Privacy Policy

1. Introduction & Overview

Music Games International Company, Inc. (“Company“, “we“, “us“, or “our“), doing business as Kids Music Games International, creates enriching, award-winning classical music educational games and operates the website located at https://www.kidsmusicgames.com.

We are deeply committed to protecting the privacy of everyone who interacts with our digital properties, especially the children who play our educational games and the parents, guardians, and educators who provide them with our software.

This Privacy Policy explains how we collect, use, store, share, and protect information across our website and software applications. It is designed to comply with applicable United States federal and state privacy statutes, including the Children’s Online Privacy Protection Act (COPPA), the Federal Trade Commission (FTC) COPPA Rule, the New York Child Data Protection Act (N.Y. General Business Law Article 39-FF), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the California Online Privacy Protection Act (CalOPPA), and applicable school privacy frameworks.

As permitted by FTC guidance, this unified Master Privacy Policy clearly differentiates between our parent-facing commerce operations and our child-directed educational games so that parents and educators can easily understand exactly what data is handled by each product.

---

2. Services & Properties Covered by This Policy

This Privacy Policy applies to all digital products and online services offered by Music Games International Company, Inc., specifically:

1. The Primary Website: kidsmusicgames.com (including our online store, customer account portals, product information pages, and game launch interfaces).
2. The Nutcracker Music Game (Paid): Our flagship interactive educational music game, available via web browser, macOS and Windows desktop applications, and native mobile/tablet applications (iOS/iPadOS and Android).
3. Mini Nutcracker (Free): Our standalone free introductory educational game, available via web browser, desktop applications, and native mobile/tablet applications.
4. Mozart’s Magic Flute (Paid – Upcoming): Our upcoming interactive educational music game, sharing the same platform architecture and licensing rules as The Nutcracker.
5. Other Platform Samplers & Future Titles: Including Alice in Vivaldi’s Four Seasons and related interactive music games developed under the Kids Music Games International brand.

---

3. Core Privacy Principles for Children’s Games

Before detailing specific technical flows, we state our overarching commitments regarding children’s privacy:

• No Behavioral Tracking or Advertising in Games: We never display third-party advertisements in our games. We do not track children across third-party websites or services, and we do not create advertising, behavioral, or cross-service marketing profiles of children.
• No In-Game Social Communication: Our games contain no open chat rooms, direct messaging systems, public forums, user-to-user networking, or unmonitored text input fields. Children cannot communicate with other users or publish personal information publicly.
• Data Minimization: We collect only the minimum amount of information technically necessary to deliver the gameplay experience, maintain educational progress, and verify software licenses.
• Protected Outbound Links (Parental Gate): Any external links inside our mobile applications (such as links to our commerce website, app stores, or customer support) are strictly shielded behind an arithmetic Parental Gate requiring adult verification before navigation can proceed.
• Parental Control: Parents and legal guardians have the right to inspect, correct, and request the permanent deletion of any personal information associated with their child’s gameplay at any time, subject to verification.

---

4. Information Collected From Parents, Adults, and Educators

Our commercial storefront and account management tools on kidsmusicgames.com are intended exclusively for adults (parents, guardians, teachers, and school administrators). We collect the following categories of information from adult users:

A. Website Account Information

When an adult creates an account on kidsmusicgames.com, we collect:

• Username (chosen by the user);
• Email Address;
• Password (cryptographically hashed using standard one-way algorithms; we never store plain-text passwords).

B. Purchase & Billing Information

When purchasing a game license through our website:

• Billing Details: Cardholder name, billing address, country, state, and postal code.
• Payment Card Processing: All credit and debit card transactions (Visa, Mastercard, American Express, Discover) are processed directly by our third-party payment gateways, Stripe and PayPal, utilizing encrypted elements and tokenization. We never receive, process, or store raw credit card numbers or CVV security codes on our servers.
• Transaction Records: Order identification numbers, purchased products, transaction timestamps, payment status, and IP address (logged by the eCommerce system solely for transaction fraud prevention and regional sales tax compliance).

