Privacy policy
Version 2026-10-19.2
COASTALCODING LIMITED (trading as Coastal Coding), company number 14771208, 36 Woodlea Road, Worthing, England, BN13 1BN, runs Miraventura and is responsible for your data. Contact: hello@miraventura.com.
What we keep, why and for how long
- Account: your name, email address and hashed password; if you sign in with Google or Apple, your identifier, name and email address there, and from Apple an encrypted token used to end that link when you delete your account. Needed for an account (contract). Kept until you delete your account; an account that has never agreed to any version of the terms is deleted 7 days after it is first asked to, unless it is an administrator's or suspended.
- Agreement: that you are 18 or over and agreed to the terms, which version and when. Contract. Until you delete your account.
- Sign-ins: when each started, your IP address and browser description; for the game, when it started and was last used. Contract and security (legitimate interests). Until you sign out, or after 7 days unused (the game's: 90 days).
- Security: your authenticator's secret, encrypted; sign-in attempts and their IP addresses, for up to a day. At sign-up and password reset, Cloudflare Turnstile sees your IP address and browser details, and Have I Been Pwned gets the first five characters of your password's SHA-1 hash. Security (legitimate interests).
- Email: a hashed copy of your address with each email we send, for 30 days, or for good if you report one as spam, so that we stop writing. Legitimate interests.
- AI use: daily counts of your AI checks, mini-game AI requests and spoken answers turned into text, for 30 days; any AI switch or allowance an administrator sets, until you delete your account. To apply allowances (contract).
- Administrators' actions on accounts (suspending, restoring, signing out, deleting, changing AI or role, signing in as you to help) and invitations: who, when and why, for 12 months; an invitation itself until it is withdrawn or that address's account is deleted. Legitimate interests (accountability).
- Progress: saved games, kept words, mistakes, finished stories and stamps, and mini-games, stored with your account so that it follows you; saved games and mistakes contain what you typed. Contract; looked at in aggregate to improve the stories (legitimate interests). Until you delete your account; when two devices played on in the same story, the copy not kept is kept for 30 days. Progress already in a browser joins the first account signed in there. Each browser keeps its own copy until its site data is cleared.
- AI checking: while “Check my answers with AI” is on, a typed answer the game cannot mark is sent with its task to OpenAI. A record of each check is kept for 12 months without your account, then deleted; while “Keep my answers to improve marking” is on, with your answer as typed, personal details included, which OpenAI's and Anthropic's models may check again when we test the marking. Checking: contract. Keeping: improving the marking (legitimate interests).
- Spoken answers: in a story or its quizzes, while “Transcribe spoken answers with OpenAI” and “Check my answers with AI” are on, your recording is sent to OpenAI to be turned into text. Otherwise, and always in the mini-games, your browser's own speech recognition is used, whatever the AI settings say, and may send the sound to the browser's maker, such as Google. Contract.
- Kept spoken answers: while “Keep my spoken answers to improve recognition” is also on, the recording, its text, the story and task, the language, whether it worked, the time, its length and your browser type. No account, device identifier or IP address is added, but what you say stays in it. To test and improve speech recognition (legitimate interests). Kept for 12 months, then deleted. The setting belongs to each browser.
- Mini-games: while “Check my answers with AI” is on, what you type, or the text your browser heard, drafts included, is sent to Cloudflare Workers AI to judge it, personal details included. Not kept. Contract.
- Usage statistics: anonymous counts, with no account, device or visit named, for 3 months; switch them off in the game's settings on each device. When you sign up, a box asks whether to share anonymous usage statistics. If you untick it, we keep that with your account, and statistics are switched off on each device where you sign in and have not chosen yourself. Cloudflare Web Analytics also counts visits and page speed, keeping each visit's data for 7 days, then a sample of about one in ten for a time it does not state. Legitimate interests.
- Feedback: what you write or choose, where you were, and play and device details (time played, accuracy, phone or computer, the game's version); for “Marking seems wrong”, the answer, task, verdict and any AI check's reference; a random code your browser keeps for all its feedback; and a daily-changing hash of your IP address. Kept for 12 months without your account, then deleted. Legitimate interests.
- Recovery copies: deleted data can stay for up to 30 days in the databases' history and in copies of them on our own computer; recordings are in neither. Legitimate interests (recovering from failures).
- Cookies only keep you signed in and remember how you last signed in. The game keeps your progress and settings in your browser.
Who receives it
Cloudflare (hosting, database, email, Turnstile, Workers AI, Web Analytics); OpenAI (checking typed answers, transcribing spoken answers, re-checking kept answers); Anthropic (re-checking kept answers); speech-recognition services we test kept spoken answers with; Google or Apple, if you sign in with them; Have I Been Pwned; and your browser's maker, when its speech recognition is used. Some of them handle data outside the UK, including in the United States, under the transfer safeguards in their data processing terms. We do not sell your data or show advertising.
Automated decisions
The game marks answers automatically, sometimes with AI. This has no legal or similarly significant effect on you.
Deleting your account
Delete it from its Account page: everything stored with it goes, and if you used Apple, we ask Apple to end that link. Kept typed and spoken answers, feedback and usage statistics are not tied to your account and stay for their periods; so do administrators' records and recovery copies.
Your rights
You can ask for a copy of your data, to have it corrected or deleted, to restrict its use, or to receive it in a portable form: write to hello@miraventura.com. You can complain to the Information Commissioner's Office (ico.org.uk).
You can object to any use based on legitimate interests. To stop us keeping your spoken answers, switch the setting off on each device. Nothing ties a kept answer to you, so we cannot pick yours out: write to us with the days you spoke answers, and we delete every spoken answer kept on those days, other people's included. Kept typed answers cannot be found to be deleted.
Changes
A changed policy has a new version number. If a change matters to you, we will ask you to read it.