Privacy Policy

A. Collection of your Personal Data

In order for us to provide the Products and Services to you, we will collect standard network request information when you load our content, which includes the following:

• IP address, request time, requested resource address, browser or device information (user-agent).

Except for standard network request information, the Products and Services are designed to work without collecting Personal Data from you. Depending on how you use them, the following types of information are involved:

1. Information we do not collect

• We do not offer user accounts or registration. Apart from TestFlight beta testing (see A.4), we do not ask for or collect your name, date of birth, gender, email address, phone number, photo or any other profile information, and the Application cannot be linked to social media accounts.
• We do not collect usage statistics, analytics, advertising identifiers, installation identifiers, crash reports or diagnostic reports, and we do not track your activity across other companies’ apps or websites.
• We do not collect precise or approximate location, contacts, photos, camera or microphone input, health data, payment information, or any sensitive Personal Data disclosing your psychological, mental or physical health, genetic or biometric data, religious beliefs, political views or criminal records.

2. Information stored only on your device

To let you continue where you left off, the Application and the Website save the following information in your device’s local storage (for the Website, your browser’s local storage and cache). This information stays on your device; it is not synced to any account and is not sent to us:

• episode progress, completed cases, scores, answers, results and checkpoints that let you resume a case;
• badges, rewards, in-game (virtual) items and the learning profile shown in the Application;
• settings such as the selected language, sound, reading and subtitle preferences;
• a cached copy of the case map and of videos, images and audio that have already been loaded, so that they play smoothly.

You can delete this information at any time by deleting the Application, or by clearing this Website’s data in your browser. Deleted progress cannot be restored by us, because we never had a copy of it.

3. Technical information received automatically when content loads

Episodes, videos, images, audio and the case map are delivered over the internet from our servers and our content delivery network (CDN). Like any website, these servers necessarily receive the technical information contained in each request, which may include:

• your device’s IP address;
• the date and time of the request and the resource (file or page) requested;
• browser or system type and version (User-Agent), language setting and the referring page;
• technical information about the connection, such as response status and amount of data transferred.

This information is used to deliver the content you request, to keep the service secure and to investigate faults. It may be recorded in server and CDN access logs (see Section H for retention). We do not use it to identify you, build a profile of you, or show you advertising, and we do not combine it with other information about you.

4. Information you choose to provide to us

• If you email us for support, feedback or a privacy request, we receive your email address, the content of your message and any attachments (such as screenshots) you choose to send.
• If you take part in a beta test through Apple TestFlight, we receive the name and email address used to invite you and, through Apple, any feedback and screenshots you send, together with the device information and crash reports that TestFlight attaches.

Please do not include sensitive information, or a child’s personal details or image, in emails, feedback or screenshots.

5. Information provided to us by third parties

Apple may make available to us, under its own terms and privacy policy, aggregated information about App Store downloads and sales, and — only if you have chosen in your device settings to share analytics with app developers — crash logs and basic usage information about the Application. Apple provides these to us in a form that does not directly identify you. We do not receive Personal Data from social networks, advertising networks or data brokers.

B. Use of data

We use the limited information described in Section A only for the following purposes:

• to provide and maintain the Products and Services, including delivering episodes, videos and other content to your device;
• to keep the Products and Services secure and reliable, for example to detect and prevent abuse of our servers and to investigate technical problems;
• to respond to your questions, feedback, support requests and privacy requests;
• to evaluate and fix problems reported by beta testers or shown in crash logs that Apple makes available to us;
• to comply with Applicable Laws, court orders and requests from competent authorities, and to establish, exercise or defend legal claims.

We do not use any information for advertising, marketing, profiling, automated decision-making, or to train artificial intelligence models, and we do not sell Personal Data.

C. Legal basis

Where Applicable Laws require a legal basis for using Personal Data, we rely on the following:

• Contract Performance: delivering the content you request when you use the Products and Services;
• Legitimate Interests: keeping the service secure and working properly, and handling technical faults. When we rely on a legitimate interest, we ensure that our interests do not override your interests or fundamental rights and freedoms, especially where the user is a child;
• Your Consent: where you choose to contact us or send us feedback;
• Legal Requirement: where it is necessary to comply with the law or a court order, or to defend or make a legal claim.

