Privacy Policy

The short version

KidBits Games LLC makes personalized video games. An adult describes a child, we build a game starring that child, and we deliver it as a private link that plays in a web browser.

• You are our customer. The child does not create an account, does not fill in any form, and never types anything into our website.
• The child does play the finished game, and we explain below exactly what that does and does not record.
• The only free text you can enter about a child anywhere in our system is their first name. Everything else is chosen from a short fixed list: gender, age stage, skin tone, hair, eyes and the item they carry.
• We do not collect a child's date of birth, real age, address, photograph, school, phone number or email address.
• We never sell your personal information for money.
• Giving us your email address does sign you up for our emails about new games and updates. From August 18, 2026 this works the same way as the advertising described below: we do not ask first, this page is your notice, and every one of those emails carries an unsubscribe link that ends them for good in one click. Your order confirmation and your delivery link are not marketing. They are part of what you bought and you receive them either way, whether you unsubscribe or not.
• Your email address may be used to reach similar parents through advertising platforms, and you can stop that at any time. This works on an opt-out basis rather than by asking first, so it is described in full below and you can decline before it ever affects you, by emailing privacy@playkidbits.com. Only a parent's email address is ever involved. Nothing about a child leaves our systems, ever, for any reason.
• We use one analytics tool to see where people get stuck on the site. It does not know who you are until you give us your email address. It sets a cookie so that we can tell one visitor from two. From August 26, 2026 it also records what happens on your screen. Everything you type, and every place a child's name is shown back to you, is blanked out on your own device before the recording is sent. Analytics is never used for advertising.

Everything below is the detail behind those statements.

Who we are

KidBits Games LLC is a limited liability company registered in North Carolina, United States, operating playkidbits.com.

Postal address:

General inquiries: hello@playkidbits.com
Order help: support@playkidbits.com
Privacy requests, opt-outs and data requests: privacy@playkidbits.com

This policy covers playkidbits.com and the games we build and deliver. It applies to people in the United States; we do not currently sell outside the United States.

What we collect from you

Information you give us

Your email address. We ask for it partway through building a game, before you pay, so that we can save your work if you close the tab. We store it in lowercase with surrounding spaces removed, so that one address is always one account.

A second email address, if the two differ. Our payment processor collects its own email address at checkout. If you enter a different one there, we keep both: yours as the address on your account, theirs as the billing address on that order. We do this because marketing attaches to a specific address, and we will not silently move a setting from one address to another. Only the address you typed on the builder is enrolled in marketing emails. A different address entered at the payment step is used for your receipt and nothing else, because it is our payment processor that collected it and you were not shown our notice at that moment.

Your payment record: the amount, the date, and reference numbers from our payment processor.

We do not collect or store your card details. Payment information goes directly to our payment processor and never reaches our systems. We cannot see your card number.

Whether you have unsubscribed or opted out, described in its own section below. We keep a record of that permanently, because forgetting it is how a company emails someone who told it to stop.

Anything you send us by email.

Information about the child in the game

A game can have up to four characters, so a sibling, parent or grandparent can join the party. For each one we store:

We also store the title of the game, which is generated around the child's name, so the name appears there as well.

Every one of those fixed choices is enforced by our database itself: a value outside the permitted list is rejected when it is written. The product is bounded by design rather than filtered afterwards.

The age stage above is a character size, not an age. It determines how the character is drawn. We do not collect or store a child's real age or date of birth.

What we do not collect about a child

There is nowhere in our system to record a child's date of birth, real age, home address, photograph, school, phone number, email address, or any free-text description beyond their first name. We do not ask for these and we could not store them if you offered them.

Information collected automatically

Standard server records. Our hosting provider keeps ordinary web server logs, as any website host does.

Product analytics. We use PostHog to understand how people move through the site: which pages are visited, how far someone gets through the character builder before leaving, and how much of the trailer video on the home page is actually watched. We use it to find the places where the site is confusing, and for nothing else.