C. Customer Support & Inquiries

If you contact us via email at help@kidsmusicgames.com or gimpelson@weekendangel.com, we collect your name, email address, and any correspondence history needed to investigate and resolve your technical, licensing, or billing inquiry.

D. “Tell a Friend” Referral Feature

Our website includes an optional feature allowing visitors to send a one-time game recommendation to a friend.

• The recipient’s email address is processed solely in transient memory to transmit the single email and is never stored in our databases or marketing lists.
• To prevent spam and automated abuse, we set a temporary, anonymous session cookie (kmg_share_session) containing a random string that expires automatically.

---

5. Information Practices for Paid Authenticated Games

(The Nutcracker & Mozart’s Magic Flute)

Our paid educational titles require adult authentication to associate gameplay progress with an authorized purchase. The technical data practices for these titles are as follows:

A. Parent / Adult Authentication & Sign-In Architecture

Access to our paid titles (The Nutcracker and Mozart’s Magic Flute) requires an initial account authentication to associate software access with an authorized adult purchase license. Our authentication system operates under strict adult-only compliance protocols:

• Adult-Exclusive Credentialing: In compliance with our Terms & Conditions and applicable children’s privacy frameworks, all account creation and login functions are intended and authorized solely for parents, legal guardians, and educators. Children under thirteen (13) (or the applicable age of digital consent) are strictly prohibited from creating accounts or logging in using their own personal Google or Apple accounts.
• Role of Third-Party Authentication (Google Sign-In & Sign in with Apple): We provide Google Sign-In and Apple Sign-In solely as an adult identity verification and credential management gateway to establish the authorized adult account. The authentication layer is bridged via Firebase Authentication (Google LLC).
• Child-Directed Service Safeguards & Google API Policy Compliance: In strict adherence to the Google API Services User Data Policy, Google Play Families Policy, and FTC COPPA guidelines:

1. Our applications do not access, request, collect, or store Google Account data belonging to children.
2. Sign-in is restricted by contract and interface to the adult account holder to manage family licensing and unlock educational content for their children.
3. We request only the absolute minimum OAuth scopes (openid, email, profile) necessary to verify the adult identity.
4. Google Account data is never combined with child gameplay telemetry, never shared with advertising or marketing networks, and never used for tracking, profiling, or commercial targeting.

• Data Processed & Stored for Adult Accounts: When an adult authenticates via Google or Apple, our backend database creates an adult administrative account record storing:
• The provider’s unique account identifier (firebaseUid);
• Identity provider type (google.com or apple.com);
• The adult’s registered email address (or Apple Private Relay anonymous proxy email);
• The adult’s public account display name (if supplied by the identity provider);
• Account creation date and lastSeen timestamp.

B. In-Game Player Profiles & Children’s Nicknames

Within the authenticated adult account, an authorized adult may create one or more local player profiles (for example, allowing different children in a household or classroom to save their own game progress independently). These profiles do not have independent login credentials, passwords, or email addresses.

• Player Nickname (playerName): A custom display name chosen on the Create Player screen (between 2 and 24 characters, e.g., “Maya” or “Player 1”). Parents and players are strictly instructed to enter only a first name or creative nickname, and never a full legal name.
• Avatar Selection (avatarId): A cartoon character icon chosen from our pre-designed graphic gallery.
• Data Safeguards: Player profiles do not collect, store, or solicit child email addresses, phone numbers, home addresses, dates of birth, or school names.

C. Game Progress Data

As the child plays the game, our backend database saves educational progress linked to the selected player profile:

• Unlocked musical rooms, doors, and scenes;
• Solved musical puzzles, ear-training exercises, and instrument challenges;
• In-game keys earned;
• Completed activities and game scores.

This progress data is purely mechanical game-state telemetry and contains no personally identifiable contact information.

