Updated November 8, 2026
Privacy policy
This English text is a courtesy translation. If there is any difference between versions, the Portuguese version is the official one.
This policy explains what personal data NomiPlay processes, why, for how long and what your rights are, under Brazil's General Data Protection Law (LGPD, Law 13.709/2018), Brazil's Internet Civil Framework (Law 12.965/2014) and Brazil's Child and Adolescent Statute (Law 8.069/1990). We pay special attention to children, as Article 14 of the LGPD requires. Sections 12 and 13 explain how we apply the rules for children in the United States and India.
1. Who is responsible (controller)
The party responsible for processing the data (controller) is Andrey Luiz Cardoso Garcez, CPF 517.916.252-15, Rua Padre João Manuel, 173, São Paulo - SP, CEP 01411-001. Contact for privacy matters, including exercising your rights: andgarmed@gmail.com.
2. Our principle: as little data as possible
The games work without an account, without registration and without ads. An account is only requested to make a purchase, and it always belongs to the responsible adult (never the child). We do not ask for children's full names, addresses, schools, phone numbers or locations, we do not receive photos (on the English site, gift links with photos are not offered), we do not use tracking cookies and we do not do targeted advertising. The visitor number shown in the footer is only a count: each browser adds one visit per day, without recording who visited.
3. Data processed, purposes and legal bases
| Data | Where it is kept | What it is for | Legal basis (LGPD) |
|---|---|---|---|
| Account of the responsible adult (over 18): full name, date of birth, email, phone number and password (stored only in encrypted form that no one can read) | At the hosting provider, in private storage | Identify who is buying, confirm they are an adult, keep purchases and gifts so they can be reopened on any device, and provide support | Performance of a contract (Art. 7, V) |
| Purchased gifts: player names, message and game theme (no photos) | At the hosting provider, linked to the purchaser's account | Allow the gift link to be reopened, edited and resent whenever desired | Performance of a contract (Art. 7, V), at the request of the responsible adult (Art. 14, §1) |
| Nicknames, age group, progress, usage time, settings, saved games and a digest of the parents' PIN | On the device only (the browser's local storage) | Make the games work and allow parental control | Not sent to servers; where children are involved, use depends on the responsible adult's choice (Art. 14, §1) |
| Player photo (optional, chosen by the responsible adult in some games) | On the device, already reduced in size (the browser's local storage), or, if the family chooses, inside the game's private link, after the “#” (the part of the address the browser does not send to the server). When a family requests a short gift link, the photo and names are kept at the hosting provider, accessible only through that secret link (not indexed) and deleted on request | Show the player's face on the character | Choice of the responsible adult; it can be removed in the game itself or by erasing the data in the Parents area |
| Names in the private link of a personalized game | In the link itself, after the “#” (not sent to the server) | Open the game with the chosen names | Choice of the person who creates and shares the link |
| RESPECT PLAY alerts: the type of situation chosen by the child (for example, “is being bullied in PE” or “answered that they have seen something similar happen”), the date and the time. Never what the child writes or classmates' names | Sent by email to the responsible adult of the account signed in on the device and, if they turned it on, by SMS to the registered phone. The server keeps only the date of the last notice of each type, to limit sending. With no account signed in, the type and date stay on the device for up to 7 days, until an adult signs in | Notify the family when the child asks for help or indicates they experience, practice or witness bullying, so that an adult can protect them | Best interests of the child (Art. 14, caput) and protection of their safety (Art. 7, VII and Art. 11, II, “e”), with the responsible adult's choice to keep the account on the device; SMS only with specific consent, which can be withdrawn in My account (Art. 14, §1) |
| Orders: item, amount, coupon, order code, date and status | Server (Vercel Blob) | Record and release purchases, provide support and comply with legal and tax obligations | Performance of a contract (Art. 7, V) and legal obligation (Art. 7, II) |
| Access logs (IP address, date and time) | Hosting provider | Security and operation of the site | Legal obligation (Internet Civil Framework, Art. 15) and legitimate interest (Art. 7, IX) |
4. Children and teens
- The children's games were designed to require no personal data: everything the child creates stays on the family's device.
- There is no chat, messaging between users, public ranking or advertising.
- Purchases, settings and extra play time are handled by adults, with confirmation (a PIN in the Parents area, if one is set).
- Parents and guardians can erase all data on the device at any time in the Parents area.
- In RESPECT PLAY (bullying prevention), what the child writes in the “I need help” area is not saved or sent. When the child chooses an option in that area, or answers a reflection question saying they experience, practice or witness bullying, the game shows on screen that it will notify the responsible adult and sends only the type of situation and the date (at most 1 notice of each type every 12 hours). The help area always shows official services for when the problem happens at home: on the English site, emergency numbers and child and crisis helplines for the United States and India.
