Privacy Policy

We keep what the game needs to work: your email, your display name, your age group, and your progress in the world. Your private photos, clips, and audio are encrypted before they're stored — and the section below is honest about who holds the keys today.

We show no ads, we sell nothing about you, we run no third-party trackers, and we don't follow you around the internet. If any of that ever changed, this page would change first — loudly.

Your account: the email address you sign in with, a display name you choose, and your age group (13–17 or 18+). Real safety rules hang off your age, so while you can correct it in your Trust Center, a teen account can never promote itself to adult.

Your life in the world: rooms you decorate, quests you finish, play-money balances and their full ledger history (recent activity in your Trust Center, everything in your data export), characters you've befriended, garden plantings, streaks, and an audit trail of important actions.

Things you keep here: media you upload to your family's Gallery, Theater, or Music room (encrypted — see below), memories you deliberately save with Marlow in the Memory Library, plus a few small milestone memories the world records automatically (like a level-up) — visible in the Library like everything else.

Your family: circle memberships, invites you've sent, guardian links and the spending caps attached to them.

Plumbing: the strictly-necessary cookies that keep you signed in (a session cookie and sign-in security cookies — no advertising or cross-site tracking cookies), plus basic technical logs that tell us when something breaks so we can fix it.

Ottopedia shows no advertising and embeds no ad networks. We do not sell, rent, or trade your personal information — to anyone, for anything.

There are no third-party analytics or tracking scripts on Ottopedia today. If we ever add usage measurement, our commitment is that it will be privacy-preserving, we will not use advertising trackers, and this page will describe it before it happens.

The play currencies (Glow, Current, XP, Tickets) are never cashable — so there is no gambling-shaped economy and nothing about your play is monetized behind your back.

When you put a photo, clip, or song into your family's media rooms, it is encrypted before it is stored in our database (AES-256-GCM, if you like the technical name). What sits at rest is ciphertext — a locked box.

Now the honest part: in this early phase, Ottopedia's server performs that encryption and custodies the master key. That means our systems could technically decrypt your media. We don't browse it — but a promise that we *can't* would be false today, so we won't make it. Two things are also stored readable on purpose: a small preview thumbnail (so your shelves load fast) and your caption (which runs through our safety filter, like all shared text).

The designed end state — the code is literally built around this swap — is keys held by your family alone, so that we couldn't open anything even if pressured to. When that ships, this section changes to say so, and not a day before.

Cloudflare serves the website and runs our code at the edge. Prisma Postgres hosts our database (including your encrypted media boxes). Resend delivers our emails — sign-in magic links and family invites. If you sign in with Google, Google confirms your email to us. Where real-money purchases are offered, Stripe processes payment — your card details go to Stripe, never to us.

Real AI chat for the companions is switched off by default. If Ottopedia's operator turns it on, each chat message you choose to send goes to the AI provider Ottopedia has configured (DeepSeek or Anthropic) to generate the reply. Real chat is metered with spending ceilings, labeled in the world, and Ottopedia does not store the content of those messages.

The Companion Emojis browser extension has its own, narrower privacy page — it keeps your emoji picks on your own device.

Ottopedia accounts require the account holder to be at least 13, and the limit is enforced by our servers at sign-up. We do not knowingly collect personal information from children under 13. If we learn an under-13 account was created, we will delete it and its data.

For 13–17 accounts, protective defaults are on from the first minute: real-money spending starts at zero and only a guardian can raise it, limits stay guardian-managed, and marketplace selling is adult-only. Parents and guardians can read exactly how the safety systems work — including the kill switch — on the How Ottopedia Works page, without signing in.

We keep your data while your account exists, so the world can keep remembering you. Sign-in links and sessions expire on their own.

When you delete your account, your personal information and creations are removed. A small set of records must survive for honest bookkeeping — real-money purchase records and marketplace receipts — and those are anonymized: stripped of your name and email, kept under a random identifier that no longer points to you. The world's audit trail keeps its entries under account IDs rather than names; a few entries note details like the email an invite was sent to, and we scrub your email from those when your account is deleted.

Download your data: the Trust Center has a "Download my data" button that gives you your information as a file you can keep — profile, progress, ledger, memories, and the rest. Your Memory Library has its own export too.

Delete your account: the Trust Center's "Leave Ottopedia" flow deletes your account after a typed confirmation, as described in the section above. It is real deletion, not a hidden deactivation.

Changing the email on an account isn't self-serve yet — write to us and we'll help. Your age you can correct yourself in the Trust Center; the one change that never works self-serve is turning a teen account into an adult one, which requires verification.

When this policy changes, the date at the top changes with it, and meaningful changes get announced plainly. This page never gets quietly swapped out from under you.

If we ever discover a data breach that affects you, we will tell you plainly and quickly — what happened, what it touched, and what we're doing about it. No burying.

Questions, worries, or requests about your data — including anything a parent wants to double-check — go to the address below. A human reads it.