D. Digital Licensing & Device Identifiers

To enforce our “one active device / station per license” policy and protect against unauthorized duplication, our system utilizes persistent technical tokens. Under the COPPA rule, these persistent identifiers are utilized strictly for support for internal operations (16 C.F.R. § 312.5(c)(7)):

• Desktop Games (Mac & Windows): The application generates a cryptographic hardware machine hash using node-machine-id. This hash is transmitted to our server to register the computer authorized to run the software. If a user moves the software to a new computer, an 8-character verification code is emailed to the adult purchaser’s address to authorize the transfer.
• Web Browser Games: When launched from our website, our server creates a temporary, single-use 64-character launch_token (valid for 30 seconds). The game script immediately exchanges this token for a 48-character session_token (SESS-..., valid for 7 days) tied to an application-generated random UUID stored in the browser’s localStorage (browser_device_id). If the game is launched in a different browser, the previous session is marked superseded.
• Mobile Applications: Purchases made through the Apple App Store or Google Play are validated via cryptographic store receipt entitlement verification tokens.

These technical identifiers are used solely to enforce authorized access, maintain game sessions, and secure our systems. They are never shared with advertising networks, never used for behavioral tracking, and never combined with cross-service profiles.

---

6. Information Practices for Mini Nutcracker (Free Game)

Mini Nutcracker is our completely free, introductory classical music educational game. Its privacy design is the simplest and most privacy-protective in our ecosystem:

• No Logins or Accounts: Mini Nutcracker requires zero registration, zero authentication, and zero user accounts.
• No Backend Telemetry: Mini Nutcracker downloads its visual and audio assets from our content delivery network, but does not send gameplay telemetry or personal information to our application backend.
• Client-Side Storage Only: The game uses the browser’s local storage (localStorage) strictly on the user’s own device for:

1. Build version cache busting (nutcracker_build_hash) so returning players automatically receive updated audio and graphics;
2. Local puzzle completion state for the Children’s Album mini-game so that progress is retained between sessions on that specific browser.

• Zero Third-Party SDKs: The application contains no analytics SDKs, no advertising SDKs, and no external tracking pixels.
• Parental Gate Protection: Any links exiting the application (such as the Parents Guide or links to explore the full game) trigger our arithmetic Parental Gate modal, requiring an adult to solve a math multiplication challenge before the link opens.

---

7. Dedicated Children’s Privacy Notice (COPPA & State Child Privacy Rules)

Because our educational games are directed toward children ages 5 and up, we adhere strictly to the Children’s Online Privacy Protection Act (COPPA) and its implementing regulations administered by the U.S. Federal Trade Commission (FTC), as well as state-specific children’s privacy statutes such as the New York Child Data Protection Act (N.Y. GBL Article 39-FF).

A. Notice to Parents

We provide this direct, prominent privacy notice so parents and guardians understand our data practices before their children play our games.

B. Parental Consent Framework

• Web Purchases: When an adult purchases a digital game license on kidsmusicgames.com, the transaction involves a credit card or PayPal payment that provides discrete transaction notification, which constitutes a recognized method of verifiable parental consent under 16 C.F.R. § 312.5(b)(2) for the educational gameplay features and profile setup described during checkout.
• Mobile App Store Purchases: Purchases made within the Apple App Store or Google Play are processed through adult platform accounts under adult commercial terms.
• Adult Account Management & Child Gameplay Isolation: Third-party OAuth identity providers (Google and Apple) are deployed strictly for adult account holders to authenticate parent software licenses. Children never authenticate via Google or Apple, and in-game player profiles maintain no third-party account linkages or external identity tokens.
• Support for Internal Operations: Persistent identifiers collected during gameplay (such as device authorization hashes and browser session tokens) are utilized exclusively for internal operations under 16 C.F.R. § 312.5(c)(7)—specifically, authenticating access, preventing piracy, maintaining game state, and securing our systems.
• Parental Gates vs. Parental Consent: Our arithmetic Parental Gate modal protects children from unintentionally opening external links. While it serves as an important child-safety barrier, it is distinct from statutory verifiable parental consent.

