Privacy Policy

This policy explains what information LafaNGames collects, why we collect it, and the choices you have. It describes the software as provided; the organisation running this installation may add its own policies or contact details.

Playing without an account

You can play every game without creating an account. Games run in a sandboxed frame and do not receive your name, email address, session cookie or account details.

Accounts

Creating an account lets you manage an optional subscription. We store your name, email address, a securely hashed password, email-verification status and account timestamps. Passwords are never stored in plain text. Sessions are kept in secure, HTTP-only cookies and can be revoked by signing out.

Subscriptions and payments

Payments are processed by Stripe. We do not receive or store your full card number. We store a subscription record containing a provider customer identifier, subscription identifier, plan, status and renewal date so we can provide ad-free access and show billing status. Stripe handles invoices, taxes and payment methods under its own privacy terms.

Messages

If you use the contact form or report a game, we store the name, email address, subject and message you provide so staff can respond. Please do not include sensitive personal information about students in a message. Staff may add an internal note that is not shown publicly.

Cookies and consent

Essential cookies keep accounts signed in and protect forms. Optional analytics and advertising are disabled until you accept them in the cookie notice. You can reopen the notice through the “Cookie settings” link in the footer and choose essential-only at any time.

Analytics

With analytics consent, we record page views in our own database. A record contains the page path, a hashed random visitor identifier, the referring hostname, a coarse device type and a timestamp. Bots are identified from the user agent and excluded from headline totals. We do not use this data to identify individual visitors. If the site owner configures Google Analytics, that provider receives data only after you consent.

Advertising

The site does not display ads inside games. Advertising is optional and disabled by default. When enabled and after advertising consent, Google AdSense may set cookies and collect data to serve and measure ads. Premium subscribers do not see ad slots. You can use the site with essential cookies only; some advertising may then be limited or unavailable.

Service providers

• Stripe for subscription checkout, billing and payment records.
• Resend for account verification and password-reset emails, when configured.
• Google AdSense for advertising, only when enabled and consented.
• Google Analytics for optional traffic analytics, only when configured and consented.
• A managed PostgreSQL provider or self-hosted database for application data.

Retention and security

Account, subscription, content and message records are kept while the service is operating or as needed to meet legal obligations. Sessions and one-time tokens expire automatically. Data is transmitted over HTTPS in production. Access to administrative tools is restricted to authorised staff and recorded in an audit log. No system is completely secure, so please use a unique password and keep it private.

Children and classrooms

Games are intended to be used with teacher supervision. Student accounts are not required. If you are a teacher or guardian and believe a child has submitted personal information through the contact form, contact us so it can be removed.

Your choices

You can update your name and password from your account page, sign out of all sessions, change cookie consent at any time, or ask for help with access, correction or deletion of your account data through the contact page. Some records, such as payment and security logs, may need to be retained where required by law.

Changes

We may update this policy as the service changes. The date shown at the top of the page reflects the latest edit. Material changes should be communicated through the site or by email where appropriate.