Explorer Kids
Privacy notice
Find out what data is processed when you visit, sign in, buy or redeem a gift.
Last updated: 22 October 2026
What does this notice cover?
This notice covers explorerkids.app, the web account, digital purchases, gift redemption and related communication. The web account can connect Explorer-Packs and inventory with the Explorer Kids app. Additional app features such as location access, camera use or AI features are outside this website notice; the notices and permissions within the app apply to those features.
Who is responsible?
The controller is LinkEase LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA, represented by Björn Boy. Contact support@explorerkids.app about privacy or to exercise your rights.
Visiting the website and necessary browser storage
Google Firebase Hosting delivers this website and processes technical information such as IP address, requested page, time and browser information to deliver and protect it. We do not embed advertising or visitor-analytics trackers on the public website. Your language choice is stored locally until you remove it or clear browser data. Sign-in session data is stored in your browser. To resume a gift purchase, the order ID, a random continuation credential, selection, languages and any optional signature and message are kept only in the browser session. This storage supports the requested functions and can be removed by ending the session or clearing browser data.
Accounts, Apple and Google
We use Firebase Authentication for web accounts. It processes an account ID, email address, sign-in method and technical security information; Firebase also manages the password for email sign-in. If you choose Apple or Google, the sign-in information you authorise, including a provider identifier, email address and, where provided, your name, is shared with Firebase. Apple may supply a relay address instead of your actual email. We do not receive your Apple or Google password. Matching email addresses alone do not automatically merge accounts or purchases. Account data and associations are used for sign-in, assigning Explorer-Packs and performing our contract.
Abuse prevention
Protected purchase and redemption requests use Firebase App Check and reCAPTCHA Enterprise. Google processes technical browser, device and request information and integrity attestations. Our servers also validate requests and limit repeated code attempts. These measures help prevent unauthorised access, repeated redemption and fraud; we do not use them for personalised advertising.
Purchases and server-held inventory
When purchasing is available, payment takes place in an embedded Stripe Checkout form using Managed Payments or Link. Stripe processes payment and billing information under its own notices. We do not store full payment-card details. We receive the order information needed to fulfil the purchase, such as order and transaction identifiers, status, amount, currency, selected product and the contact address supplied at checkout. If you expressly choose immediate delivery, we also record the consent wording, version, language, order reference and server timestamp for the contractual record. Explorer-Packs, remaining unlocks, redemptions and refunds are associated with the relevant account or order on the server. Returning from checkout is not, by itself, proof of payment.
Gifts and email
A gift may be ordered without an Explorer Kids buyer account. We save the selection, purchase-email language, voucher language, order status and any optional giver name and message. Please do not enter sensitive information, addresses or unnecessary data about children. After confirmed payment, the voucher is sent only to the buyer email address from checkout. No email is automatically sent to the receiving family. The buyer chooses whether to share the private link or print the voucher. A person holding the link or code can view the gift; assignment requires sign-in and explicit redemption. Private gift links and redemption codes are not processed in URL query strings or visitor-analytics services. We use Resend for transactional emails, which processes the recipient address, content and delivery status. Replies and support requests are processed through ALL-INKL.COM and forwarded internally for handling.
Customer communications and Hostinger Reach
A server-side sync of regular customer accounts from the app and website with Hostinger Reach is planned for managing account and product service communications. It processes the account email address, chosen language, app or website usage and, where relevant, purchaser status. Guest and disabled accounts are excluded. Children’s and profile names, location, mission and card data are not transferred. An account or language choice is not blanket consent to advertising; the sync itself sends no campaigns and does not change existing unsubscribes. Where the GDPR applies, necessary service data is processed to perform the contract under Article 6(1)(b); organising customer communications relies on our legitimate interest under Article 6(1)(f). You may object to that processing where the statutory conditions apply. Contacts managed by our sync are removed or updated after account deletion or email changes following the next complete account scan. Hostinger is an additional service provider; its privacy information is linked below.
Legal bases and optional information
Where the GDPR applies, account, order, gift and support data is processed to take steps towards or perform a contract under Article 6(1)(b). Necessary website delivery and abuse prevention rely on our legitimate interests in a secure, working service under Article 6(1)(f). Legally required retention relies on Article 6(1)(c). If a separate purpose requires consent, we obtain it separately; acknowledging this notice is not blanket consent. Without necessary account, payment or security data, we cannot provide the corresponding function. A gift signature and message are optional.
Recipients and processing outside Europe
Recipients include Google/Firebase for hosting, authentication and integrity checks; Apple or Google for your chosen sign-in; Stripe/Link for payments; Resend for transactional email; and ALL-INKL.COM for support email. Our operator is based in the USA. Google states that Firebase Authentication operates in the USA; other providers may also process data outside the EEA. Google describes safeguards including the EU-US Data Privacy Framework and contractual measures. See the provider information linked below for their roles, transfers and safeguards, or contact us about the processors we use.
How long is data kept?
Account information is kept to operate the account until it is deleted or processing is no longer needed. Order, redemption and refund records are kept as needed for fulfilment, unresolved claims, fraud prevention and statutory retention. Optional gift information is stored with the order or gift; you may request its deletion through support. Support correspondence is retained for handling and subsequent clarification unless longer retention is needed. Providers may apply their own technical deletion and backup periods. Browser continuation and sign-in data lasts for the relevant session; language preferences remain until deleted.
Your rights and children
Subject to the applicable conditions, you may request access, correction, deletion, restriction and portability. You may object to legitimate-interest processing on grounds relating to your particular situation, and withdraw consent for the future. You may complain to a competent data-protection authority, including one where you live or stay in the EEA. Contact support@explorerkids.app; an appropriate identity check may be needed, but never your password. Registration, purchasing and gift redemption on this website are intended for adults. This website does not offer separate child accounts or ask for children’s email addresses, dates of birth, photos or location data.
Provider information
Your statutory rights are not affected.