COSMIQ

COSMIQ ("we", "our", or "the app") is a space-education app designed for children and families. We are committed to protecting the privacy of all users. This policy explains what information the app handles, where it goes, and how to remove it.

The short version: almost everything stays on your device. The app shows no adverts, contains no advertising or analytics software, and never builds a profile of your child.

1. Information Stored Only On Your Device

The following never leaves the device it was entered on. It is not uploaded to us and it is not visible to us:

• First name — entered by the user or parent during onboarding, and shown only on the Home and Profile screens. It is never spoken aloud, never sent anywhere and never attached to anything we store.
• Age — entered as a number during onboarding. Four things on the device read it: a quiz picks its easier question set for children of seven and under, where an easier set has been written for that object; the "You in Space" birthday toy starts from it; the Birthday Sky picker in Zyx's Lab starts its year from it; and the solar system's orrery uses it for the "when I was born" button. In the last three the number is shown on screen and can be changed there. Zyx's voice and wording are the same for every child, whatever their age. The age is never sent anywhere.
• Preferences — chosen theme, reminder times, and whether game sound effects are on.
• Parental gate state — the count of incorrect answers and any lockout, so a child cannot simply retry a gate until it opens.
• Sign-in details — if a parent signs in, the provider's account identifier, the email address the provider returned (when it returns one) and the tokens that keep the session alive are held in the device's secure keychain. The email address is used only to show which account is signed in; it is never sent to our server.
• Cached space content — the most recent astronomy pictures, space-weather readings and launch listings, so the app still shows something without a connection. This holds no information about your child.

2. Information Saved To Your Account

If, and only if, a parent chooses to sign in with Apple or Google, we save a copy of learning progress so a child keeps it on a new or reinstalled device. That copy contains:

• Badges earned, Star Points (XP), best scores in Space Blitz and Galactic Guardian, weekend medals, this week's points and quiz count, which daily mission and weekend challenge have been done, and which "You in Space" toys have been opened.
• A record of which calendar days the app was used, and the date it was last used. This is what lets a streak survive a change of phone, and what stops two devices counting the same day twice. It is used for nothing else — no reporting, no reminders, no profiling.

It does not contain your child's name, their age, their location, or anything they typed. Those stay on the device, as described above.

The saved copy is stored under a one-way key derived from the account identifier combined with a secret held only on our server. The Apple or Google identifier itself is never written to our database, and no name, age or email address is stored beside it. A device can read or change that copy only after proving it is currently signed in to that account, so nobody else can reach your child's progress.

We also store a random identifier for each installation, created on the device and not derived from any hardware or account detail. It exists so that one family's account can be used on up to three devices at a time, and so a replaced phone can take over the slot of an old one. It tells us nothing about who you are, and it is forgotten when the app is uninstalled.

3. Location

COSMIQ asks for approximate location permission, and only for the stargazing features: the sky map, tonight's Moon, which planets are visible tonight, the space-weather page, and the Explore hub's summary of what is up tonight. These need to know roughly where you are standing in order to work out what is above you.

Three things about it matter:

• Approximate only. The app never asks for precise location. On Android the precise-location permission is blocked outright in the app's manifest, so the only permission it can hold is the coarse one; on iOS the app is built with reduced accuracy as its default and never asks for full accuracy. What comes back is roughly a one-to-three kilometre area, which is all the astronomy needs. We cannot see a street address, and we do not want one.
• It never leaves the device. Coordinates are used on the device to calculate what is overhead. No request the app sends — to our server or anywhere else — carries them. We never receive them, never store them, and never share them.
• Declining is fine. If permission is refused the app keeps working. Most stargazing screens fall back to a default city, clearly labelled as a default so nobody is misled; the sky map instead says it needs a location, because a star map aimed at the wrong city is worse than no star map.

Location is requested only while the app is open. COSMIQ never tracks location in the background.

The sky map also reads the device's compass and motion sensors so the sky moves as the phone is turned. Those readings stay on the device and are not stored.