Those analytics requests are sent to e.playkidbits.com, which is a subdomain of this site, and passed on from there to PostHog. This changes nothing about what an event contains and adds nothing to what is collected. It exists because ad and tracker blockers block requests made to PostHog's own address, which was leaving gaps in our numbers. The routing is operated by PostHog and carried over Cloudflare's network.

It is configured deliberately narrowly:

• It stores a random identifier on your device, in a cookie and in local storage, so that we can tell one returning visitor from two new ones. It is a random string, not a name, and it is described in the cookies section above.
• It is anonymous until you give us your email address, and not after. Up to that point we are counting visits, not people, and no profile is created for you. When you enter your email address at the save step, we attach it, so that we can see which routes through the site actually lead to a finished game. If you would rather we did not, email privacy@playkidbits.com and we will delete it.
• It records what happens on your screen, from August 26, 2026. This is a change. Until that date we recorded nothing of the kind and this page said so. We now keep a replay of the pages you see and what you click, because our own numbers could tell us where people stopped and never why. Two limits are built into it, and both run on your device before anything reaches us. Everything you type is replaced with asterisks, so a child's name, a child's age, your email address and any discount code never leave your browser. Every place the builder shows a child's name back to you is blanked the same way: the name on the character, the tab for each child, the saved character list and the confirmation line. We still record no heatmaps. Recordings are deleted automatically after 30 days. If you would rather we did not record you at all, email privacy@playkidbits.com and we will delete your recordings and leave you out.
• It counts how much of the trailer on the home page is watched, from August 27, 2026. The trailer plays without sound on its own when you scroll down to it. We record that you reached it, whether you turned the sound on, roughly how much of it played while it was on your screen, and whether you clicked the button underneath it. That is a count of seconds and four yes or no flags. It is not a recording of you, it says nothing about who you are, and nothing about a child is involved.
• It measures page speed and records errors. We collect how quickly pages load on your device, and when something breaks we receive the technical details of the failure so we can fix it.
• It never receives a child's name or age. Automatic capture of clicks and typing is switched off, and the screen recording described above blanks out everything typed as well as every place a name is displayed, so a child's name, a child's age and your email address are never sent to it. One thing is worth saying plainly rather than leaving you to work out: a screen recording does show the pictures on the page, so the character being built is visible in it, in the same way it is visible to someone standing behind you. We send a short, fixed list of events we chose by hand, such as "a character was completed" or "checkout was started". They carry only counts and simple yes/no flags, such as which of the three games was picked, how many characters were finished, and whether rush delivery was chosen.
• It does collect ordinary technical information automatically, as analytics tools do: an approximate location worked out from your IP address (roughly city and postal district, not a street address), your browser and operating system, your screen size, and the page that referred you. We use this to know whether the site works properly on the devices people actually use. It is not accurate enough to locate a person and we never try to.
• The data is stored in the United States and kept for one year.

A Meta advertising pixel runs on this site. It is how we tell whether an ad we paid for actually brought someone here. It records the page you are looking at, which of the three games was chosen, that a build reached the checkout step, and that an email address was entered. It is never given a child's name, age or appearance. When you give us your email address, a scrambled one way version of it is sent to Meta, so they can tell that the person who bought is the person who saw the ad. The readable address never leaves this site and Meta cannot turn the scrambled version back into it. When an order is paid, our own server tells Meta that a purchase happened, what it was worth, which game it was, and the order number. With that message it sends a short list of details, so that Meta can tell the buyer is the same person who saw the ad: the scrambled email address, plus your name as it appears on the card, your postal code and your country, each one scrambled the same way; a customer reference of our own, also scrambled, which stays the same if you buy again; and your IP address and your browser, which are sent as they are, because scrambling those two would make them useless to anyone including Meta. It does not send your street address, your phone number, your date of birth, your card details, or anything at all about a child. That message is sent from us, not from your browser, so it says only what is written here. The pixel also sets two cookies of its own on this site, named _fbp and _fbc, which is how a click on an ad is matched to a visit here. The product analytics described above is separate from it, and is still never used for advertising, never shared with an advertising platform, and never combined with your order. Advertising is handled separately and is described in Your marketing choices below, along with how to opt out of it.

