Privacy
policy

Girafoufou is a calm learning game for children aged three to five: numbers, shapes, picture books, stories and nature walks, with a little giraffe called Girafoufou. Parents trust us with their children’s time, and that trust is everything we have. This page explains, without jargon, what we know about you and your child, where it is kept, for how long, and what you can do about it.

The short version

• Your child’s game (stars, garden, drawings, first name, settings) stays on your device. We never receive it.
• There is no advertising, no tracker, no analytics tool, no advertising ID and no cookie in the English edition. The game never asks for the microphone, the camera or your location.
• Our hosting provider, like every website’s, sees the technical details of each connection (such as your IP address) and keeps them in its logs to run and protect the service. We never use them to follow what your child does.
• The English website counts nothing: not even how many times a page is opened.
• You can erase everything the device keeps, at any time, from the parents’ corner.

Who we are

Girafoufou is made and run by Marcel Venturino, a sole trader (entrepreneur individuel, micro-entreprise) registered in France: 4 rue Papassaudi, 13100 Aix-en-Provence, France — SIREN 999 463 847, registered with the Aix-en-Provence trade and companies register. He is the controller of the personal data described on this page.

• Contact for anything about your data: marcel@girafoufou.fr (we read and answer in English).
• Our representative in the United Kingdom (Article 27 UK GDPR): being appointed. Their name, UK postal address and email will appear here as soon as the appointment is confirmed; until then, families in the United Kingdom can write to us directly at the address above.
• Registration with the Information Commission as a data controller: the data protection fee was paid on 6 October 2026 (application C2052344); our registration number will appear here as soon as it is issued.
• We have not appointed a Data Protection Officer: the law does not require one for a project of this size. The address above receives every request.

Because we are based in France, we follow both the EU GDPR and, for families in the United Kingdom, the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and the Age Appropriate Design Code (the “Children’s Code”).

What happens when your child plays

Everything stays on the device. While your child plays, the game keeps the following in your browser’s storage, on your device only:

• the stars, the garden and its furniture, the drawings, today’s diary (“Today” in the parents’ corner), the off-screen challenges marked “done”, and today’s play time (for quiet time);
• if you give them on the first-name card: a first name or nickname, and “a girl” or “a boy”;
• the settings you choose in the parents’ corner, such as your child’s age (3, 4 or 5) and the seasonal scenery;
• copies of the game’s own files (pictures, voices) once they have been played, so that they open faster and keep working without a connection — the same files for every family.

We do not receive any of this. It is not sent to our server, it is not synchronised, and nobody at Girafoufou can see it. In the English edition, the first name is only written on the screen: it is never sent anywhere, and no voice service ever receives it. The English edition has no parent account.

How to erase it: in the parents’ corner, “Reset everything” erases the stars, the garden, the first name, the drawings and the play time from this device. Clearing your browser’s data for our website does the same.

What the game never does: it never asks for the microphone, the camera, your location or notifications; it has no chat and no way for your child to contact other people; it shows no advertising and sells nothing to your child; there is no in-game purchase and your child never sees a price.

What happens when anyone visits the website

Like every website, ours needs a few technical details to answer your device.

• Our hosting provider’s logs. When your device connects, our hosting provider, Railway, receives and records technical information about the connection, including your IP address, your browser, the page requested, the status and the duration of the answer. Railway uses these logs to run the service and keep it secure, partly for its own purposes as described in its data processing agreement. These logs are therefore not anonymous. We use them only to diagnose problems, never to follow your child’s games or progress. Railway stores these logs in its US West region, in the United States, whichever region the website runs in, and deletes them permanently after 90 days; they cannot be deleted earlier, nor entry by entry.
• Our own application. The English edition sends nothing to our application’s server: no account, no page counting, no voice. The game’s pages and files are simply served.
• Faster files. To load quickly, copies of the public files of the website (pictures, voices, films) — identical for everyone — are kept for up to one day on Railway’s servers closest to you, anywhere in the world. Never a page, never anything about you or your child.

Lawful basis: our legitimate interest in running a secure and reliable website (Article 6(1)(f) UK GDPR). You can object by writing to us; we will explain what we can do, knowing that a website cannot answer a device without its address.