D. Analytics, cookies and similar technologies

1. No analytics or tracking

The Application and the Website do not use internal or third-party analytics, advertising or tracking technologies, and contain no third-party analytics, advertising or crash-reporting software development kits (SDKs).

2. Local storage

The Website does not set cookies. The Application and the Website use your device’s local storage and cache (including Local Storage and Cache Storage) only to save the information described in Section A.2 on your device. These technologies are strictly necessary for saving your progress and for smooth playback; they do not send information to us or to third parties. If you clear them, your progress and settings on that device will be removed.

3. Direct marketing and advertising

We do not send direct marketing, newsletters or push notifications, and the Products and Services do not display advertising.

E. Application features and device permissions

The Application does not request access to your camera, microphone, speech recognition, photo library, files, contacts, location, Bluetooth, notifications or tracking (App Tracking Transparency). It does not read your clipboard. The only capability it uses is internet access, to download the episodes and other content described above.

The Application does not offer in-app purchases or any other way to spend real money. Items earned or shown in the Application’s in-game shop are virtual items used for play only.

F. Personal Data shared with third parties & AI disclosures

1. Artificial intelligence

The Products and Services do not contain interactive or generative AI features, and we do not send any of your information to AI service providers. Some of the videos, images and voices in the episodes were produced in advance by our team with the help of generative AI tools; that content is the same for every user and is not created from or personalised with your information.

2. Service providers

We share information only as necessary to provide the Products and Services, with:

• providers of cloud hosting, object storage and content delivery network (CDN) services, which process the technical information described in Section A.3 on our behalf in order to deliver content and keep the service secure and working;
• our email service provider, for emails you send us;
• our holding companies, subsidiaries or affiliated companies that develop, operate and support the Products and Services on our behalf;
• professional advisers, insurers, and potential investors or acquirers in connection with any merger, acquisition, sale or transfer of our business, subject to confidentiality obligations;
• regulators, law enforcement bodies and courts where required by Applicable Laws.

We take reasonable contractual measures to ensure that these third parties protect Personal Data and use it only according to our instructions. We do not sell or rent Personal Data, and we do not share it for cross-context behavioural or targeted advertising.

3. Third-party code

The Application uses third-party code and plug-ins, listed in Schedule 1. None of them collects Personal Data for its provider.

G. Location and transfer of your Personal Data

The servers that host the Website and the episode content are located in Singapore. Content is delivered through a content delivery network, whose servers (edge nodes) may be located in other countries close to you, so the technical information described in Section A.3 may be processed in those countries. Emails you send us are stored with our email service provider. Members of our development and support teams may access this information from outside the country where you live, only to provide support and maintain the Products and Services.

Where Personal Data is transferred to a country that may not offer the same degree of data protection as your country, we will only do so in compliance with Applicable Laws, for example where the destination is recognised as providing adequate protection or where appropriate contractual safeguards are in place.

H. Retention period of Personal Data

• Information stored on your device stays there until you delete the Application or clear this Website’s data. We never hold a copy of it.
• Server and CDN access logs (including IP addresses) are generated and kept on our behalf by our hosting and content delivery providers only for as long as needed for content delivery, troubleshooting and security, unless a longer period is required by law. We do not keep separate copies of them, except extracts needed to investigate a specific fault or security incident, which we delete once it is resolved.
• Emails and feedback are kept for as long as needed to handle your request and for up to 12 months afterwards, unless the law requires a longer period.

At the end of the relevant period, Personal Data is deleted or anonymised.

I. Safeguards of your Personal Data

We follow generally accepted industry standards and the security requirements of Applicable Laws to protect Personal Data against loss, destruction, alteration, and unauthorised or unlawful use. All content and requests between the Application or the Website and our servers are transmitted over encrypted connections (HTTPS/TLS). Access to server logs and to emails sent to us is limited to personnel who need it, and who are subject to confidentiality obligations.

Because the Products and Services have no accounts and do not hold your progress on our servers, there are no passwords or account records that could be exposed. In the event of a data breach affecting Personal Data we hold, we will act promptly to contain it and will notify affected users and authorities where required by law.

