Who this policy covers
This policy describes information handled through the Mystery Missions software, marketplace pages, teacher dashboard, and Creator tools. The operator identified at the end of this policy is responsible for its account administration, security, licensing, and inquiry processing. Schools and teachers may have their own responsibilities for classroom data; the precise controller and processor roles must be addressed in any required school data-processing agreement.
A mission’s seller and any external checkout website are responsible for the information you provide directly to them. Their privacy policies also apply. This policy does not mean that the platform is certified for a particular school, jurisdiction, or privacy program.
Information the platform handles
- Teacher and Creator accounts: email address, account identifier, verification and sign-in events, activated mission licenses, and relevant purchase-source or activation records. You do not provide payment-card details to the Mystery Missions marketplace.
- Classroom access: classroom identifiers, mission and published-version references, class labels and settings, code creation and expiry dates, and timer settings.
- Student participation: the nickname or team name entered, session identifiers and access tokens, local game state, and—in tracked sessions—task completion counts, completion status, timestamps, and timer information. Do not enter student real names or contact information.
- Technical and security information: network requests and service logs, device/browser information needed to render the service, and hashed network identifiers used for abuse prevention. Hosting providers may process IP addresses in their infrastructure logs.
- Platform analytics: account, classroom, mission, and session identifiers associated with dashboard use, class activity, completions, and shop-link clicks. The analytics activity ledger does not copy student nicknames, email addresses, or bearer tokens. Pseudonymous identifiers are not necessarily anonymous.
- Creator content: educational content, artwork, audio, resources, drafts, publishing settings, and approved public listing information uploaded by an authorized creator.
- Inquiries: your adult contact name, email, optional creator/business name, message, submission time, and the privacy-notice version. Spam prevention stores short-lived hashed identifiers separately from the inquiry.
- Optional newsletters: the verified teacher email, opt-in choice and record, and delivery/synchronization status when you choose to subscribe.
Why information is used
We use information to verify account access, deliver licensed missions, manage classrooms, save or display progress, operate timers, host creator content, provide support, respond to inquiries, and investigate suspected code sharing or security problems. Usage reports help us understand platform use and compare activations with reported sales and authorized free copies; they do not automatically deactivate accounts.
Where the GDPR applies, relevant grounds may include performing a contract or taking requested steps before a contract, legitimate interests in operating and protecting the service, complying with legal obligations, and consent where required. Legitimate interests must be balanced against users’ rights. Classroom processing requires an appropriate school authorization or other applicable legal basis; a teacher’s general acceptance of terms is not a substitute for every required permission.
Optional marketing is separate from access to a purchased mission. Submitting a creator inquiry does not subscribe you to a mailing list. We do not use student nicknames or progress to build advertising profiles, and this platform does not provide targeted advertising inside missions.
Children and classroom participation
Students join a teacher-managed class without creating email accounts. We ask for a nickname or team name instead of a real name. This reduces what is needed, but does not make all student information anonymous or remove privacy obligations.
Before classroom use, schools and teachers must review the service and provide the notices and authorizations required in their circumstances. Where parental permission is required, it must be obtained through an appropriate process. Parents or guardians can ask the teacher and the platform operator about reviewing, correcting, deleting, or preventing further collection of their child’s information. We may need limited information to verify authority and identify the correct session without exposing other students’ data.
Creator inquiries are for adults. Do not submit student information, student photographs, student voice recordings, or confidential school records through that form or the Creator tools.
Cookies and browser storage
Mystery Missions is responsible for the browser storage described here; operator details appear at the end of this policy. Supabase authentication cookies maintain teacher and Creator sign-in sessions. The short-lived mm_teacher_activation cookie links the activation and email-verification steps; it lasts no more than 20 minutes and is cleared when the flow completes or is canceled. Authentication cookies may be renewed while an account remains signed in; the current authentication library sets a maximum cookie lifetime of 400 days. That browser-cookie lifetime is separate from access-token validity and classroom-code expiry.
Browser local storage and session storage support classroom access, a player’s nickname, session credentials, clues, timer information, activity answers, and resuming a mission on the same browser and device. Sound and volume settings are saved when adjusted. Creator tools also keep browser recovery drafts. These functions do not use advertising cookies. The two domains have separate browser sign-in sessions and local storage even though licensed missions are linked to the same teacher account.
Session storage normally lasts for the browser-tab session, although browsers may restore it. Local storage has no automatic browser expiry. Expired classroom access is rejected, and some expired entries are removed when the application reads them; previous-player records, activity saves, audio settings, and recovery drafts can remain until cleared or replaced. Server-side student-progress deletion does not clear copies already saved on a device.