4. Reminders and Notifications

COSMIQ can send space-exploration reminders after notification permission is allowed. These are scheduled entirely on your device. They do not require an account or an internet connection, and no push-notification token is ever created or sent to us or to anyone else.

Default times are 6 PM on weekdays and 10 AM on weekends, in the device's local time. Parents can change the times or turn reminders off in Profile. The times are fixed by that setting alone: the app does not watch when your child uses it in order to choose a moment to interrupt them. Reminders say what is new and waiting; we deliberately do not send streak warnings, "you are about to lose" messages, or anything else designed to make a child feel they must open the app.

5. Where Data Travels

We do not sell, rent, or share any personal data with advertisers or data brokers. We have never done so and the app contains no software capable of it.

Space data is fetched through our own server rather than directly from the organisations that publish it. This is a deliberate privacy measure: those organisations see a request from our server, not from your child's device, so they receive no device address or identifying detail. Through that server the app draws on public space-science archives, a public space-weather service, a public satellite-tracking service, a public rocket-launch database, and a public exoplanet archive. None of these requests carry any information about you.

The device itself communicates directly with these parties:

• Our server — for all space content and, if signed in, the saved progress described above.
• The image servers of the space archives above — a few photographs are loaded straight from the archive that publishes them, over an encrypted connection, so they display at full quality. The spinning view of Earth checks every frame's address against that archive's own host on the device and drops anything else; the birthday picture is loaded when the archive's feed marks it as an image and gives an encrypted address. Pictures offered by the rocket-launch database are not loaded at all. No photograph is ever loaded from an advertising network, a recommendation service or any other third-party content network: where a day's entry is a video hosted on such a service, the app shows the text and skips the video entirely, including its thumbnail image.
• Apple or Google — only if a parent chooses to sign in. They handle the sign-in themselves. The app receives an account identifier and, where the provider supplies one, an email address; both stay in the device's keychain. Our server is sent the provider's signed token so it can check the sign-in is genuine, and it keeps only the one-way key described in section 2 — never the identifier itself, never the email.
• RevenueCat — our subscription provider, which records whether a subscription is active. When a parent is signed in it receives a random subscriber identifier our server creates for that account; when nobody is signed in it uses an anonymous identifier of its own. It also receives the store's purchase information, which is what tells it the subscription is real, and its own software collects technical details about the device it is running on, described in RevenueCat's own privacy policy. We never send it your child's name, age, location or learning progress.
• Expo — checks whether an updated version of the app's content is available, in the same way an app store checks for updates. The request carries the app version, the platform and a random installation identifier created by that software. It carries no personal data.
• Your device's own speech engine — most of the narrator's lines are recordings shipped inside the app. Anything not recorded is read aloud by the speech engine built into the phone, the same one the rest of the device uses. On many Android phones that engine is Google's and may send the line of text to Google to be spoken. Only fixed lines of space narration are ever passed to it — never your child's name, their age, or anything they typed.

A few things in the app are links out of it, and each opens in the device's own browser rather than inside COSMIQ. A rocket launch's live webcast — usually YouTube — and the store page for managing a subscription each sit behind their own parental gate, so a child cannot follow one alone. The standard licence terms sit on the subscribe screen, which is itself reached only after a parental gate. Once any of these is followed, the privacy policy of the site it opens applies instead of this one.

Payments are handled entirely by the App Store or Google Play. We never see card details.

6. No Advertising, No Tracking, No Analytics

COSMIQ contains no advertisements. It includes no advertising software, no analytics or attribution software, and no behavioural tracking of any kind. It reads no advertising identifier. We do not ask for permission to track you across other apps or websites, because we do not do it. The app does not request access to the camera, microphone, photo library, contacts, or your files.

The one place purchase information is recorded is our subscription provider, described in section 5, and that exists to know whether a family has paid — not to measure what anybody does in the app.