No security measures are 100% effective. To the extent permitted by Applicable Laws, we shall not be held liable for any loss or damage caused by unauthorised access that is beyond our reasonable control. If you have any questions about security, please contact us at edacn@101.com.

J. Your rights and choices on your Personal Data

As our Products and Services process only isolated technical data and do not maintain user profiles, we generally have no administrative or technical means to directly or indirectly link the technical data collected to an individual. To the extent that any of your Personal Data is collected, you enjoy the following rights under Applicable Laws with respect to Personal Data in our possession or under our control (which, as explained above, is limited to technical access logs, messages you have sent us and, for beta testers, the TestFlight information described in Section A.4).

1. The right to be informed

This Policy sets out what information is involved, why, on what legal basis, and how it is transferred, stored and handled. We recommend that you, or a parent or guardian, read it before using the Products and Services.

2. Control over information on your device

You are in full control of the information stored on your device: you can delete it at any time by deleting the Application or clearing this Website’s data. You can also stop all online loading by disconnecting from the internet, but the episodes will then not be available.

3. The rights of access, rectification, erasure and restriction

You may ask us to access, correct, delete or restrict the processing of Personal Data that we hold about you, such as the emails you have sent us. Because we do not have accounts, we may be unable to link access-log entries to you; if you make a request about access logs, please tell us the approximate time, IP address and device you used. The right to erasure is subject to our rights under Applicable Laws to keep Personal Data for legitimate purposes, such as complying with legal obligations or defending legal claims.

4. The right to object and to withdraw consent

You may object to our processing of your Personal Data, or withdraw consent you have given, at any time. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

5. How to make a request

Please email us at edacn@101.com. You agree to provide your contact information, the subject of the request and the Personal Data in question, and we may ask for information reasonably necessary to confirm your identity (or, for a request about a child, that you are the child’s parent or legal guardian). We will respond without undue delay and, in any event, no later than forty (40) days from the date of receipt of your request, unless the Addendum for your country sets a different period. As far as permitted by Applicable Laws, we may extend this period because of the complexity or number of requests. You may also contact your local data protection authority for any questions relating to the collection and use of your Personal Data.

K. Children

The Products and Services are designed for children aged 10 to 14 to enjoy with a parent, guardian or teacher, as well as for families and educators. We do not ask children for Personal Data:

• children are not asked to register, create an account or enter their name, contact details, photo or any other personal information;
• the Products and Services contain no advertising, no third-party analytics or tracking, no in-app purchases, no chat or social features, and no links that let a child share information publicly;
• progress and results stay on the child’s device.

We encourage parents and guardians to supervise their children’s use of the internet and of the Products and Services, and to send any support emails on the child’s behalf. If we learn that we have received Personal Data from a child without the consent of a parent or guardian where such consent is required (for example, a child has emailed us), we will use it only to respond if appropriate and then delete it. A parent or guardian may contact us at edacn@101.com to review or request deletion of any information a child has sent us.

L. Third party services

The Application is distributed through Apple’s App Store (and, for beta testing, Apple TestFlight). Your use of these services is governed by Apple’s own terms and privacy policy, and Apple independently collects and processes information about downloads, purchases, beta testing and device diagnostics. Deleting the Application or clearing local data does not delete information that Apple holds independently or messages you have already sent us.

Neopets and related characters and marks are used under licence. The licensor does not receive any Personal Data from the Products and Services. The Products and Services may contain links (for example, an email link to contact us); if you follow a link to a third-party website or application, its own privacy policy applies, and we are not responsible for its practices.

M. Changes to the Policy

We may update this Policy from time to time, for example when we change the Products and Services or when Applicable Laws change. We will publish the updated Policy on the Website with a new “last updated” date and, where the change is material, also tell you through the Application or the Website before it takes effect. Any changes take effect thirty (30) days after they are published, unless Applicable Laws require otherwise. If a future feature changes how Personal Data is handled, we will update this Policy first and, where the law requires, ask for consent (including verifiable parental consent for children) before the feature collects any Personal Data.

N. Severance

If any part or provision of this Policy is prohibited or deemed to be void or unenforceable, that part or provision shall be ineffective to the extent of such prohibition or unenforceability without invalidating the remaining provisions hereof.

