Privacy Policy

Last updated: September 2026

Overview

MindBubble is hosted on servers located in Australia. All data remains within Australia and is not transferred overseas. It is not shared with any third party.

This policy covers all tools on the MindBubble platform — the collaborative mind mapping boards, the Learning Wall, the classroom games (Quiz, Poll, Globle, Times Tables Blitz, Tell the Time, Maths Blitz, Spelling Blitz, Type Ninja, Pattern Builder, Code Maze, Wordle, Word Search, Sudoku, Bubble Float, and Pixel Art), and the Rewards Shop where students spend points earned from solo games on cosmetics and site themes.

What we collect

• Teacher accounts — email address, display name, and a hashed (bcrypt) password. Plain-text passwords are never stored.
• Student sessions — students join all activities using only a display name. No email address, password, or personal details are collected from students.
• MindBubble board content — the text and positions of bubbles and connections created during sessions are stored in the database and persist until the teacher resets or deletes the board.
• Learning Wall content — drawings, shapes, text, sticky notes, images, and poll/randomizer results a teacher adds to a wall are stored in the database and persist until the teacher deletes the wall. A wall is only visible to students while the teacher is actively connected.
• Learning Wall — Presentation uploads — on a wall created as a Presentation, a teacher can upload a PowerPoint (.pptx) file, which is converted server-side into a PDF so it can be displayed and annotated slide by slide. The original .pptx is discarded after conversion; the converted PDF is stored for as long as the wall exists.
• Learning Wall — student annotations — marks a student adds to a wall are visible to the teacher but not other students. By default they are temporary. A teacher may optionally enable “Keep student work”, which stores completed annotations and locks the student's chosen display name to their anonymous device ID for that wall. The teacher chooses a retention period of 15 or 30 days and can clear the saved work sooner.
• Quiz packs — teachers create quiz packs containing a name, emoji, and multiple-choice questions with answer options. Packs are private to the teacher who created them by default. A teacher can share a pack with a private group of colleagues (a team joined via a group code); shared packs are visible only to teachers within that group, never made public. If a teacher deletes their account, their packs — including any shared with a group — are deleted.
• Poll sessions — teachers create a poll with a question and 2–6 answer options. Students vote using only their anonymous device ID (described under Cookies below) — no name or other personal detail is collected. Votes are retained until the teacher deletes the poll.
• Game sessions — session codes, question settings, student display names, and scores submitted during multiplayer games (Quiz, Globle, Times Tables Blitz, Tell the Time, Maths Blitz, Spelling Blitz, Type Ninja, Pattern Builder) are stored temporarily. Game session data is automatically deleted after 30 days.
• Aggregate usage counters — anonymous totals (e.g. how many games have been started or completed across all players) are stored server-side per game. These contain no personal information and are used only to populate the teacher portal stats panel.
• Anonymous visitor statistics — MindBubble records one visit when a browser or app session begins, rather than recording every page viewed. A one-way keyed hash of the anonymous device ID is used to count unique and returning visitors. The record contains whether the website or iOS app was used, a broad device category, and the visit date. No IP address, location, or page history is stored.
• Single-player progress and achievements — scores, streaks, best times, and achievement badges for all solo games (Wordle, Globle, Word Search, Maths Blitz solo, Times Tables Blitz solo, Tell the Time solo, Spelling Blitz solo, Type Ninja solo, Pattern Builder solo, Code Maze, and Sudoku) are stored only in the student's own browser using local storage. This data never leaves their device.
• Rewards points and cosmetics — points earned by completing solo games, and any cosmetics or site themes unlocked with those points, are stored server-side keyed by the student's device ID (the same anonymous identifier described under Cookies below) so they carry over between visits on the same device. No personal information is involved and the device ID cannot be traced back to a specific student. An equipped cosmetic (a colour, title, badge effect, or border) is visible to other players in multiplayer games; unlocked themes are visible only on the student's own device.

Cookies and local storage

MindBubble uses a small number of browser cookies and local storage items to provide the service and produce anonymous first-party visitor statistics. None are used for advertising or cross-site tracking.

• Device ID (mb_device_id) — a randomly generated identifier unique to the browser. Used to ensure only the student who created a bubble can edit or delete it, to remember votes on boards, and to track rewards points and unlocked cosmetics across games. Contains no personal information. Expires after 1 year.
• Last name used (mb_last_name) — the display name entered on the join screen, saved so it is pre-filled next time. Expires after 30 days.
• Teacher session token — stored in local storage to keep teachers signed in. Cleared on sign out.
• Visitor session — a random session identifier and last-activity time used to ensure moving between MindBubble pages is counted as one visit. A new visit begins after 30 minutes of inactivity.
• Solo game scores — best scores and streaks for single-player games are stored in local storage on the student's device. Never transmitted to the server.

Students can clear any of this data at any time by clearing their browser cookies and local storage.

How data is used

Data is used solely to operate and improve the MindBubble platform — to authenticate teachers, display boards and games to participants, persist enabled content between sessions, and understand anonymous visitor numbers by platform. It is not used for advertising or profiling individual students.

Data sharing

MindBubble does not use external analytics, tracking scripts, or advertising services, and does not share any personal data with third parties.

The Globle game fetches country flag images from flagcdn.com when a game ends to display the answer country's flag. This request contains no personal data — it is a standard image fetch, equivalent to loading any image from a website. No information about the player or their session is transmitted.

Data retention

• MindBubble board data is retained until a teacher deletes the room or resets the board.
• Learning Wall content, including converted Presentation PDFs, is retained until the teacher deletes the wall. Student annotations are temporary unless the teacher enables “Keep student work”; saved annotations then expire after the selected 15-day or 30-day period and can be cleared sooner by the teacher.
• Game session data (Quiz, Globle, Times Tables Blitz, Tell the Time, Maths Blitz, Spelling Blitz, Type Ninja, Pattern Builder) is automatically deleted after 30 days.
• Aggregate usage counters are retained indefinitely as anonymous totals. They contain no personal information.
• Anonymous visitor statistics are retained as hashed visitor profiles and compact daily totals. Short-lived session identifiers used to prevent duplicate counting are deleted after two days. Raw IP addresses and page histories are not stored.
• Rewards points and cosmetics are retained against the device ID indefinitely, and reset automatically if the device ID cookie expires or is cleared, since there is no account to link them to.
• Quiz packs, including any shared with a private group, are deleted when the teacher deletes their account.
• Poll sessions and votes are retained until the teacher deletes the poll.
• Teacher accounts and all associated data can be deleted at any time from the account settings page.

Security

Passwords are hashed using bcrypt before storage. Sessions use cryptographically random tokens. All traffic is served over HTTPS.

Contact

For privacy questions, see the About page for contact details.