whether your child is online (only if you allow it), duel results between the two of them, a race ghost based on your child’s best race, and the shared total of a team goal. Never the school year, level, scores per skill, answers, playing times or email address.
• No chat. Children can’t send each other messages or type anything another child sees. They can only choose from fixed sets: five emoji in a duel, six emoji on a badge or visit, and a gift from a fixed list.
• Removing and blocking. Your child can remove a friend. You can remove and block friends in the parent area. Turning friends off hides everything on both sides straight away.
• Keeping. A request nobody decides on expires after 14 days. Declined and expired requests are deleted after 30 days, emoji, stickers and gift notes after 30 days, and team goals after 8 weeks. When two children stop being friends, their duels and messages are deleted straight away.

In the parent area you can add family members, such as a grandparent, so your children can challenge them to a duel. A family member has no account and plays for free via a personal link in an email. Please ask them first.

• We keep the name you choose (such as “Grandma Jo”), their email address, the school year and level they last picked, whether they want no more emails, and a hash of the link. Of the games themselves only the challenges and results. Not their answers.
• They see the nicknames and avatars of your children who can duel, and the results of their duels together. Nothing else about your child.
• One invitation email, then an email when a child challenges them (at most five a day). The “No more emails” button stops them.
• When you remove a family member, the link stops working and their name, email address and duels are deleted straight away.

In the app, Summi can send a notification when someone starts a duel. It is off for your child until you turn it on in your child’s settings.

• Only for a challenge from a brother, sister, you or an approved friend, and one note back when the other player says yes. Never adverts, never “come back and play”.
• Not between 8pm and 7:30am for children (10pm and 7am for you), at most one per quarter of an hour from the same person, and at most six a day for a child.
• A notification shows the name of who is challenging: within your family the nickname, from a friend only their friend name. It can appear on the lock screen.
• We keep, per logged-in device, the push address Apple or Google makes for it, the device type, the app version and when it last checked in, plus a log of which kind of notification went to which family and whether it worked (not the text). Log out and the push address is deleted; a device that hasn’t opened the app for 60 days is removed; the log is kept for 90 days.

• No adverts in Summi.
• No tracking or analytics in the game or the parent area.
• We don’t sell or share personal data for advertising, and we don’t use your child’s data for anything other than learning in Summi.
• No chat, and no contact with strangers: only approved friends and your family.
• No notifications to lure your child back.
• No photos, no voice recording, no location.
• We don’t use your child’s data to train AI models.

Our data is on servers in the European Union that we manage ourselves. These companies handle some data for us, under a data processing agreement, unless we say they act on their own account:

• Email: Resend or AhaSend send our emails. They handle your email address and the content of the email. The weekly summary and reminder contain your child’s nickname and progress; friend emails contain nicknames and friend names. Our emails have no tracking pixels.
• PostHog (servers in Frankfurt, EU): website visit counts and error reports.
• Cloudflare: an encrypted nightly backup of the database, stored in Western Europe.
• Apple and Google deliver notifications (Apple Push Notification service and Firebase Cloud Messaging). They get the device’s push address and the notification text. If you choose to log in with Google or Apple, they see that you log in to Summi and we get your email address from them; they act on their own account.
• Mollie: if you pay on our website through Mollie, Mollie B.V. (the Netherlands) processes the payment as an independent controller, under its own privacy notice. We get from Mollie only whether the payment worked, the amount, the currency and a reference number. Your child’s data never goes to Mollie.
• Paddle: if you buy Summi on our website outside the Netherlands and the checkout is through Paddle, Paddle.com Market Limited (UK) sells it to you as our reseller (Merchant of Record). Paddle handles your payment, billing address, tax and receipts as an independent controller, under its own privacy notice. We get from Paddle only whether the payment worked, the amount, the currency and a reference number. Your child’s data never goes to Paddle.
• App Store and Google Play: if you buy in the app, Apple or Google handles the payment on its own account. RevenueCat (US) tells us that the purchase went through, using your account number and the transaction ID, nothing about your child.

International transfers. Data from the UK goes to the EU under the UK adequacy regulations. Where a company above may handle data in the United States, it does so under the EU-US Data Privacy Framework and its UK Extension, or standard contractual clauses.

• We keep data for as long as the account exists, with these exceptions.
• Individual answers are deleted automatically after 24 months. What the game learned from them (the level per skill) stays, so your child doesn’t have to start again.
• Delete a child in the parent area, and all their data goes straight away: profile, answers, progress, rewards, friends and ideas.
• Delete your account in Settings, and your account and all your children’s data go straight away.
• If you start signing up with Google or Apple but don’t finish, we delete your email address after a day.
• A login session expires after a year.
• Email links work briefly: 30 minutes for a new password, 15 minutes for a login link and 7 days to confirm your address. Each works once.
• The log of which emails we sent is kept for six months.
• Purchase records are kept for 7 years for the tax authorities, without a link to you once your account is deleted.
• Backups are kept for 30 days, so deleted data may still be in a backup for up to 30 days. We only use backups to restore Summi after a failure.
• The other retention periods are under Friends, Family members and Notifications.