C. Parental Rights & Data Management

Parents and legal guardians have clear rights regarding their children’s data:

1. Right to Review: You may request to review any in-game profile information or gameplay state associated with your child.
2. Right to Deletion: You may request that we permanently delete your child’s player nickname, avatar, and game progress records from our active servers.
3. Right to Refuse Further Collection: You may instruct us to cease collecting further data from your child’s game profile by deleting the in-game profile or closing your account.
4. No Third-Party Commercial Disclosure: We do not disclose children’s personal information to third parties for commercial or marketing purposes.

To exercise any parental rights, please email us directly at gimpelson@weekendangel.com or help@kidsmusicgames.com with the subject line “Parental Data Request”. To protect your family’s privacy, we will take reasonable steps to verify your identity as the parent or legal guardian before processing your request.

---

8. Cookies, Tracking & Analytics

We maintain a strict boundary between web browsing on our marketing website and playing our games:

A. Website Analytics on kidsmusicgames.com

On our public website (kidsmusicgames.com), we use Google Analytics 4 (GA4) (Measurement ID: G-FWT44D6MJP) to understand website traffic patterns, popular pages, referral sources, and eCommerce conversion rates. GA4 collects anonymized device information, browser type, approximate geographic region (city/state level), and pages visited.

STRICT ARCHITECTURAL SEPARATION: Google Analytics 4 is installed only on the public marketing and eCommerce website (kidsmusicgames.com). Google Analytics 4 is NOT installed, loaded, or executed inside our child-directed games, web-game bundles, or mobile applications.

B. Essential Website Cookies

Our website uses standard session and functional cookies necessary to:

• Maintain your authenticated login session (wordpress_logged_in_*);
• Maintain your shopping cart contents and checkout progress (edd_items_in_cart);
• Manage CSRF security tokens and prevent fraudulent form submissions.

C. Server & CDN Access Logging

When accessing our website or downloading game assets, our hosting servers and content delivery network (Amazon Web Services CloudFront) automatically log standard technical connection metadata, including client IP address, browser user-agent, operating system, and request timestamps. These logs are used solely for network security, DDoS mitigation, error debugging, and operational reliability, and are automatically rotated and purged within ninety (90) days.

---

9. Third-Party Service Providers

Music Games International Company, Inc. does not sell, rent, monetize, or trade personal information to data brokers, advertisers, or any third party. We share information only with trusted service providers under strict data processing agreements solely to operate our service:

We do not sell children’s personal information or disclose children’s personal information to third parties for behavioral advertising or commercial profiling. Service providers process limited technical information on our behalf strictly as necessary to operate, secure, and maintain the service.

We may also disclose personal information if required to do so by law, subpoena, court order, or governmental regulation, or when we believe in good faith that disclosure is necessary to protect the safety, security, rights, or property of our users, the public, or the Company.

---

10. Data Retention & Account Deletion

We adhere to strict data minimization principles and retain personal data only as long as necessary:

• Adult Accounts & Profiles: Retained for the duration of your active account lifecycle. If you delete your account, your user credentials, associated child profiles, and game progress records are purged from our active databases within thirty (30) days.
• Game Progress: Retained while the customer’s account and digital license remain active so that the player can resume their educational progress across sessions. Progress is permanently deleted upon in-game reset, account closure, or parental deletion request.
• Financial & Order Records: Retained for seven (7) years following the transaction date to comply with federal and New York State tax, accounting, and commercial auditing requirements.
• Licensing Tokens & Machine Hashes: Retained as long as the digital software license remains active, and purged upon license deactivation or customer account deletion.
• Server Logs: Routine web server access and error logs are automatically rotated and deleted within ninety (90) days.
• Backup Archives: Residual copies of deleted data stored in encrypted disaster-recovery backups are permanently overwritten and destroyed within sixty (60) days of routine backup rotation.

---

11. School, Teacher & Educational Use

Our games are frequently purchased and utilized by elementary schools, music educators, homeschooling cooperatives, and school districts:

• Classroom Station Setup: Teachers and schools typically license the software per classroom computer, tablet station, or interactive whiteboard. Students play either as guests or under an educator-managed station license without entering personal identification.
• No Individual Student Accounts: Our educational games do not require or allow individual students to create personal accounts, submit student email addresses, or log into personal profiles.
• FERPA & Student Privacy Compliance: Because we do not collect, maintain, or process personal student educational records or student directories, our services comply with the Family Educational Rights and Privacy Act (FERPA) and applicable state student privacy frameworks (including New York Education Law § 2-d). We act strictly as a commercial digital curriculum vendor.