What happens when the child plays the game

This section exists because a child is the intended player of what we build, and we would rather be specific than reassuring.

The game itself collects nothing. It is a single self-contained file. It contains no analytics, no tracking, no advertising, no network calls, and no way to send anything anywhere. It does not know who is playing. Nothing typed or done inside the game leaves the device it is played on.

Our server records that the link was opened. When the private link is opened, we increment a count and record the time of the most recent open. That is all. We do not record who opened it, where they were, what device they used, or anything about how the game was played. We use this to see whether links are being widely shared, and as evidence if a payment is disputed. Opens by our own reviewer are deliberately excluded from the count.

If you save the game file, even that stops. A saved copy plays entirely offline and never contacts us again.

Cookies

Three. The first two are strictly functional. The third is the analytics identifier described above, which is not:

• A sign-in session cookie, only if you choose to sign in to an account.
• An administrator session cookie, which applies only to us and never to you.
• An analytics cookie named ph_…_posthog, set by PostHog, together with a matching entry in your browser's local storage. It holds a random identifier and nothing else. Its only job is to let us tell whether two page views came from one visitor or from two people, which we could not do before. It lasts a year, and clearing your browser data removes it.

No advertising cookies. No third-party cookies.

This changed on 11 August 2026. Until that date our analytics stored nothing on your device at all. The cost was that every page you loaded looked like a different person, so we could not tell whether the site was confusing or simply busy. We would rather set one random identifier and say so plainly than keep a claim that made the tool useless.

The advertising described further down does not currently rely on a cookie. If that changes, whether to remember which ad brought you here or to measure whether it worked, this section will be rewritten to name that cookie before it is ever set, not afterwards.

Why we use your information

Your marketing choices

Emails about new games and updates, and how to stop them

Before August 18, 2026 this worked the other way round, as a box you had to tick, and we said we would only ever record a yes. We are keeping that promise to the people it was made to. If you gave us your address before that date and did not tick the box, you were not added to these emails and you will not be. The new arrangement applies to addresses given to us from that date onward.

An unsubscribe is permanent. Once you unsubscribe, buying from us again does not put you back on the list. Nothing you do on the website can re-enroll you, and only you can undo it, by asking us.

What these emails contain. News about new games, updates to existing ones, and offers such as a discount code. What they never contain is anything about your child. Your child's name, age, appearance choices and game are not sent to the company that delivers these emails for us. What that company holds is set out in the sharing table below.

Your order emails are separate and are not affected. Your confirmation, your delivery link and any message about a problem with your order are part of what you bought. Unsubscribing from marketing does not stop them, and it cannot.

Advertising, and how to opt out

We would rather describe this precisely than reassuringly, so here is exactly what it does and does not involve.

• Never a child's information. Names, ages, appearance choices, the game and the link to it stay in our systems. This is not a preference we have chosen and could change later. Federal law protects children's information, and the advertising platforms themselves prohibit receiving it. The only things that ever leave are a parent's own details and the technical details of the visit, both of which we list in full below.
• Your address is scrambled before it is sent, using a one-way process called hashing. To be accurate about what that does: it stops the platform reading your address in plain text, but it does not make the information anonymous, because the platform can still match the scrambled version against its own users. That matching is the entire point. We will not call that anonymous.
• Alongside it we may send ordinary technical details of your visit, such as your IP address, your browser, and an identifier attached to an ad you clicked to reach us. These are used to work out which ads led to which purchases, and to match your address more reliably.
• When you buy, we also send a few details from the payment itself: your name as it appears on the card, your postal code, and your country. These are scrambled exactly as your email address is, and they are sent for the same reason, which is that a match on several details is more likely to be the right person than a match on one. We also send a reference number of our own that stands for you, scrambled too, so that a second order is recognized as the same customer. We do not send your street address, your phone number, your date of birth or your card details, and we do not ask the payment page for them.
• We may send the fact and value of a purchase, so that we can measure whether an ad worked. This means the game type and the amount paid. It does not mean the child's name, the game title, or anything from inside the game.
• We do not receive information about you back from these platforms, and we do not buy lists of people to advertise to.

