Privacy Policy

1. Who we are

Online Zoo Builder is made by Drennan Software ("we" or "us"). This policy covers the onlinezoobuilder.com website, the game you play there (in a browser or installed as a web app), the Online Zoo Builder apps for iPhone, iPad and Android, and copies of the game we make for our partners' websites. It explains what information we collect, why, and what you can do about it.

2. What we collect

When you play without an account

Guests (including everyone playing in the mobile app) play without giving us any personal information. Your zoos are saved on your own device, in your browser's storage or the app's storage, and we don't get a copy. The game does talk to our server to get the current season or event, to download game updates in the app, and to send anonymous game activity. If you tap the screenshot button and share a screenshot, the picture is saved on our server so its link works.

When you make an account

An account lets you save zoos online and play them on any device. We collect:

• Your email address (13 and over), to log in, verify your account, reset your password and send the emails described below. Under 13, we ask for a parent's email instead and never ask for the child's own (see Children under 13).
• A nickname (up to 12 letters), shown to other players (never for players under 13).
• A password, which we store only in scrambled (hashed) form.
• An avatar you pick from our cartoon animals. You can't upload photos.
• Your birth month and year, only to know whether you are under 13. We don't ask for the day.
• Your zoos and progress: what you build, your money, experience, Zoo Tokens, badges, daily gift streak, event collectibles, adopted animals, and a small picture of each zoo for the Explore page.
• Your time zone (like "America/New_York"), which the game sends with your saves so streak reminders arrive in the daytime where you live (not kept for players under 13).
• Account details: when you joined and last logged in, your email settings, whether your email is verified and, for teachers, the reason you gave when asking for educator access.

When you use the website

Like most websites, our server receives your IP address and basic information about your browser and device with each visit. While you're logged in, your login session is kept in our database with your IP address and browser type, so we can keep you logged in and stop others from using your account. We also use IP addresses for a short time to slow down repeated wrong passwords. The tools from other companies on the website collect information of their own.

3. How we use it

• To run the game and the website: save and load your zoos, keep you logged in and give you what you buy.
• To send the emails described in Emails.
• To help teachers follow their class (see Schools).
• To keep players safe and the game fair: stopping spam sign-ups, cheating and rule breaking, and hiding nicknames, zoos or screenshots that break our rules.
• To fix bugs and make the game better, using anonymous game activity and counts across all zoos.
• To keep records the law asks for, like sales records.

4. Children under 13 and parents

Online Zoo Builder is made for players of all ages. Some of our players are under 13, and for them we follow the U.S. Children's Online Privacy Protection Act (COPPA). Anyone can play the whole game as a guest without telling us anything about themselves.

Everything below is about players who tell us they are under 13. Create Account asks every player for their birth month and year first.

A parent says yes first

We ask a parent for permission before a child under 13 gets an account (COPPA's "email plus" method):

1. The child gives us only a parent's email address. We keep that email, the birth month and year, and a secret link, and nothing else. There is no account yet; the child can keep playing as a guest, with zoos saved only on their device.
2. We email the parent a notice: who we are, what we would collect and why, that we share nothing, and how to say yes or no. The link works for 7 days. Opening it doesn't approve anything; the parent ticks a box and presses a button to agree.
3. If the parent agrees, we show them (and email them) a 6-letter code. The child types the code, then picks a nickname, password and cartoon avatar, and the account works right away. The code works for 30 days.
4. 24 hours after the parent agrees, we send a second email that repeats the notice and explains how to change their mind and delete the account.
5. If the parent says no, we delete their email and the request right away. If nobody answers in 7 days, or the code isn't used in 30 days, we delete them then.

Accounts made before we asked everyone's age, whose player turns out to be under 13, are paused (no logging in or saving online) until a parent agrees the same way. Nothing in them is deleted while they wait. We remove the child's own email address from those accounts.

What a child's account keeps

The nickname, password (stored scrambled), avatar, birth month and year, the parent's email, saved zoos (including names the child gives adopted animals), screenshots the child chooses to upload, event badges and progress, and records of anything a parent buys. We don't keep a child's time zone. We never ask a child for their own email address.

What we don't do with it

• Nothing is public. Other players see "Young Zookeeper" instead of the nickname on Explore, profiles, screenshots and the home page, and never see the names of the child's adopted animals. A child's screenshots are never featured on the home page, and their profile pages ask search engines not to list them. There is no chat or messaging.
• We don't sell or share it with anyone, except companies that run parts of the service for us (see Who we share it with).
• No outside trackers, and only one kind of ad. While a child is logged in, and in a browser that told us it's under 13 or asked a parent for permission, the website loads no Google Analytics, ShareThis or reCAPTCHA. It may show Google AdSense ads at the top and bottom of the page, which we mark for Google's child treatment so it is contextual (based on the page, not on the child) and not personalized. See Ads.
• No marketing emails. Account emails, like receipts, go to the parent. Children never get zoo news or streak reminders.