7. Children's Privacy (COPPA)

COSMIQ is designed for children. Onboarding asks for a first name and an age, and both are kept on the device and never transmitted — so no personal information is collected from a child in the sense the rule means. Signing in with Apple or Google is optional, sits behind a parental verification step, and is intended to be completed by a parent or guardian rather than the child. No account is required to use the app's free content.

The identifiers we do hold for a signed-in family — the one-way account key, the random subscriber identifier and the random installation identifier — exist to give a child back their own progress, to keep the subscription a parent paid for, and to cap how many devices share one account. We do not use them for analytics, for measuring how often anyone returns, or to build any kind of profile. If you believe a child has provided us with personal information, use the account deletion page linked in section 9 and we will delete it.

8. How Long We Keep Information

Information stored on your device stays there until you erase it, using any of the options in the next section.

A saved progress record is kept while the account is in use, so that it is there when a child opens the app on a new device. A cleanup routine runs once a day and removes records that nothing has touched for about two years, along with the marker left by a deletion once it is ninety days old and every device has had the chance to see it. When you delete your account or reset progress, the record is emptied immediately, and the marker also instructs any other device still holding the old progress to clear it the next time it connects.

Our server writes short operational logs — which endpoint was called and whether it worked — kept only long enough to diagnose faults. They contain no IP address, no account key and no progress. Cloudflare, which runs the server for us, necessarily handles your device's network address in order to deliver each request and to apply rate limits; we do not record or keep it.

9. How To Delete Your Data

There are three controls, all in the Profile tab, and they do different things:

• Reset learning progress (under Manage data) — clears points, streaks, badges, completed activities and game records. If you are signed in it clears them for the account, so every device syncing to it is cleared too. You stay signed in, and the name, age and any purchase are kept.
• Sign Out (under Account) — saves anything not yet synced, then clears the account's progress from this device and signs out. The saved copy for the account stays intact, so signing in again brings the progress back. The name, age and chosen theme stay on this device.
• Delete COSMIQ account (under Manage data) — erases the saved copy for the account, clears this device including the name and age, signs you out, and withdraws the sign-in provider's access grant. Other devices clear their copy the next time they connect. This cannot be undone.

All three sit behind a parental gate so that a child cannot trigger them alone. None of them cancel a paid subscription: subscriptions are managed and cancelled through the App Store or Google Play directly.

If you are handing the device to someone else, or setting it up for a different child, note that Sign Out deliberately leaves the name and age in place. To clear those too, use Delete COSMIQ account, or sign out and then uninstall the app.

You can also request deletion without installing the app, which is useful if you have already removed it. Visit our account deletion page and follow the instructions there.

One caution about removing the app by hand. Uninstalling COSMIQ clears what is on the device, but on iOS a small amount of sign-in information is held in the system keychain, which by design survives an app being deleted and is restored if you reinstall. If you want a genuinely clean state, use Sign Out or Delete COSMIQ account inside the app before uninstalling it. On Android, clearing the app's storage in system settings removes everything held locally.

10. Security

All communication with our servers uses HTTPS encryption. Sign-in credentials are held in the device's secure keychain rather than in ordinary storage. Requests that read or change saved progress must prove they come from a device currently signed in to that account. Our servers are rate limited to resist abuse. The account identifier we store is a one-way hash, so even direct access to our database would not reveal which Apple or Google account a record belongs to.

No system is perfectly secure, but the most effective protection here is how little we hold: no names, no ages, no locations, no messages, and no payment details.

11. Your Rights

Depending on where you live, you may have the right to see what we hold, correct it, or have it erased. Because we deliberately store so little, the controls in section 9 already carry out erasure immediately and in full. For anything else, including a copy of what is held for your account, use the account deletion page linked in section 9, which also carries our contact details, and we will respond.

12. Changes To This Policy

We may update this policy from time to time. The current version is always available on this page and inside the app under Profile, and the date it last changed is shown below. Material changes will be reflected here before they take effect.

Last updated: September 16, 2026