Children's privacy

No child accounts. No child data.

Flyrail is used in kids' ministry, youth groups and classrooms, which means children are in the room. They are not users of this service and we have built it so that they cannot be.

• A player never signs up. There is no registration, no email field and no password for a player. A phone joins a game by scanning the code on the screen.
• A player is not an identity. A device is a player for the length of one game. When the game ends it is nothing, and the next game does not know it was ever here.
• No contact details are collected. Not an email, not a phone number, not a surname.
• Accounts are for adults. Only a leader, teacher or volunteer has an account — they must be 18 or over — and that account is what the organization bills to.

What about the name a child types?

Games show nicknames so a room can tell teams apart. That nickname lives for the length of the game, in the session on the Mac in the room, and is not part of any account. A leader can change or remove one at any point, and a name goes through the same word filter as every other piece of text before it reaches a screen.

Tell children to use first names or nicknames, not full names. The product does not ask for more than that and never will.

What a leader keeps afterwards

Scores for a game, so you can show the winner. They belong to the session, not to a child, and they are not joined to anything identifying. Nothing follows a child from one week to the next.

Why text is filtered before it is shown

A room of children can type anything, and a projector is an unforgiving place for it to appear. So every text answer and every player name is checked against a word list first, anything the check is unsure of is held for an adult to approve, and a host can clear the screen or remove a player instantly. If the filter cannot run at all, text is held rather than shown — the safe failure, not the fast one.

COPPA, GDPR-K and schools

Because we hold no personal information from a child, there is nothing for a parent to consent to and nothing for us to disclose or delete on request. A school does not need a data-processing agreement covering pupil data, because no pupil data reaches us. If your diocese, district or trust needs that in writing for a procurement form, ask us and we will put it on letterhead.

If you think we have child data

Tell us and we will look and delete it. We would treat it as a defect in the product, not as a support request — if any ever reaches us, something is wrong with the design and not just with one record.