The product analytics described earlier is kept entirely separate from this. To be exact about what that does and does not mean: it does set one cookie holding a random identifier, and from the save step onward it is linked to your email address. Both are described above and neither is new. What it never does is leave our own tooling. It is never shared with an advertising platform, never used for advertising, and never combined with the scrambled address described in this section. It exists to fix a confusing website and does nothing else.

To opt out, email privacy@playkidbits.com with the subject line Opt out of advertising, or use the opt-out link at the bottom of any marketing email we send you. You do not have to give a reason.

When you opt out we stop including your address, and we remove it from any advertising audience already created, within 30 days. Unsubscribing from our marketing emails opts you out of advertising audiences as well, so you do not need to do both. We cannot undo an ad that someone has already seen.

We keep a permanent record that you opted out. This is the one piece of information we will not delete on request, because deleting it is how an address quietly gets added back later. The record is your email address and the date, and it is used for nothing except keeping you out.

Selling and sharing

We never sell your personal information for money, and we never will.

That said, several US state privacy laws define sale and share broadly enough that sharing an email address with an advertising platform, as described above, falls within those definitions even though no money changes hands. We would rather tell you that plainly than rely on a narrow reading of the word. So: if you are in California, Colorado, Connecticut, Virginia, or another state with a comparable law, treat the opt-out above as your right to opt out of the sale or sharing of your personal information and of targeted advertising. One email to privacy@playkidbits.com exercises it. We do not require an account, a form, or a reason.

We do not use your information to make automated decisions that produce legal or similarly significant effects, and we do not profile you for any purpose beyond the advertising described here.

Who else handles your information

We use a small number of established service providers. Each receives only what it needs.

All are based in the United States and our data is stored in the United States.

We may also disclose information where we are legally required to, or to establish or defend a legal claim, for example as evidence in a payment dispute.

How long we keep it

Provisional periods, subject to confirmation on legal review.

A copy of a game you saved to your own device is not covered by any of this. It is yours and it stays yours. See below.

The game file itself

The game we build is a single file that plays in a browser. It contains the child's first name and appearance choices in plain text, and a hidden reference number identifying the order it was built for.

You can save that file and keep it. That is deliberate. It is your game, and it should still work years from now with no internet connection.

The link we email you is different. It is a long random address that cannot be guessed, it is published nowhere, and we can switch it off. A refund switches it off immediately.

How we protect it

• Game files are held in private storage with no public address. They are served only by our own system, which checks the link is valid and has not been refunded.
• Our database refuses anyone who is not signed in. A signed-in customer can read only their own records. We tested this by signing in as one family and attempting to read another's, and received nothing.
• Game links use 64 random characters rather than a sequential order number, so links cannot be found by guessing or counting upwards.
• A person reviews every game before it is delivered. Nothing reaches a child unseen.
• Names are screened automatically, before payment and again before the game is built. Anything resembling an email address, web address or phone number, along with markup and unambiguous profanity, is refused; borderline cases are flagged for a person to review. The screening is deliberately biased toward flagging rather than refusing, because wrongly rejecting a real child's name is the worse mistake.

No system is perfectly secure and we do not claim otherwise. If a breach affects your information, we will tell you.

Children's privacy

Our website is sold to and used by adults. We do not knowingly allow a child to create an account, submit a form, or provide information to us directly. All information we hold about a child is provided by the adult who bought the game.