The game's anonymous activity counts also run for children. They use a random number made by the game, are never linked to a name, email or account, are never used for ads, and only help us keep the game working and improve it.

A few things still reach other companies when a child uses the site, because the pages need them: Google Fonts and the jQuery script library (which see the visitor's IP address), YouTube videos on the Media page (in YouTube's privacy-enhanced mode), Stripe or PayPal when a parent pays, and Google AdSense for the child-tagged ads.

When a child turns 13

The account stays private until the player turns 13 and goes through a short "You're 13 now" page on the website. There they can add their own email address if they want; zoo news and streak reminders start switched off. From then on the parent can't manage the account or reset its password: password resets use the player's own email, which they can add then or later with "Add my email" on their account page. Until they add one, receipts still go to the parent, and a forgotten password means writing to us. After that it's a regular account: the nickname can be shown to other players and the website can show ads. We email the parent when this happens, and if the player added their own email, we stop keeping the parent's.

Parents, you can always

• Review what we keep about your child: the parent page linked from our emails shows it. The link works for 7 days; for a new one, use "Forgot your password?" on the log in page with your email.
• Correct it: change the nickname, remove the names of adopted animals, or set a new password.
• Withdraw your permission and delete the account, its zoos, screenshots, badges and logins, on the parent page or by writing to us. We stop collecting anything from your child at once. Records of purchases stay for our accounts, without anything that names your child.
• Ask us anything at support@drennansoftware.com, from the email address you gave us. If you think your child made an account with their own email or without telling you, write to us and we'll take care of it.

5. Schools and class codes

Teachers ask for educator access with a normal account and then make class codes. Students join with the class link or code. Students don't need an account or an email, and class pages have no store and no ads.

The first time a student plays with a class code, the game asks for a first name or nickname. Their teacher sees:

• the first name or nickname they typed,
• how their class zoo is doing: level, number of animals and kinds of animals, guests, and quiz answers right,
• when they last played.

The class zoo itself stays in the student's browser. The game makes a random number for each browser so a student shows up once on the teacher's list. Teachers can remove a student or delete a class code at any time, and that deletes the student's class information from our server. We use class information only to show it to the teacher and class, never for ads.

6. Game activity

To keep the game working and make it better, the game counts how it is played: for example which animals and buildings are bought, which windows and minigames are used, how far players get through the tutorial, how long a visit lasts, and which errors happen. The game makes a random number for your device to tell visits apart. It is not your account, name, email, class code, advertising ID or device ID, it is never linked to any of them, and we never record your IP address with it or anything you type.

We keep activity linked to that random number for 30 days and then delete it. After that, only totals that can't identify anyone are kept (like how many zebras were bought on a day). We use it only to maintain and improve the game, never for advertising, and never share or sell it. You can delete it any time with "Reset Play Data" in the game's Sound window, which also gives your device a new random number. If your browser sends a Global Privacy Control signal, the game doesn't send any activity.

We also count things across all saved online zoos every night (like how many zoos have a lion), as totals only.

7. Emails

We send email through SendGrid, a company that delivers email for us. We send:

• Account emails, which can't be turned off because they're about something you did: verify your email, reset your password, receipts and adoption thank-yous, and gifts from us. For players under 13 these go to the parent.
• Parent emails for a child under 13: the request for permission, the code once a parent agrees, and a confirmation 24 hours later (see Children under 13).
• Zoo news (when a new event starts, or an announcement) and streak reminders (a few hours before your daily gift streak ends), only to players 13 and over with a verified email. They're on when you sign up, and the sign-up page shows them so you can turn them off first. We send at most two of these a week, and every one has a link to turn it off (and works with your email app's unsubscribe button). You can also change them on your account page.

We keep a short record of which emails we sent and when, so we don't send too many.

8. Purchases and adoptions

On the website, you need to be logged in to buy Zoo Tokens, Zoo Club VIP or an animal adoption. Payments are handled by Stripe or PayPal. You type your card or PayPal details on their forms, and we never see or keep your full card number. We keep what was bought, the price, which payment service was used and its reference number, so we can give you the item, help with problems and keep our sales records. 10% of every sale and half of every adoption goes to the Wildlife Conservation Society; we tell them only totals, never who bought.

In the mobile apps, purchases go through the App Store or Google Play, and Apple or Google handle the payment. They tell our server when a sale or refund happens so we can count sales, but not who bought it.