O. Governing law and dispute resolution

This Policy shall be governed by, and construed in accordance with, the laws of Hong Kong Special Administrative Region (“Hong Kong”). Any dispute, controversy, difference or claim arising out of or relating to this Policy, including the existence, validity, interpretation, performance, breach or termination thereof or any dispute regarding non-contractual obligations arising out of or relating to it shall be referred to and finally resolved by arbitration administered by the Hong Kong International Arbitration Centre (HKIAC) under the HKIAC Administered Arbitration Rules in force when the Notice of Arbitration is submitted. The seat of arbitration shall be Hong Kong. The number of arbitrators shall be one. The arbitration proceedings shall be conducted in English.

P. Language versions

This Policy is officially published in English. If this Policy is translated into other languages, the English version shall prevail.

Q. Communicate with us

If you have any questions or concerns regarding this Policy, please contact us using the following information:

• Attn.: ELERNITY LIMITED
• Address: RM 2001-05 & 11, 20/F, HARBOUR CENTRE, 25 HARBOUR ROAD, WAN CHAI, HONG KONG
• Email: edacn@101.com

Schedule 1 – List of Personal Data that may be collected by third-party code and plug-ins

The Application is a web-based iPad application. It uses the following third-party code and plug-ins; the libraries that run in its web content are also used by the Website. None of them collects Personal Data for its provider or sends information to any party other than our own servers.

Capacitor (Capacitor.framework; @capacitor/core, @capacitor/ios)

• SDK name: Capacitor (Capacitor.framework; @capacitor/core, @capacitor/ios)
• Organisation: Open-source framework (Ionic), MIT licence
• Usage scenario of SDK: Runs the Application’s web content inside a native iPad app and bridges basic app functions.
• Purpose of use: Application runtime.
• Types of Personal Data collected: None collected. Content requests are sent only to our servers and CDN (see Section A.3).
• Data sharing: No data is shared.
• Permissions required: Internet access
• Link to SDK's official privacy policy: — (open-source library; does not collect personal information)
• Operating system: iPadOS

Cordova.framework (Capacitor’s Cordova compatibility layer)

• SDK name: Cordova.framework (Capacitor’s Cordova compatibility layer)
• Organisation: Open-source component bundled with Capacitor (Ionic, based on Apache Cordova), MIT licence; includes code from Apache Cordova under the Apache License 2.0
• Usage scenario of SDK: Capacitor’s built-in compatibility layer for Cordova plug-ins; it is bundled and loaded together with Capacitor.
• Purpose of use: Part of the Capacitor runtime, which loads it at start-up; the Application does not use it directly and has no Cordova plug-ins.
• Types of Personal Data collected: None.
• Data sharing: No data is shared.
• Permissions required: None (requests no additional permissions)
• Link to SDK's official privacy policy: — (open-source library; does not collect personal information)
• Operating system: iPadOS

Capacitor Splash Screen (@capacitor/splash-screen)

• SDK name: Capacitor Splash Screen (@capacitor/splash-screen)
• Organisation: Open-source plug-in (Ionic), MIT licence
• Usage scenario of SDK: Shows and hides the launch screen while the Application starts.
• Purpose of use: Display only.
• Types of Personal Data collected: None.
• Data sharing: No data is shared.
• Permissions required: None
• Link to SDK's official privacy policy: —
• Operating system: iPadOS

React and React DOM (react, react-dom)

• SDK name: React and React DOM (react, react-dom)
• Organisation: Open-source library (Meta Platforms, Inc.), MIT licence
• Usage scenario of SDK: Builds and updates the screens of the Application and the Website.
• Purpose of use: User interface.
• Types of Personal Data collected: None.
• Data sharing: No data is shared.
• Permissions required: None
• Link to SDK's official privacy policy: — (open-source library; does not collect personal information)
• Operating system: iPadOS; also runs in web browsers when you use the Website

React Router (react-router, react-router-dom)

• SDK name: React Router (react-router, react-router-dom)
• Organisation: Open-source library (Remix Software / Shopify Inc.), MIT licence
• Usage scenario of SDK: Moves between pages and screens within the Application and the Website.
• Purpose of use: Navigation.
• Types of Personal Data collected: None.
• Data sharing: No data is shared.
• Permissions required: None
• Link to SDK's official privacy policy: — (open-source library; does not collect personal information)
• Operating system: iPadOS; also runs in web browsers when you use the Website

