PRIVACY

PLAIN LANGUAGE · LAST UPDATED 2026-09-20

The short version: we store only what a family arcade needs — a made-up callsign, game scores and progress, an avatar look, honest play-time minutes, an educator's email if one is given, and a family allowance record if a parent or legal guardian turns one on. No ads, no tracking cookies, no selling of data. Our host counts page visits without cookies (details below). Everything is deletable on request.

Family Allowance: Your family's allowance record — not an account. jesselander.com is not a bank and never holds, sends or guarantees money. You pay your child yourself. What the record stores and who can see it

WHO WE ARE

jesselander.com is a family-built collection of learning worlds and arcade games, run by Jesse Lander. Contact: jesselander@gmail.com.

WE TREAT EVERY PLAYER AS A CHILD

We design as if every player is under 13. We never ask for age, real name, address, phone number or photos. There is no free-text chat, no messaging between players, and no public profile page. The only identity a player has is an AETHER ID callsign they invent (3–20 letters, numbers, _ or -).

A few places do take typed words. Other players see only callsigns and names typed on leaderboards; everything else stays private. The places are: a name typed on a leaderboard as a guest; names given to saved runs; short notes on a family allowance record (up to 60 characters, from an educator, or from a child asking to spend); and what a player types to the AI characters in The Vault Warden and Undertype (see Anthropic below). Please don't type real names, addresses or phone numbers into any of them. New Orbit Points awards use preset notes. Earlier award notes remain in saved history and can be imported after a grown-up reviews them.

Accounts for children. Signing up asks for an email address and a password. A parent or legal guardian should set up a child's account using their own email. The sign-up form doesn't check whose email it is yet. If a child signed up with their own address, a parent or legal guardian can change it at /profile/, or write to us and we'll change it or delete the account.

PLAYING WITHOUT AN ACCOUNT

You never need an account. As a guest, progress lives in your own browser's local storage on that device. There are two exceptions. Guest scores you submit to a leaderboard show the name you type on that board and nothing else. And Neon Swarm backs up a guest's runs to this site under a random save code (like NS-7K2M9QX4PD), so a long run survives a crash and can carry on from any device that knows the code. That backup holds the runs and the names you give your saves, nothing else. If you later sign in while playing Neon Swarm, your account adopts the code so no saves are lost.

WHAT AN ACCOUNT STORES, AND WHY

An AETHER ID is optional. If a family creates one, we store:

A callsign you choose — the one name shown everywhere on the site.
An email address and a password — the email is how you sign in and how we reach you (please use a parent's or legal guardian's, see above); the password is kept only as a salted hash, never in readable form.
Game progress and saves — the small text records each game keeps in your browser (up to about 20 KB in all) are mirrored to your account (a per-app save mirror keyed to the account) so progress follows your sign-in to another device. On a new device we restore what is missing and never overwrite what is there. No photos or media files are mirrored, and neither are keys: an Anthropic API key a player pastes into The Vault Warden or Undertype stays on that device and is never uploaded. Copies saved before 14 September 2026 may still hold one until that account next signs in on the device that made it, and we are removing any that remain.
🪐 Orbit Points — fun points with no cash value. Your account keeps recorded awards, approved practice, balances, lifetime totals, rank and history, along with device-reported practice awaiting grown-up approval. Practice needs approval before it becomes recorded points. Earlier device history stays local until a grown-up reviews and imports it; any earlier account history is preserved. Grown-up actions use an existing signed console link; there is no device PIN. Account deletion removes Orbit Points records; local copies stay in the browser.
Scores and an avatar look — leaderboards are public and show a callsign, an avatar built from our own parts, and a score. Nothing else.
Play time — apps count active minutes only: the page must be visible and the player must have tapped, typed, scrolled or been listening to narration or video within the last two minutes. Idle time and parked tabs count nothing. Apps also keep a small daily progress count. Educators see learning-vs-play time in the Educator Console and on Mission Control; the site keeps the most recent 40 days of daily totals.
Up to two educator email addresses (optional) — the first can be typed on Mission Control while none is on file (with a short window to fix a typo); after that only an educator can change them, from the Educator Console. They are used only to send progress reports, Game Fuel emails (learning time earns game time; the settings an educator picks are kept with the account) and family allowance emails, and the private links inside them. Emails go out through our email provider, Resend; jesselander.com doesn't keep a copy of a message after sending it.
A family allowance record — only if a parent or legal guardian turns it on. Described in full below.

