Privacy policy

We care a lot about privacy, especially children's privacy. This policy explains, in plain words, what we collect on jaskirat.se, why, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The data controller is Cloudblocks AB, Lindekullegatan 41B. Contact us about anything to do with privacy at info@cloudblocks.se.

2. What we collect

About the parent (the account holder)

• Name and email address.
• Password, stored only as a secure one-way hash (we can never read it).
• When you accepted our terms and privacy policy, and which version.
• Whether and when you confirmed your email address.

About the kids you add

• A first name or nickname, an avatar, a favourite colour and a school grade.
• Learning activity: which challenges, games and printables were used, the score, the stars earned, the time spent and the date.
• Whether you have switched on a share link for that child.

Technical data

• Your IP address, browser type and the pages requested, in our server logs, to keep the service secure and working.
• A session that keeps you logged in (see our cookie policy).

What we never collect

We do not ask for children's email addresses, surnames, birth dates, photos, voice recordings or location. Drawings made in the drawing studio and pictures coloured on screen stay on your device unless you save or print them yourself. We do not use your data for profiling, automated decisions or marketing.

3. Why we use it (legal basis)

Purpose	Legal basis (GDPR Art. 6)
Creating and running your account, saving kids' progress, showing stars and badges	Contract (6.1.b): needed to provide the service you signed up for
Emails: confirming your address, welcome, password reset, security notices	Contract (6.1.b)
Share links for grandparents and family	Consent (6.1.a): only when you switch it on, and you can switch it off at any time
Security, preventing abuse, fixing errors (logs, rate limits)	Legitimate interest (6.1.f) in a safe, working service
Keeping records we are required to keep by law	Legal obligation (6.1.c)

4. Children's data

jaskirat.se is made for children but is always set up by a parent or legal guardian who is at least 18 years old. The parent decides which children to add and what name to use, and can edit or delete a child's profile at any time. We collect as little as possible about children, never show them ads and never contact them directly. In line with GDPR Article 8, accounts can only be created by adults.

5. Who we share data with

We never sell or rent your data. We only use a few trusted service providers (data processors) who work on our behalf under data processing agreements:

• Web hosting: stores the website and database. We host within the EU/EEA.
• Resend (email delivery): receives your name and email address to send account emails.
• ElevenLabs (read-aloud voices): receives only the word or sentence to be read aloud, for example "ett äpple". No names, accounts or other personal data are sent, and each clip is saved on our server so it is only created once.

Some providers are based in the USA. When data is transferred outside the EU/EEA, it is protected by the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses (GDPR Chapter V).

All fonts and files are served from our own server, so visiting the site does not send your IP address to Google or other font or content networks.

6. How long we keep data

• Your account and kids' profiles: until you delete them. Deleting your account removes all kids and all their activity immediately.
• Accounts that never confirm their email: deleted automatically after 30 days.
• Server logs: 14 days.
• Password reset links: expire after 60 minutes.
• Sessions: end when you log out or after a period of inactivity.
• Backups: overwritten within 30 days, so deleted data also disappears from backups.

7. Your rights

Under the GDPR you have the right to:

• Access your data and take it with you (Art. 15 and 20): download everything as a file on your account page.
• Correct it (Art. 16): edit names and settings in the parent area.
• Delete it (Art. 17): delete your account yourself on the account page.
• Restrict or object to processing (Art. 18 and 21).
• Withdraw consent at any time, for example by switching off a share link.

For anything else, email info@cloudblocks.se. We answer within one month.

If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), or the data protection authority in your country.

8. How we protect data

• Encrypted connections (HTTPS) and secure, encrypted session cookies.
• Passwords stored as strong one-way hashes.
• Limits on login and password-reset attempts to stop guessing.
• Parents can only ever see their own children. Share links are random, private and off by default.

9. Changes to this policy

If we change this policy in an important way, we will tell you on the site and by email, and ask you to accept the new version. The current version is dated 23 September 2026.