Privacy Policy

iTumble is operated by Alistair Downes, based in the United Kingdom. iTumble is a web app that lets children create animated characters, perform gymnastics moves, and turn them into personalised fidget toys.

For privacy questions please contact us at: contact@itumbl.com

We collect the minimum data needed to run the service:

• Anonymous session token — when you first visit, Supabase creates a random ID stored in a secure cookie. No name, email, or personal information is associated with it unless you choose to add one.
• Display name — if you type a name in the "Name your creature" field or set a username, that name is stored against your session. We recommend children use a fun made-up name, not their real one.
• Toy data & scores — your saved fidget toys and spin scores are stored so you can access them again.
• Pro subscription — if a parent or guardian upgrades to Pro, Stripe processes the payment. We receive only a Stripe customer ID; we never see full card details.

We do not collect location data, contact lists, device identifiers, or any other personal data.

iTumble is designed to be used by children, and we take their privacy seriously. We apply the principles of the UK Age Appropriate Design Code (Children's Code):

• We collect only the data strictly necessary to provide the service.
• No personal information is required to play — the session is anonymous by default.
• We do not use children's data for profiling, advertising, or sharing with third parties beyond the processors listed below.
• Leaderboard display names are chosen by the user. We encourage parents to help children choose a nickname rather than a real name.

Parents or guardians may request deletion of all data associated with their child's account by emailing contact@itumbl.com.

• Legitimate interests — providing the app service, maintaining security, preventing abuse.
• Contract performance — processing Pro subscription payments.
• Legal obligation — retaining certain records as required by law.

We use the following processors, each operating under their own data protection terms:

• Supabase — database and authentication hosting. Data is stored in the EU (Ireland). Supabase Privacy Policy
• Stripe — payment processing for Pro subscriptions. Stripe Privacy Policy

We do not sell your data. We do not share it with advertisers or marketing platforms.

Your session data and toys are kept until you request deletion. If an account is completely inactive for 2 years we may delete it. Stripe retains payment records as required by financial regulations (typically 7 years).

You have the right to:

• Access — request a copy of data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Restriction — ask us to pause processing while a dispute is resolved
• Objection — object to processing based on legitimate interests

To exercise any right, email contact@itumbl.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk

We use only the cookies needed to make the app work:

• Session cookie — set by Supabase to keep you logged in during and between visits. This is a strictly necessary cookie; the app cannot function without it.
• Stripe cookie — only set if you visit the payment flow. Used to prevent fraud during checkout.

We do not use advertising cookies, analytics cookies, or any third-party tracking.

Because we only use strictly necessary cookies, we are not required to show a consent banner under UK PECR. If you block all cookies, the app will not be able to save your progress.

We may update this policy as the service evolves. Material changes will be noted at the top of this page with a new "Last updated" date.