COOKIES

The aeid cookie keeps your AETHER ID signed in. It holds a random token (not a name or email), is HttpOnly and Secure, and expires after 30 days or when you sign out. The new Parent Console uses a separate ag cookie: a random sign-in token, also HttpOnly and Secure, lasting up to 30 days. Signing out or switching off its links ends that access. There are no advertising, analytics or tracking cookies of any kind.

WHERE IT LIVES

On your device — each game's saves, the play-time meter, Orbit Points practice and earlier device history live in your browser's local storage. Practice tied to an account can sync for grown-up review; guest practice is not automatically attached to an account. Earlier device history is only imported after a grown-up reviews it.
On this site's own storage — account records, save mirrors, Orbit Points records and practice awaiting approval, scores, avatar looks, play-time totals, educator emails, family allowance records and Neon Swarm cloud saves are held in this site's own storage on Cloudflare, the company that hosts jesselander.com. The other companies involved are listed below.
Short-lived housekeeping — Cloudflare keeps standard request logs for security and reliability, and the site keeps tiny counters keyed to your network address or account (to slow down password guessing and email floods) that expire within 48 hours, plus a site-wide count of emails sent each day and month, not tied to anyone, kept for up to 32 days. When a button from one of our emails is used, the site also keeps a marker made from that link (not a name or email address) so the link can't act twice. The marker expires an hour after the link itself would have: about 2 days for game-time buttons, 7 days for Game Fuel switch-on links, 14 days for allowance request links, and at most 90 days for older links that carry no expiry date.
Diagnostics — the /diag/ page exists to chase a bug on one device, usually when we've asked someone to open it. A few seconds after it opens, it sends us technical details: browser and version, language, screen and window size, graphics chip, memory and processor count, motion and data-saver settings, and any page errors. Our host adds an approximate country and city from the network address. These reports aren't linked to an account and are deleted after 14 days.

OTHER COMPANIES INVOLVED

Cloudflare hosts the site and its storage. Every page also runs Cloudflare Web Analytics — Cloudflare's privacy-first page analytics, with no cookies and no cross-site tracking. It counts page visits, where they came from and how fast pages appear. One older game version (Neon Orbs Classic) also fetches a physics library from Cloudflare's public code library, cdnjs.
Resend delivers our emails (progress reports, Game Fuel and family allowance emails) to the educator addresses on file.
Google Fonts supplies the web fonts, so your browser asks Google for them.
Anthropic — only in The Vault Warden and Undertype, and only if a player pastes in their own Anthropic API key. The game then sends what the player types and details of their play straight from the browser to Anthropic, under Anthropic's own terms; none of it passes through our servers. The key is kept in the browser, and for a signed-in player it can also travel in the account's save mirror (see above).

WHAT WE DON'T DO

No advertising, ad networks or ad SDKs.
No tag managers, tracking pixels or analytics beyond Cloudflare's cookie-free page counts described above.
No selling or renting of player data, and no sharing beyond the companies named above, which handle it only to run the site.
No voice recording — jesselander.com never records or stores anyone's voice, and narration is pre-rendered audio we play to you. When a reading mode listens to a child reading aloud (Story Galaxy's “I'll read it!”), it uses the speech recognition built into the web browser, and the browser maker's speech service (for example Google in Chrome, Apple in Safari, Microsoft in Edge) may process that audio to turn it into words. Families who'd rather avoid that can use “Read to me”, which doesn't use the microphone. The music visualizer can also listen to a microphone to draw; that sound stays on your device.
No cross-site tracking.

IN-GAME CREDITS

◆ LUMEN and ⚡ FLUX are game credits earned by playing, and 🪐 Orbit Points are points. None of them has cash value, none can become allowance, and allowance can't buy them. jesselander.com has no real-money purchases.

FAMILY ALLOWANCE RECORD

Your family's allowance record — not an account. jesselander.com is not a bank and never holds, sends or guarantees money. You pay your child yourself.

