🔒 Cheesedrop Privacy Policy — First Season Beta

Cheesedrop is a private drawing room for small groups of children. This policy explains what we collect, why, and what you can do about it. It is written to be read by parents, not lawyers.

This is a beta: thirty families, one season, run by a very small operation. That shapes what follows, and we have tried to say so plainly rather than write a policy for a company we are not yet.

If anything here is unclear, write to privacy@playcheesedrop.com and a person will answer.

The short version

• Children do not have their own accounts. Every account belongs to a parent or guardian over 18.
• There are no passwords. You sign in with a code we email you.
• A child chooses their own display name, and we suggest options. Everything else they choose comes from lists we provide. The sticker search box is the other place they can type a word to find a sticker. More on that below.
• We do not show ads, and we do not sell, rent or share personal information with anyone for their own purposes.
• We use no advertising trackers, no social-media pixels and no third-party analytics.
• We never ask a child for a real name, an address, a phone number, a photo or a recording. The display name a child types is theirs to invent, and the one-word rule is there so it stays that way, and a parent can change the name at any time.
• The room is open 7:30 to 8:00 pm, every night, in your squad's time zone. The lobby opens at 7:25. There is no other time to set.
• A child's artwork belongs to their family. The Fridge holds the last 60 days, and you can download all of it at full resolution whenever you like.
• During the beta, a real person may look at artwork and sessions to fix things that break. We say more about this below, because it is the part most specific to a beta.
• Membership is free and we never ask for a card. Murals and prints are paid, and the price is always shown before you pay.

1. Who we are, and what this covers

Cheesedrop is operated by Cheesedrop, a small business in Los Angeles, California.

Cheesedrop
1001 Gayley Ave, Ste 105
Los Angeles, CA 90024
privacy@playcheesedrop.com
(424) 229-1013

This policy covers playcheesedrop.com, the Cheesedrop app — squad rooms, the Lounge, the Fridge and seasonal missions — and gift murals created from a shared link.

Classroom and camp sessions are not open during the beta. When they are, we will publish a policy that covers them before any child takes part.

Cheesedrop is intended for children aged roughly 6–12, used with a parent's knowledge. Accounts may only be created by adults aged 18 or over.

2. What the beta means for your information

We think you should know three things about using a product this early.

It is small. Thirty families in the first season. That means fewer people, less data, and a smaller thing to protect — which is genuinely safer than the alternative.

A real person is paying attention. During the beta, the person running Cheesedrop may look at artwork, sessions and error reports in order to fix what breaks. This is how a product this young gets better. We look at what we need to fix a problem and nothing else, we never use what we see for marketing, and we never share it.

Things will change. Features will appear and disappear. If a change means we collect something new, we will update this policy, tell you what changed, and email you before it takes effect — not afterwards.

Nothing is deleted when the beta ends. Your account, your child's artwork and your settings carry on. We will publish a new policy and tell you what changed.

The business is being incorporated. Cheesedrop is in the process of becoming a California limited liability company. When it does, the company becomes the operator named above and we will tell you. Nothing about what we collect or how we use it changes because of that.

3. What we collect, and from whom

3.1 From parents and guardians

• Your email address
• No password. You sign in with a six-digit code we email you, so there is no password for us to store or for anyone to steal
• The display name you give each child
• Your squad's time zone, so the room opens at 7:30 pm where you are
• Your notification preferences
• A record of your confirmation that you are the child's parent or legal guardian and over 18, with the date
• A postal address, only if you order a print. We keep it to fulfill that order and to reprint it if something goes wrong. We do not ask for an address otherwise.

Membership is free and needs no card, so for most families we never see any payment information at all. If you buy a gift mural or a print, payment is handled by Stripe. We receive a confirmation that payment succeeded, the last four digits of the card and its expiry. We never receive or store full card numbers.

3.2 From children in a family that has an account

With your consent as the account holder:

• The display name they use in the room
• An avatar and color
• The artwork they make — drawings, stamps, squad crests and cards
• Which nights they took part, and which parts of a shared picture were theirs
• What they earn in the game — cheese caught, ink, and their squad's mission points

We do not collect a child's real name, date of birth, address, phone number, email address, photograph, voice recording or location. Your child's real first name appears in your parent portal only if you choose to enter it, so you can tell who is who; it is never shown to other children or other families.

On what children can write. Captions are chosen from fixed lists we provide. A message stamped onto a drawing is typed, up to 24 characters. Before it can be placed, it is checked for phone numbers, email addresses, street addresses and postal codes, and for unkind, explicit or unsafe language — including attempts to disguise words by swapping letters for numbers. If the check fails, the phrase cannot be placed, and the text that failed is never stored anywhere. The same check runs again on our server, so it cannot be skipped from the browser. A display name is also typed: the child chooses their own, and the app suggests options like “rocketpower.” It must be a single word with no spaces and a limited length, so a full real name cannot be entered. A parent can change the name at any time once they’ve claimed their child’s tag. The sticker search box is the other place a child can type. A child can type a word — “cats”, “pizza”, “stars” — to find a sticker.

We keep a count of the words searched for, so we know which stickers to draw next. We do not store who searched for what. A search is never shown to another child, and suggestions come only from our own sticker labels, never from anything another child has typed. Short, ordinary search words are kept as counts; anything longer or unusual is counted without keeping the text.

Leagues, and what other squads can see. During a seasonal mission a squad may race up to three other squads. The other squads see your squad's name, its score and how far through the case it is — and nothing else. Not your child's name, not their avatar, not anything they have drawn, and there is no way for anyone in another squad to send anything to your child. You can see every squad in the league from your portal and take your child's squad out of it at any time.