The finished game is intended for a child to play. As described above, the game itself collects nothing, and our records of it consist only of a count of how many times its private link was opened.

If you believe a child has provided information to us directly, email privacy@playkidbits.com and we will delete it.

Your rights

You may ask us to:

• Tell you what we hold about you and about the characters in your games.
• Correct anything inaccurate.
• Delete your information. We will delete your account, character details and game files. We must retain payment and tax records for the period above, and we cannot reach a copy of a game you have already saved.
• Stop marketing to you at any time, with no effect on anything you have bought. Use the unsubscribe link in any marketing email, or email privacy@playkidbits.com.
• Opt out of advertising audiences at any time, by emailing privacy@playkidbits.com or using the opt-out link in any marketing email. We will action this within 30 days.

Email privacy@playkidbits.com. We will respond within 30 days. We may need to confirm your identity before acting, so that we do not disclose your information to someone else.

Changes to this policy

If we change this policy we will update the date at the top. If a change is significant, in particular anything about advertising or about what we collect, we will notify you by email before it takes effect. We will not apply a materially different practice to information we already hold without telling you first.

11 August 2026, analytics. Our analytics tool now stores a random identifier on your device and attaches your email address once you enter it at the save step. Before this date it did neither. Nothing else about it changed on that date: there was still no session recording, no heatmaps, no automatic capture of clicks or typing, and nothing about a child was sent to it. Screen recording changed on August 26, 2026. The entry below describes it. The cookies section and the analytics section above describe the new arrangement in full.

That promise applies to the advertising described in this version. An earlier version of this policy said we did not share email addresses with advertising platforms. If you gave us your email address before August 11, 2026, we will email you before your address is included in any advertising audience, and that email will tell you how to decline. If you gave it to us on or after that date, this page is the notice and no separate email is needed.

18 August 2026, marketing emails. Emails about new games and updates used to require you to tick a box. They no longer do. Giving us your email address now enrolls you, this page is your notice, and one click on the unsubscribe link in any of those emails ends them permanently. This is not applied backwards. If you gave us your address before this date and did not tick the box, you were not added and you will not be, including if you buy from us again. Nothing about your order emails, your refund rights, what we collect about a child, or the advertising described above changed on this date.

20 August 2026, what we send the advertising platform. The message our own server sends Meta when an order is paid now carries more about the buyer than it did: your name as it appears on the card, your postal code, your country, your IP address, your browser, and a reference number of our own that stands for you. The name, postal code, country and reference number are scrambled the same way your email address already was. Nothing new is collected from you to do this. Every one of those details was already given to us, or given to our payment processor to take the payment. The reason has not changed and neither has the opt-out: it is still only about telling whether an ad worked, and emailing privacy@playkidbits.com still stops all of it. Nothing about a child is included. That has not changed and it will not. We also considered asking the payment page for your full street address, which would match better still, and decided against it.

26 August 2026, screen recording. We now record what happens on your screen while you use the site. Before this date we did not, and this page promised we would not. We changed it because our own numbers showed people leaving the builder without ever telling us what stopped them. Nothing new is collected about a child. Everything typed is replaced with asterisks on your own device before the recording is sent, and so is every place the builder shows a child's name back to you. A recording does show the pictures on the page, including the character being built. Recordings are deleted automatically after 30 days. Emailing privacy@playkidbits.com stops it for you and deletes what we already hold.

27 August 2026, the trailer. We now count how much of the trailer on the home page is watched: that you reached it, whether you turned the sound on, how much of it played while it was on your screen, and whether you clicked the button underneath it. Nothing new is collected about you and nothing at all about a child. It is a count of seconds on a video that was already there, and it exists so that we can tell whether the trailer is worth keeping. Nothing about advertising, about your order, or about what we hold on a child changed on this date.

Contact

General: hello@playkidbits.com
Order help: support@playkidbits.com
Privacy, opt-outs and data requests: privacy@playkidbits.com

See also our Terms & Conditions.