What we store, only if a parent or legal guardian turns it on: the rules they pick (a rate, a daily limit, minutes for a full day); each finished day's amount; the amounts an educator records as spent, with a short note; the amounts an educator adds, with a reason (such as a chore or a birthday) and a short note; the child's requests to spend (an amount, a short note the child typed, and whether an educator said yes or no); and up to two educator email addresses. Daily learning minutes (already described above) are used to work out each day's amount. If we pause educator links on a record for safety, we also keep a note of why and when.
Passkeys, only if an educator adds one: the passkey's public key, a device label (like "iPhone · Safari"), and when it was added and last used. The private key, and the Face ID, fingerprint or passcode that unlocks it, never leave the educator's device — we never see them. Every educator on the account is emailed when a passkey is added.
What we never collect: bank, card or payment details. No money passes through the site.
Who can see it: anyone holding an educator's console link from our emails or signed in with a passkey an educator added, and the signed-in child (their own amount, their learning time, how many requests are waiting, and a masked hint of each educator address, like d•••@outlook.com). Never public, never on leaderboards, never sold or shared.
Where it lives: this site's own storage on Cloudflare. Emails are delivered by our email provider, Resend.
How long: kept until a parent or legal guardian asks us to delete it. A copy of the record taken during a repair on 14 September 2026 is kept with it, so nothing can be lost, and is erased with it. Daily learning minutes are kept for 40 days. Console links last 90 days; request links 14 days; a passkey sign-in lasts 12 hours. Passkeys are kept until an educator removes them in the console, and "Revoke every console link and passkey" switches them all off. Account deletion now also starts erasing the allowance record and its earlier copies. Cleanup runs in steps. Keep the deletion page open; if interrupted, return to your profile in the same browser and choose Continue deletion. If you cannot finish there, email jesselander@gmail.com for help.

New Parent Console records

If your family uses the new Parent Console, children ask with an amount and a preset category; they cannot type request notes. Parents can add notes of up to 60 characters. The child sees their own allowance and learning plan, but no educator email address. Confirmed parents can manage the family record. A classroom teacher does not receive allowance access through a classroom invitation.

Data	How long it stays
Unconfirmed educator address	14 days.
An address from the earlier tracker awaiting confirmation	30 days from the first successful confirmation email or first console visit. An address set aside for a safety check receives no email and is removed after 30 days.
An address that asked not to be contacted	The address is removed. A scrambled, hashed form blocks further invitations for one year.
Private email links	Console links: 30 days. Request and bonus links: 7 days. Confirmation links: 14 days. Stop-email links: 12 months. Switching off links ends their access sooner.
Parent Console sign-in	The ag cookie lasts up to 30 days. Signing out or switching off links ends access.
Per-device learning counts	60 days. Each finished day's total remains with the allowance record.
Allowance rules, entries, requests, answers and seen-letter markers	Until the record is erased. Erasing only allowance history keeps the account and Learning Plans; deleting the account erases those plans too.
Earlier-tracker copies and unresolved rebuild checks	Kept with the record and erased with it, including the copy made during the 14 September 2026 repair.
Short anti-abuse counters	Scrambled email and network-address counters expire within 25 hours. Site-wide email totals, which do not identify a person, can remain for up to 32 days.
Who-did-what log	24 months; email addresses are stored only in hashed form.
Deletion recovery and stop markers	While cleanup is unfinished, the recovery job remains so it can be retried. After completion, minimal allowance stop markers remain for 60 days; account stop markers and hashes of revoked sign-in tokens remain for 90 days. They prevent an old device from restoring erased data and do not keep the erased money history.

Stop these emails: use the stop-email link in a report, or the report and weekly-summary controls in Privacy & data in the Parent Console. Request answers, security messages and access notices are separate from those optional reports. To remove your access completely, use Educators & security.

HOW LONG WE KEEP THINGS

Account data, saves, Orbit Points records, scores, avatar looks, play-time totals (the most recent 40 days) and Neon Swarm cloud saves are kept until you ask us to delete them, so progress isn't lost; deleting the account yourself removes some of them at once (see below). The family allowance record follows its own rules above. Diagnostics reports are deleted after 14 days. Sign-in tokens expire on their own after 30 days.

DELETING YOUR DATA

Two ways:

Yourself — sign in at /profile/ and use the delete option. It revokes the account’s sign-ins and erases the account, email, password, callsign, save mirror, Orbit Points records, allowance history, Learning Plans and private AI mentor records in steps. Other children’s records in a shared family stay intact. Keep the page open until it finishes; return to your profile in the same browser to continue an interrupted deletion. Leaderboard rows, the avatar look and Neon Swarm cloud saves still need an email request. Minimal deletion markers remain for the periods listed above.
By email — a parent or legal guardian can write to jesselander@gmail.com from the email address on file (or quoting the callsign) and we will delete the account, its saves, scores, play-time, allowance record, Neon Swarm cloud saves and any stored email.

Account deletion does not clear earlier Orbit Points history or practice kept in your browser. Clearing your browser's site data removes the local copies on that device at any time.

CHANGES

If this page changes in a way that matters, the date above changes and the home page will say so.