Ant Design (antd, with its component packages @ant-design/* and @rc-component/*)

• SDK name: Ant Design (antd, with its component packages @ant-design/* and @rc-component/*)
• Organisation: Open-source library (Ant Group), MIT licence
• Usage scenario of SDK: Provides interface components, such as on-screen notices.
• Purpose of use: User interface.
• Types of Personal Data collected: None.
• Data sharing: No data is shared.
• Permissions required: None
• Link to SDK's official privacy policy: — (open-source library; does not collect personal information)
• Operating system: iPadOS; also runs in web browsers when you use the Website

ahooks

• SDK name: ahooks
• Organisation: Open-source library (Alibaba Group), MIT licence
• Usage scenario of SDK: Provides reusable interface logic, such as timers, event handling and full-screen control.
• Purpose of use: User interface.
• Types of Personal Data collected: None.
• Data sharing: No data is shared.
• Permissions required: None
• Link to SDK's official privacy policy: — (open-source library; does not collect personal information)
• Operating system: iPadOS; also runs in web browsers when you use the Website

PixiJS (pixi.js, pixi-filters)

• SDK name: PixiJS (pixi.js, pixi-filters)
• Organisation: Open-source library (PixiJS Team), MIT licence
• Usage scenario of SDK: Draws 2D graphics and effects in some scenes and interactive experiments.
• Purpose of use: Graphics rendering.
• Types of Personal Data collected: None.
• Data sharing: No data is shared.
• Permissions required: None
• Link to SDK's official privacy policy: — (open-source library; does not collect personal information)
• Operating system: iPadOS; also runs in web browsers when you use the Website

three.js (three)

• SDK name: three.js (three)
• Organisation: Open-source library (three.js authors), MIT licence
• Usage scenario of SDK: Draws 3D scenes in some interactive experiments.
• Purpose of use: Graphics rendering.
• Types of Personal Data collected: None.
• Data sharing: No data is shared.
• Permissions required: None
• Link to SDK's official privacy policy: — (open-source library; does not collect personal information)
• Operating system: iPadOS; also runs in web browsers when you use the Website

react-zoom-pan-pinch

• SDK name: react-zoom-pan-pinch
• Organisation: Open-source library, MIT licence
• Usage scenario of SDK: Lets you zoom and pan within some on-screen boards.
• Purpose of use: User interaction.
• Types of Personal Data collected: None.
• Data sharing: No data is shared.
• Permissions required: None
• Link to SDK's official privacy policy: — (open-source library; does not collect personal information)
• Operating system: iPadOS; also runs in web browsers when you use the Website

fflate

• SDK name: fflate
• Organisation: Open-source library, MIT licence
• Usage scenario of SDK: Decompresses compressed files downloaded from our servers.
• Purpose of use: File decompression.
• Types of Personal Data collected: None.
• Data sharing: No data is shared.
• Permissions required: None
• Link to SDK's official privacy policy: — (open-source library; does not collect personal information)
• Operating system: iPadOS; also runs in web browsers when you use the Website

Utility libraries (clsx, eventemitter3, @chenglou/pretext, Day.js, lodash, screenfull, tslib and other dependencies of the libraries above)

• SDK name: Utility libraries (clsx, eventemitter3, @chenglou/pretext, Day.js, lodash, screenfull, tslib and other dependencies of the libraries above)
• Organisation: Open-source libraries, MIT, ISC, BSD-3-Clause or 0BSD licences
• Usage scenario of SDK: Common programming functions, such as combining style names, passing events, laying out text, handling dates and controlling full-screen mode.
• Purpose of use: Internal functions of the Application and the Website.
• Types of Personal Data collected: None.
• Data sharing: No data is shared.
• Permissions required: None
• Link to SDK's official privacy policy: — (open-source library; does not collect personal information)
• Operating system: iPadOS; also runs in web browsers when you use the Website

The Application contains no advertising, analytics, attribution, crash-reporting, social-login, payment or AI SDKs.