---

12. State-Specific Privacy Rights

A. New York Privacy Rights

As a New York corporation, we comply fully with New York State consumer and child protection statutes, including the New York Child Data Protection Act (N.Y. General Business Law Article 39-FF, §§ 899-ee et seq.):

• We do not process, share, or disclose personal data of users under eighteen (18) years of age for targeted advertising or profiling.
• We restrict all data collection from minors to what is strictly necessary to deliver the educational music game experience.
• New York residents may contact us at gimpelson@weekendangel.com to exercise their rights of access, correction, and deletion.

B. California Privacy Rights (CCPA / CPRA & CalOPPA)

To the extent applicable to us, the California Consumer Privacy Act as amended by the California Privacy Rights Act provides California residents with specific privacy rights:

• Categories of Personal Information Collected (Past 12 Months): Identifiers (name, email, IP address, device machine hash, player nickname), commercial transaction records (purchased products), and internet activity logs on our marketing website.
• No Sale or Sharing: We do not sell personal information and do not share personal information for cross-context behavioral advertising. We have zero actual knowledge of any sale or sharing of personal information of minors under sixteen (16) years of age.
• California Consumer Rights: Eligible California residents (and parents acting on behalf of minor children) may request:

1. Access to personal information collected;
2. Deletion of personal information;
3. Correction of inaccurate personal information;
4. Non-discrimination for exercising privacy rights.

• Shine the Light: Under California Civil Code § 1798.83, California residents may request information regarding third-party direct marketing disclosures. We do not disclose personal information to third parties for direct marketing.
• Age-Appropriate Design Principles: We design our services with children’s privacy and safety in mind and comply with applicable California children’s privacy standards.

---

13. Data Security Measures

We maintain industry-standard technical, organizational, and administrative safeguards designed to protect personal data against accidental loss, unauthorized access, misuse, alteration, or disclosure:

• Encryption in Transit: All communications across kidsmusicgames.com, our game web applications, and backend APIs are encrypted using modern Transport Layer Security (TLS/HTTPS).
• Payment Security: All card transactions adhere to Payment Card Industry Data Security Standards (PCI-DSS Level 1) through Stripe and PayPal tokenization.
• Storage Security: Backend databases and CloudFront origins are hosted within secured, firewalled cloud infrastructure with strict access controls.
• Minimal Data Footprint: By deliberately not collecting child contact information, phone numbers, or physical addresses, we minimize the potential impact of any security event.

While we implement robust security protocols, no method of digital transmission or electronic storage is completely impenetrable, and we cannot guarantee absolute security.

---

14. Systems & Data Processing Location

Our primary operational systems and servers are located within the United States. If you access our website or games from outside the United States, please be aware that your information will be processed and stored in the United States and other locations where our service providers maintain facilities. By accessing our services, you acknowledge this processing.

---

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect modifications in our software, updates to our legal obligations, or changes in operational practices.

When revisions occur, we will update the “Last Updated” date at the top of this page. If we make material changes to how we collect or use children’s personal information, we will provide prominent notice on our website and, where required by COPPA, obtain prior verifiable parental consent before applying such changes to previously collected information.

---

16. Contact Information & Designated Privacy Officer

If you have questions, comments, concerns, or requests regarding this Privacy Policy, our children’s privacy protections, or our data handling practices, please contact our designated Privacy and Legal Officer:

Music Games International Company, Inc.

(d/b/a Kids Music Games International)

Attention: Sasha Gimpelson, Privacy Officer

Physical Address:

418 Broadway STE N

Albany, NY 12207-2922

USA

Customer Support Email: help@kidsmusicgames.com

Privacy & Legal Officer Email: gimpelson@weekendangel.com

Primary Website: https://www.kidsmusicgames.com