3.3 From a child visiting a friend's squad

A child invited to a friend's squad can draw the same evening, before their own family has an account. During the first 30 days:

• We collect a nickname they type themselves, from our suggestions or their own, limited to a single word with no spaces, an avatar, a color, and the artwork they make
• We use a session identifier on their device purely to keep them in the same squad between visits. It is not used for advertising, profiling or tracking across other websites
• We collect no real name, no email address and no contact details from the child. The nickname they type is not shown to anyone else in the squad until a parent claims their tag

If their family creates an account within those 30 days, the nickname and artwork carry across. If no account is created, we delete the nickname, avatar and session record 30 days after the visit. A visiting child's display name is one they typed themselves and no parent has claimed yet. It is not shown to anyone else, and it is deleted with the rest of the visit record.

3.4 From people who buy or draw on a gift mural

• The person who buys a mural gives us an email address so we can send them the finished file, and a delivery address if they choose a printed version.
• Someone who opens a mural link draws one piece and signs it with a first name and last initial — for example “Alex P.” — which prints beside their drawing so the artwork can be credited to the child who made it. We collect no account and no email address from them, and nothing else about them at all.

3.5 Automatically, from everyone

• IP address, kept briefly in server logs for security and abuse prevention
• Browser and device type
• Times of access, so the room opens and closes correctly

We keep these to run and protect the service. We do not use them to build profiles or to advertise.

3.6 How we measure whether things work

We keep counts, not people: how often a mode is opened, which drawing starters get used, how many squads finished a mission, which sticker searches returned nothing, how many murals were ordered. These are aggregate numbers, not linked to an individual child, and we use no third-party analytics service.

4. What we never do

• We do not show advertisements of any kind.
• We do not sell, rent, trade or share personal information with anyone for their own purposes.
• We do not use advertising networks, social-media pixels or cross-site trackers.
• We do not ask a child for a real name, an address, a phone number, a photo or a recording.
• We do not show a child a price, an upgrade prompt or anything to buy.
• We do not condition a child's participation on giving us more than the activity needs.
• We do not send a child's artwork, or anything else about a child, to any artificial-intelligence service. When a finished piece is smoothed, harmonized or framed, that is our own software doing arithmetic on the strokes your child actually drew. Nothing is ever generated, redrawn or completed for them. Every mark in a finished piece is a mark a child made.

5. How consent works

Under the Children's Online Privacy Protection Act, we need a parent's consent before collecting personal information from a child under 13.

You give that consent when you create the account, confirm you are the child's parent or guardian, and set up their display name. Because we collect so little from children, and share none of it with anyone for their own purposes, this is the level of consent the Rule asks for.

You can withdraw it at any time by writing to privacy@playcheesedrop.com or using the controls in your portal. We will delete your child's information and tell you when it is done.

6. Who else touches your information

We use a small number of companies to run the service. Each gets only what its job needs, and none may use it for anything else.

We do not share information with anyone else, except where the law requires it or where it is needed to protect a child from harm.

7. Artwork

Your child owns what they make. We claim no ownership.

You give us permission to store their artwork and show it to the other children in their squad and to the adults on those accounts, so the service works. We use it for nothing else. We will not use your child's artwork in marketing, on our website, on social media, or in examples, unless you ask us to in writing for that piece.

Some pictures belong to more than one family. A shared scene or a quilt is made by several children together. Each family may download it and order its own print. No single family can delete it, because it is other children's work too. If you delete your child's information we remove their name and every link to them from those pictures, and on request we will remove their own drawing from them as well.

The Fridge holds the last 60 days. Finished pieces are deleted 60 days after they are made. Squad crests, cards, badges and avatars do not expire while your account is open. Your portal shows the date each piece leaves and lets you download everything at full resolution in one tap. Download anything you want to keep.

8. How long we keep things

When you close your account we delete everything above, except the shared pictures other children helped make, from which we remove your child's name and every link to them.

9. What you can do

From your portal, or by writing to privacy@playcheesedrop.com:

• See everything we hold about your child
• Download all of your child's artwork at full resolution
• Correct a display name or a setting
• Delete your child's information, or your whole account
• Leave a league at any time
• Stop us collecting anything further while keeping what exists
• Refuse to let your child take part at all, without losing your account

We answer within 30 days, usually much sooner. We will never make you jump through hoops or ask you why.

If you are in California, you have these rights under state law as well, and we will not treat you differently for using them.

10. How we protect it

Everything travels over an encrypted connection and is encrypted where it is stored. Access to the systems that hold children's information is limited to the person running Cheesedrop, protected by two-factor authentication. Artwork is served through links that expire. We keep a written security program and review it at least once a year.

No service can promise perfect security. If something happens that affects your family's information, we will tell you — what happened, what it means, and what we are doing about it — as quickly as we can and as the law requires.

11. Where information is held

Cheesedrop is operated from the United States, and information is stored there.

Accounts, memberships and purchases are offered in the United States only. We do not open accounts or take orders from outside the US.

Gift mural links are the exception: anyone, anywhere, can open a link and draw a piece. If a child abroad draws on a mural, the first name and last initial they enter and the drawing they make are sent to and stored in the United States, and are deleted with the mural after 60 days.

12. Changes to this policy

This is a beta, so things will change.

If a change means we collect something new, or use it differently, we will email you at least 30 days before it takes effect and give you a plain explanation of what changed. We will not make a change like that quietly.

When the beta ends, this policy is replaced. We will send you the new one and tell you what is different.

13. Contact

Anything at all: hello@playcheesedrop.com
Safety concerns: safety@playcheesedrop.com
Privacy: privacy@playcheesedrop.com

Cheesedrop
1001 Gayley Ave, Ste 105
Los Angeles, CA 90024
(424) 229-1013

A person reads these. You will not get a ticket number.