Addendums for users in specific regions

Addendum for users in the European Union, the European Economic Area and the United Kingdom

In addition to Section J:

• The controller of your Personal Data is ELERNITY LIMITED.
• You have the right to data portability and the right not to be subject to a decision based solely on automated processing. We do not make any such decisions.
• Where we rely on legitimate interests, you have the right to object at any time on grounds relating to your particular situation.
• We do not knowingly process Personal Data of children under the age of digital consent in their member state (13 to 16) on the basis of consent; the Products and Services do not ask children for Personal Data.
• We will respond within one (1) month of receipt of your request, with a possible extension of two (2) further months because of complexity or number of requests, in which case we will inform you within the first month.
• You have the right to lodge a complaint with the data protection supervisory authority of the country where you live or work, or where an alleged infringement took place.

Addendum for users in the United States

• Children’s Online Privacy Protection Act (COPPA): the Products and Services are directed in part to children, including those aged under 13.
• Except for the collection of persistent identifiers for the sole purpose of supporting our internal operations of the Products and Services, we do not collect, use or disclose Personal Information from children under 13, and we do not allow children to make their Personal Information publicly available. If we learn that we have received such information (for example, in an email from a child), we will delete it. Parents may contact us at edacn@101.com to review or request deletion of any such information.
• The persistent identifiers include IP addresses and browser or device technical characteristics, which are collected together with the time of the request and the requested resource address (URL).
• State privacy laws (including the California Consumer Privacy Act as amended): in the preceding twelve (12) months we have not sold or shared Personal Information for cross-context behavioural advertising, and we do not use or disclose sensitive Personal Information. Subject to Applicable Laws, you may request to know, access, correct or delete Personal Information we hold about you; we will not discriminate against you for exercising these rights. You may use an authorised agent to submit a request, and we may verify the agent’s authority.
• We will respond within forty-five (45) days of receipt of your request, with a possible extension of a further forty-five (45) days where reasonably necessary, in which case we will inform you of the extension and the reasons.

Addendum for users in Canada

In addition to Section J, we will respond within thirty (30) days from the date of receipt of your request, with a possible extension of a further thirty (30) days where reasonably necessary, in which case we will inform you of the extension and the reasons. You may also contact the Office of the Privacy Commissioner of Canada or your provincial privacy authority.

Addendum for users in Singapore

In addition to Section J, we aim to respond within thirty (30) days of receipt of your request, or such other period as is required or permitted under the Personal Data Protection Act 2012. You may also contact the Personal Data Protection Commission.

Addendum for users in Australia

In addition to Section J, we aim to respond within thirty (30) days of receipt of your request, or such other reasonable period as is required or permitted under the Privacy Act 1988. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner.

Addendum for users in New Zealand

In addition to Section J, we aim to respond within twenty (20) working days of receipt of your request, or such other period as is required or permitted under the Privacy Act 2020. You may also contact the Office of the Privacy Commissioner.

Addendum for users in India

In addition to Section J, you have the right of grievance redressal: you may complain to us at edacn@101.com if your valid request is ignored, mishandled or unreasonably delayed. Where a user is a child under eighteen (18), requests should be made by the parent or lawful guardian. We aim to respond within thirty (30) days of receipt of your request, or such other period as is required or permitted under Applicable Laws.

Addendum for users in Thailand

In addition to Section J, you have the right to data portability. We will respond within forty (40) days from the date of receipt of your request, or such other period as is required or permitted under the Personal Data Protection Act B.E. 2562.

Addendum for users in the Philippines

In addition to Section J, you have the right to data portability. We aim to respond within thirty (30) days of receipt of your request, or such other period as is required or permitted under the Data Privacy Act of 2012. You may also contact the National Privacy Commission.

Addendum for users in the United Arab Emirates

In addition to Section J, you have the right to data portability and the right not to be subject to a decision based solely on automated processing (we do not make such decisions). We aim to respond within one (1) calendar month of receipt of your request, with a possible extension of a further two (2) calendar months where the request is onerous, or such other period as is required or permitted under Applicable Laws.

Addendum for users in Latin America

For users in Mexico and other Latin American countries, in addition to Section J, you may exercise your rights of access, rectification, cancellation and opposition (ARCO rights) by emailing edacn@101.com, and we will respond within the periods required by the applicable law of your country (for Mexico, twenty (20) business days).