IntoWhy ("we", "us") is a curated library of tiny answers for curious kids. This page explains what we collect, what we don't, and why -- in plain language, not legal filler.

IntoWhy is operated by Into Why, an Australian sole trader business.

The short version

• One parent can use an email-and-password account for the whole family. We do not create child accounts or profiles.
• We don't ask children for their name, age, email, or any other personal information.
• We do not track children or run advertising technology inside Worlds or Questions. With a visitor's choice, we use the Meta Pixel only on parent and marketing pages to measure whether our ads lead to visits, sign-ups, and subscriptions. We never sell personal information.

What we actually collect

Family account details. When a parent signs in, we collect their email address and use an email-and-password account. Supabase provides that sign-in service and holds the account record needed to authenticate the parent and tell whether the family has access. IntoWhy does not create separate accounts or profiles for children.

Optional family character. If a parent chooses a family character in Parent Hub, we store only the selected character key on the family account. The character is decorative and belongs to the account as a whole. It is not a child profile and is not connected to a child's name, identity, activity, or behaviour.

Subscription information. Lemon Squeezy processes subscription payments as merchant of record. We receive and store the limited information needed to connect a purchase to a family account and provide access, such as the parent's email address, Lemon Squeezy customer and subscription identifiers, subscription status, amount paid, and current billing-period end date. We do not receive or store full card details.

Suggest a Why submissions. If you use the "Add to the library" form, we collect the question you type, and -- only if you choose to fill them in -- an optional topic area and an optional country. Nothing else is required. These submissions are processed by Netlify Forms, a third-party form service we use to receive them (see Netlify's privacy policy). We use submissions only to review them and, sometimes, turn them into a future wonder card.

Standard hosting logs. Like any website, our hosting provider keeps basic technical logs (things like IP address and request timing) for security and reliability. We don't use these for tracking or profiling.

Contact messages. If you email us, we keep your message and email address so we can reply and follow up on the issue you raised.

Children's privacy

IntoWhy is designed so children can explore without creating an account or profile and without being asked for their name, age, date of birth, school, email address, location, photograph, or other personal information. A parent or other adult owns and manages the family account.

We do not use children's activity to build profiles, personalise advertising, or track them across websites. Basic hosting logs may record technical information such as an IP address for security and reliability, but we do not use those logs to identify or profile children.

The Add to the library form is intended to collect a question, not information about a child. Parents and carers should supervise submissions and avoid including names or other identifying details. If personal information is submitted accidentally, contact us and we will take reasonable steps to remove it.

Essential browser storage, cookies, and fonts

IntoWhy uses essential browser storage to keep a parent signed in, protect paid pages, remember a checkout that is still being confirmed, and support limited internal content-review settings. This includes a short-lived secure access cookie and local browser storage used by our authentication provider. These are necessary for the service to work and are not used for advertising, behavioural tracking, or profiling.

Page fonts are loaded from Google Fonts' servers, which may see a visitor's IP address as part of a standard font request -- the same way any website loading fonts, images, or scripts from another server would.

Advertising measurement on parent pages

With your permission, we use the Meta Pixel on parent-facing and marketing pages, including the homepage, Free Wonders, pricing, sign-up, and Parent Hub. It helps us understand whether an IntoWhy advertisement led to a page visit, family-account registration, or subscription purchase. The Pixel may allow Meta to receive browser and device information, IP address, page URL, cookie identifiers, and the event that occurred. For a purchase event, we send the order value and AUD currency. We do not send a parent's email address to Meta for matching.

The Meta Pixel does not load in the children's Worlds or Questions areas, and we do not send children's questions, activity, avatar choice, name, age, or profile information to Meta. IntoWhy still does not create child accounts or behavioural profiles.

You can decline this measurement when asked and continue using IntoWhy. To review or change your choice on this browser, use Advertising choices. Meta processes information under its own Privacy Policy.

Where your information is processed

Some of the services we use to run IntoWhy are based overseas, which means information may be processed outside Australia. These include Netlify (hosting and forms, United States), Google Fonts (fonts, United States), Zoho Mail (email, India), Supabase (family-account authentication and account records), Lemon Squeezy (subscription payments), and, only when a visitor permits advertising measurement, Meta. We use reputable providers and share only the minimum needed.

How long we keep information

We keep personal information only for as long as reasonably needed to provide and secure family accounts, manage access and support, resolve disputes, and meet legal, tax, or record-keeping obligations. When information is no longer needed, we take reasonable steps to delete or de-identify it. Some information may remain for a limited time in backups or provider records, and Lemon Squeezy may retain transaction records under its own legal obligations as merchant of record.

How we protect information

We use reasonable technical and organisational safeguards appropriate to a small online service, including managed authentication, access controls, secure connections, and restricted server-side credentials. No internet service can guarantee absolute security. If a data breach occurs, we will investigate it and notify affected people and regulators where applicable law requires us to do so.

Your rights

You may ask us to tell you what personal information we hold about you, correct it, or delete it where we can. Email hello@intowhy.com and we will respond within a reasonable time. Some account or transaction information may need to be retained where required by law or by the merchant of record.

Privacy complaints

If you have a privacy concern, email hello@intowhy.com with enough detail for us to investigate. We will acknowledge and respond within a reasonable time. If Australian privacy law applies and you are not satisfied with our response, you may have the right to contact the Office of the Australian Information Commissioner or another relevant regulator.

Changes to this policy

If this policy changes in a meaningful way, we'll update the date at the top of this page.

Contact

Questions about this policy: hello@intowhy.com. This policy is governed by the laws of Australia.