9. Ads

• Website: pages may show ads from Google AdSense. Google may use cookies to choose ads, including ads based on your interests. There are no ads on class pages or for Zoo Club VIP members. For players we know are under 13, the website shows only fixed ad units, tagged with Google's "tag for age treatment" set to child: Google says this turns off personalized ads, remarketing and requests to other ad companies, and limits the kinds of ads shown. The page doesn't use Google's automatic ad placement for them. You can turn off personalized ads in Google's ad settings.
• Mobile apps: the free apps can show full-screen ads from Google AdMob between games. On iPhone and iPad, ads aren't personalized unless you allow tracking when the app asks. On Android, Google may use the device's advertising ID to choose ads unless you turn that off in your phone's settings.
• In the game: the sponsor window and billboards show our own ads and partners' pictures. They don't collect anything.

10. Cookies and storage on your device

Our own:

• Login cookies that keep you logged in and protect forms. They end when you log out or after a while without using the site.
• An age cookie for one day, when Create Account learns the player is under 13, so going back and picking an older year doesn't skip the parent step, and a permission cookie for 30 days in a browser that asked a parent for permission. While either is there, the browser gets no outside trackers, and only the child-tagged ad described in Ads.
• Browser storage (not sent to us): your zoos when you play as a guest or with a class code, your sound and game settings, waiting game activity counts, whether you closed the "get the app" banner and, if you're logged in, a copy of your account's zoo list so My Zoos still shows while you're offline.
• The installed web app keeps the game's files on your device so it starts fast and works offline. It doesn't collect anything extra.

Other companies' tools on the website, which collect information under their own privacy policies:

• Google Analytics (visits and store checkouts, to see how the website is used).
• Google AdSense (ads, see Ads).
• ShareThis (share buttons).
• Google reCAPTCHA on Create Account, to stop robots from making accounts (not on a child's form; the parent's code stands in for it).
• Stripe and PayPal on the store page.
• YouTube videos on the Screenshots & Videos page (in YouTube's privacy-enhanced mode).
• Google Fonts, which loads the website's lettering, and the jQuery script library from code.jquery.com.
• Ruffle from unpkg.com, which plays the old Flash versions of the game on their own pages.

11. Who we share it with

We never sell your personal information. We share it only:

• With companies that run parts of the service for us: DreamHost (our web host), SendGrid (email), Stripe and PayPal (website payments), and Apple and Google (app stores). They may use it only to do that work for us.
• Through the website tools listed in Cookies, which collect information directly.
• With teachers, for students playing with their class code.
• If the law requires it, or to protect the safety of our players or others.
• If Online Zoo Builder is sold or joins another company, with the new owner, who must follow this policy for information we already have.

12. What other players can see

With an account, other players can see your nickname, avatar, badges, zoo stats, event collectibles and your zoos (on the Explore page and your profile), and screenshots you share. Your email, parent's email, birth date and time zone are never shown. Pick a nickname that isn't your real name. For players under 13, other players see "Young Zookeeper" instead of the nickname, and the names of adopted animals are hidden. We hide nicknames, zoos and screenshots that break our rules.

13. How long we keep it

When an account is deleted, its zoos, screenshots, badges, event progress, email records and logins are deleted with it, and so are a teacher's class codes and their students' class information. Purchase records stay for our sales records, without anything that names the player.

14. Keeping it safe

The website uses HTTPS, passwords are stored hashed, payment details stay with Stripe, PayPal, Apple and Google, and only our administrators can see account information. No system is perfectly safe, so please use a password you don't use anywhere else. If something ever goes wrong, we will tell the people affected as the law requires.

15. Your choices

• Play as a guest or with a class code: no account, no email.
• Emails: turn zoo news and streak reminders off on your account page or with the link in any of those emails.
• Delete your account and all of its zoos yourself on your account page, or ask us.
• See or fix your information: your account page shows what you gave us. Write to us for a copy of everything, or to fix something.
• Game activity: "Reset Play Data" in the game's Sound window, or turn on Global Privacy Control in your browser.
• Ads: turn off personalized ads in Google's ad settings or your phone's settings, or become a Zoo Club VIP for no website ads.
• App reminders: the apps' reminders are made on your phone and never sent to us. Turn them off in the game's Notifications window or your phone's settings.

Depending on where you live, you may have more rights over your information, like getting a copy, correcting or deleting it. Write to us and we'll help; we won't treat you differently for asking.

16. Changes to this policy

When we change this policy, we update the date at the top. If a change affects what we collect from children under 13, we will tell parents first and, where the law requires, ask for their permission.

17. Contact us

Drennan Software
Email: support@drennansoftware.com
Mail: 219 W Myers Blvd Unit A PMB 1004, Mascotte, FL 34753, United States