Clearing browser storage, using a private-browsing window, switching devices, or changing domains can prevent a saved session from being found. Teachers should follow school procedures for shared devices. Signing out clears account access, but does not necessarily erase every locally saved mission or Creator draft. Do not clear storage during active play unless you are prepared to lose that browser’s resume information.
The current platform source does not include Google Analytics, advertising pixels, session-replay scripts, or embedded third-party marketing forms. Optional teacher-dashboard visit and shop-link reporting stays off until you accept it in the dashboard privacy choices. Accepting or rejecting does not change purchased access or classroom progress tracking. You can change your choice through Privacy settings in the dashboard. This browser-specific choice is saved for up to 180 days and does not automatically transfer to another device or domain. Withdrawal stops future optional reports; it does not itself delete records already collected. These reports are not anonymous merely because they are first-party. Any future non-essential cookies or similar tracking must be assessed and, where required, kept inactive until valid consent is given. Newsletter opt-in is separate from cookie consent.
Service providers and outside links
Vercel provides website hosting and delivery; Supabase provides authentication, database, storage, and backend services. Authorized platform administrators access information only for operating and supporting the service. A teacher can view tracked progress for their own classroom sessions, rather than another teacher’s classes.
If a teacher opts into newsletters, Flodesk processes the subscription information for that optional service. If an authorized creator chooses AI-assisted creation or narration, the submitted instructions and relevant creator content may be sent to the configured AI provider, currently OpenAI, to produce the requested output. Do not include student information in AI prompts.
Creator inquiry notifications are sent to mystery.missionsapp@gmail.com through Resend, using the platform’s verified sending infrastructure. Google processes messages received in that Gmail inbox. A private platform copy is kept separately; email copies have their own retention and deletion handling.
External sellers and services linked from listings have their own terms and privacy policies. Approved marketplace descriptions and promotional images are public; protected mission content and teacher resources are not made public simply by creating a listing.
Providers may process information outside your country, including outside the EEA. Where applicable, the operator must put appropriate transfer safeguards and processing arrangements in place, such as an applicable adequacy mechanism or approved contractual safeguards. Ask the operator for the arrangements relevant to your school before use.
How long information is kept
- Classroom joining/play is normally available for 72 hours after code creation. That is an access deadline, not a promise that all associated records are erased at 72 hours.
- For tracked sessions, the standard progress-review window ends seven days after classroom-code expiry. Expired server-side student progress is removed by the scheduled daily cleanup, rather than necessarily at the exact expiry second. The dashboard shows the relevant deadlines.
- Teacher account and license records are retained while needed to provide activated access, establish entitlement, handle support or disputes, and meet applicable legal obligations. Classroom and activation records and pseudonymous usage records may be retained separately for those purposes; they do not share the short student-progress cleanup window.
- Creator inquiries are removed from the platform inbox after 180 days by daily cleanup. Separate correspondence, if any, is handled for as long as needed to respond or manage an agreed relationship. Inquiry abuse-prevention records are removed after two days by daily cleanup.
- Creator content is retained to provide authoring, publishing, authorized access, and recovery. Removing a public listing does not delete an underlying mission. Deletion and recovery arrangements must be addressed before ending a creator relationship.
- Optional subscription information is handled while the subscription is active, with limited suppression or compliance records where needed. Infrastructure logs, backups, and legal holds can have separate retention periods; deletion from active application data may not immediately remove protected backup copies.
Your choices and privacy rights
Contact the operator identified at the end of this policy to request access, correction, deletion, restriction, or portability where applicable, or to object to processing based on legitimate interests. You may withdraw consent for optional processing without affecting its earlier lawful use. Marketing messages provide an unsubscribe option. Essential account processing is separate from marketing.
We may need to verify identity and authority before responding, and may retain limited information when required by law or needed to address a dispute. A school or parent request must not expose another classroom’s information. Where the GDPR applies, requests are normally answered within one month, subject to permitted extensions and exceptions; you may complain to your competent data-protection authority.
Security measures and access controls reduce risk but cannot guarantee that every system or internet transmission is risk-free. Report suspected unauthorized access without sending passwords, sign-in codes, activation codes, or student names in an initial message.
Policy updates
We will update the version date and provide appropriate notice when information practices materially change. A revised privacy policy does not itself create a new legal basis for an incompatible use of information. Contact the operator identified at the end of this policy for current privacy or school data-processing questions.
Who operates this platform?
Mystery Missions, operated by L. Giuffrida, is responsible for operating this platform.
Contact: mystery.missionsapp@gmail.com.