5. Payments
Purchases are paid by Pix (QR code or copy and paste) or, when available, through Mercado Pago. NomiPlay does not receive or store card details or banking passwords. With Pix, as with any transfer, the recipient sees the payer's name and the order code on the statement; this information is used only to confirm payment. With Mercado Pago, the buyer's data is processed by Mercado Pago, under its own privacy policy.
6. Who data is shared with
- Vercel Inc.: site hosting and storage (servers in the United States);
- Mercado Pago: only when the buyer chooses to pay through it;
- Google (Gmail): sending the site's emails, such as password recovery and RESPECT PLAY alerts to the responsible adult;
- SMS provider (for example, Twilio or Zenvia): only when the responsible adult turns on SMS alerts and SMS sending is enabled on the site; it receives the phone number and the short alert text;
- Authorities, when there is a legal obligation or court order.
We do not sell personal data.
7. International transfer
Because hosting is in the United States, server data (orders and access logs) is transferred outside Brazil, based on the provider's contractual guarantees and Article 33 of the LGPD.
8. How long we keep data
- Data on the device: until the responsible adult erases it (Parents area or browser data);
- Account of the responsible adult: while the account exists; it is deleted on request, using the contact above (except what the law requires us to keep);
- RESPECT PLAY alerts: on the server, only the date of the last notice of each type, replaced with each sending and deleted with the account; on the device, pending notices for up to 7 days;
- Orders: for the period required by tax and consumer laws (generally 5 years);
- Access logs: at least 6 months, as required by the Internet Civil Framework.
9. Your rights
You can request confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and withdrawal of consent (Art. 18 of the LGPD) by emailing andgarmed@gmail.com. We respond within 15 days. You can also file a complaint with Brazil's National Data Protection Authority (ANPD).
10. Local storage, cache and security
We use the browser's local storage, a “service worker” that keeps game pages so they work offline, and necessary cookies (language and account session). On the English site, statistics, campaign measurement and advertising tools are turned off. Game fonts are served by NomiPlay itself. See the Cookie policy. Admin panels are password protected, communications use HTTPS and the parents' PIN is stored only as a cryptographic digest.
11. Changes
Relevant changes will be published on this page, with the new update date.
12. Children in the United States (COPPA and state laws)
NomiPlay is directed in part to children under 13. We designed the English site so that we do not collect personal information online from children.
- What stays on the device: nicknames, age range, game progress, settings, saved games and optional player photos remain in the browser's local storage. They are not sent to us. Parents can erase them at any time in the Parents area.
- What is turned off: advertising, behavioral tracking, statistics and campaign tools, chat, public profiles, public rankings, online play between devices and voice recording.
- Participation: no child has to give personal information to play.
- Hosting: to deliver pages securely, our hosting provider receives technical data such as the IP address. It is used only to run and protect the site, not to build profiles or for advertising.
- Parent accounts: only adults can create an account or buy. If a parent enters a child's first name or a message to create a gift, the parent provides that information, and it is used only to deliver the game.
- RESPECT PLAY and Mission Courage alerts: when a parent's account is signed in on the device, a notice with only the type of situation and the date can be sent to that parent. Never what the child wrote, and never names. A parent who does not want alerts can sign out of the account on the child's device.
- Parents' rights: parents can ask to review or delete information about their child, and refuse further use, by writing to andgarmed@gmail.com. If we learn that we collected personal information from a child under 13 without verifiable parental consent, we will delete it.
- Sharing: we do not sell personal information or share a child's information with advertisers or data brokers.
- Retention and security: we keep information only as long as described in section 8, delete it securely when it is no longer needed, and maintain written security and retention procedures.
- Teens and state rights: we do not sell the data of teens or use it for targeted advertising. Residents of states with privacy laws can request access, correction or deletion using the contact above.
13. Children in India (Digital Personal Data Protection Act, 2023)
Under Indian law, a child is anyone under 18.
- No tracking of children: we do not carry out tracking or behavioral monitoring of children, or targeted advertising directed at children.
- Data on the device: as in section 12, game data stays on the device, and an adult must confirm permission before a child plays.
- Parental consent: we process personal data about a child only when a parent or lawful guardian provides it or consents to it. By creating an account you confirm you are an adult and, where you enter a child's details, that you are the child's parent or lawful guardian. We may ask for further confirmation where the law requires it.
- Your rights: you can request access, correction or erasure, withdraw consent as easily as you gave it, and nominate another person to exercise your rights.
- Grievances: write to andgarmed@gmail.com. We aim to respond within 15 days. If you are not satisfied, you may approach the Data Protection Board of India once it is available to you under the law.
- Online gaming: NomiPlay offers educational and social games. There are no real-money games, bets or cash prizes, and in-game coins have no monetary value and cannot be exchanged for money.