Children

Girafoufou is designed for children aged three to five, so we treat every visitor as a young child and apply the Children’s Code by design.

• High privacy by default. Nothing about your child leaves the device. There is no setting to “share more”, and no option that sends data about your child is offered in the English edition.
• Nothing is asked of the child. No account, no email, no consent is ever asked of a child. Everything that concerns data or settings lives in the parents’ corner, behind “a question for the grown-ups”, and is decided by a parent.
• No profiling. We do not build a profile of your child, for advertising, marketing or any other purpose. The game does adapt a little on the device — for example, a puzzle grows slightly after several successes, and “Do you remember?” picks older levels to review. This happens only on the device, only to give your child the game you asked for, and is never sent to us.
• No nudging. No streaks, no countdowns, no surprise rewards to bring your child back, no notifications. After about 25 minutes of play in a day, Girafoufou goes off for a nap: this “quiet time” ends the session gently, and “just a bit more” is for parents only.
• No geolocation, no data sharing, no third-party content in the game. No advertising network, analytics provider or social network receives anything from the game.
• What parents can see. The parents’ corner shows, on the device only, what your child did today (the “Today” page). At the end of the day, Girafoufou goes over the day with your child, invites them to tell you about it, and tells them that you can see their day too, in the grown-ups’ corner.
• A first name can be a nickname. You never have to give your child’s real name.

Cookies and similar technologies

The English edition sets no cookies. It does use your browser’s storage (local storage and its copy in IndexedDB, plus an offline cache) to remember your child’s progress and the choices you make in the game. Under PECR, this kind of storage does not need a consent banner because it is strictly necessary to give you the game you asked for: it records the information and selections you make. We do not use storage for anything else, and nothing in it is read by us or by anyone else.

How long things are kept

Who else is involved, and where your data goes

Railway Corporation (San Francisco, United States; representative in the European Union in Hamburg, Germany) hosts the website in its EU West region, in Amsterdam, the Netherlands, on Google Cloud infrastructure. Railway acts as our processor under a signed data processing agreement, which includes the standard contractual clauses and the UK Addendum for UK data. Because Railway is an American company, American law may apply to it even for data kept in Amsterdam; Railway takes part in the EU–US Data Privacy Framework and its UK Extension. Its logs (with your IP address and browser) are stored in its US West region, in the United States. Its servers around the world also keep copies of the public files of the website (pictures, voices, films), never data about you.

Transfers from the United Kingdom. The website and its database run in the European Economic Area, which the United Kingdom recognises as offering adequate protection. Railway’s logs, with your IP address and browser, are stored in the United States: that transfer relies on Railway’s certification to the UK Extension of the Data Privacy Framework, and on the standard contractual clauses with the UK Addendum in its data processing agreement.

Nobody else receives data from the English edition today. We never sell data, and we never share it for advertising.

Your rights

Under the UK GDPR you can ask us to tell you what we hold about you and give you a copy (access); correct it (rectification); delete it (erasure); limit how we use it (restriction), or object to a use based on our legitimate interests; give it to you in a reusable format (portability); and you can withdraw any consent at any time.

In the English edition we hold almost nothing that could identify you: your child’s game is on your device, where you can erase it yourself. For anything else, write to marcel@girafoufou.fr or to our UK representative. We may ask you a question to make sure the request is yours. We reply within one month.

We make no decision about anyone by automated means that has legal or similarly significant effects. Nothing on this page is a statutory or contractual requirement: you can play without giving any information at all.

Complaints

If you are unhappy with how we use personal data, please tell us: write to marcel@girafoufou.fr, with « Complaint » in the subject if you can. We acknowledge every complaint within 30 days, look into it, and tell you what we found and what we will do about it.

You can also complain to the UK’s data protection regulator, the Information Commission (formerly the Information Commissioner’s Office, ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113. Because we are established in France, you can also contact the French regulator, the CNIL (cnil.fr).

Keeping things safe

No analytics or tracking code is allowed in the game, and automated tests check this before every update. Pages and server answers are never kept by a shared cache. The parents’ corner is behind a question for the grown-ups.

If this page changes

If we change what we do with data, we will update this page and its date before the change happens, and ask for a new agreement wherever one is needed. Who publishes Girafoufou and who hosts it is on our legal notice.

Last updated: 6 October 2026.