• See and download. In the parent area, choose a child, then Settings, then “Download data” for a file with everything we keep about that child. For your own account data, email us.
• Correct. Nickname, school year, avatar, PINs and friend name can be changed in the parent area. For anything else, email us.
• Delete. A child or your whole account, yourself, in the parent area. It is immediate and can’t be undone.
• Withdraw consent, object or restrict. Turn a setting off, delete a child, or email us.
• Complain. We’d like to hear from you first. You can also complain to the Information Commissioner’s Office (UK), the Data Protection Commission (Ireland), the Autoriteit Persoonsgegevens (Netherlands, our lead authority), or the privacy regulator where you live.

Email [email protected] for any request. We reply within one month. Your child can also ask us about their own data; we will then involve you.

This is our direct notice to parents under the US Children’s Online Privacy Protection Act (COPPA) and the FTC’s COPPA Rule. Summi is directed at children under 13, so we treat every child as under 13.

• Operator. Stormzaak, the Netherlands. Email [email protected], phone +31 6 82 45 36 66, post Van Haersmasingel 76, 9062 GC Oentsjerk, The Netherlands. There are no other operators collecting data through Summi.
• What we collect from your child. Their answers to questions, how long they took, game progress, the avatar they build, when and how long they play, ideas they send through the Idea Bottle, and (only if you turn these on) their friends and friend activity, the last moment they were online and their device’s push address. You, not your child, give us their nickname and school year. See What we keep about your child for the full list.
• How we use it. Only to run Summi for your child: choosing the next question, showing you progress, rewards in the game, and (if you allow them) friends and notifications. Not for advertising, not to build profiles for anything else, and not to train AI.
• Who sees it. You, and only within your account. We don’t sell, rent or share your child’s personal information with third parties for their own purposes. Our service providers (listed under Who else handles data) handle some of it for us and may use it only to provide their service to us. If you turn on friends, approved friends see your child’s friend name, nickname, avatar and the game activity described under Friends. That is a disclosure to other users, and it is never possible without your separate choice.
• How you give consent. When you sign up, you confirm you are the parent and agree to this notice; we then send a confirmation email to you. Your child can only play after you have bought Summi (on our website, or in the App Store or Google Play): that payment is how we verify that you are an adult account holder. If your family got access another way (for example a code from us), friends stay locked until you have paid yourself. You can agree to us collecting and using your child’s information without agreeing to friends.
• Your rights as a parent. At any time you can review your child’s information (Download data), have it deleted (delete the child), and refuse further collection or use (turn settings off, or delete the child, which stops all collection). You can withdraw consent you gave earlier by email at any time. Email us for anything you can’t do yourself in the parent area.
• Data retention policy. We keep a child’s information only as long as needed to run Summi for them: until you delete the child or your account, with individual answers deleted after 24 months and the shorter periods under How long we keep it. We don’t keep it indefinitely, and deleted data leaves our backups within 30 days.
• Security. How we protect your child’s information is under Security.

We don’t sell or share personal information as defined by US state privacy laws, and we don’t use it for targeted advertising.

• Passwords and PINs are stored with argon2, a one-way method.
• Of a login session we keep only a hash.
• Email links contain a long random code that works once and only briefly.
• When you request a new password or login link, we don’t reveal whether an account exists for that address.
• All connections to Summi use HTTPS. Backups are encrypted.
• A parent only ever sees their own children’s data. Of a friend you only see the friend name, nickname and avatar.
• Every challenge, visit, emoji, gift, team goal and ghost race checks again that the friendship still exists and that friends is on for both children.

• We use one cookie, rekko_session, to remember that you are logged in. It is strictly necessary, so we don’t ask for it.
• Sound and music settings are stored only on your own device (in the browser’s local storage) and don’t come to us.
• Website visit counting uses no cookies and no storage on your device.
• No advertising cookies on summigame.com, in the game or in the app.

Before Summi opened in English, you could join a waiting list on summigame.com. For that list we keep your email address, your country and which advert or link brought you there. We ask nothing about your child, and the list is for adults only. We use it only to email you when Summi launches in English and to see how much interest there is per country, based on your consent. We delete your details after 12 months, or sooner if you ask.

If we change this notice in substance, it gets a new version number. With every consent we keep which version you saw. This is version 2026-11-10.1, the first full English version. If a change affects how we use your child’s data, we will ask for your consent again before it applies to your child.