Flightless Code Ltd — Privacy Policy

Effective Date: 2 November 2026
Company: Flightless Code Ltd (Incorporated in the United Kingdom)
Contact / DPO Email: [email protected]

1. Overview & Scope

This Privacy Policy applies to all applications, web platforms, and edge services operated by Flightless Code Ltd, including:

• Kiwi Driver: Courier and delivery multi-drop route optimization application.
• Family Safety Lab (Mamoo): Privacy-first mutual family safety and location beacon.
• Battle Chess & Classic Suite: Tactical animated board games web and mobile platform.

2. Kiwi Driver Platform

Information We Collect

• Account Details: Email address, driver name, and active subscription status.
• Delivery Stops & Waypoints: Postcodes and delivery addresses entered by couriers to generate optimized driving sequences.
• Coarse Drop-off Telemetry: Anonymized road entrance coordinates quantized to ~110m (3 decimal places) to build curbside entrance caches. House numbers and personal flat identifiers are strictly stripped before saving.

Purpose & Legal Basis

We process driver data under Performance of a Contract (delivering optimized route calculations) and Legitimate Interests (improving entrance navigation for UK delivery workers).

3. Family Safety Lab (Under-13 & Family Protection)

Family Safety Lab is engineered in strict accordance with the UK Age-Appropriate Design Code (Children's Code), US COPPA, and Google Play Families Policy.

Key Safeguards

• Zero Background Tracking: We do not request or collect background location (ACCESS_BACKGROUND_LOCATION). Location queries operate strictly during active foreground sessions with a persistent, un-dismissible notification.
• Zero Advertising Identifiers: We explicitly strip the Google Advertising ID (AD_ID). We do not profile or monetize children.
• Verifiable Parental Consent (VPC): Children under 13 cannot register independently. Child profiles are created exclusively by an authenticated guardian via single-use 6-digit PIN codes. No email, password, or phone number is collected from a child.
• Mutual Transparency ("Viewed by" Alerts): Whenever a parent or guardian views a family member's location, an instant alert is sent to the group. Silent or stealth tracking is technically prohibited.
• Ephemeral Location Retention: Live GPS coordinates are stored temporarily in Cloudflare D1/KV with an automatic 15-minute Time-To-Live (TTL). No permanent historical location trail is retained.

4. Battle Chess & Classic Suite

• Peer-to-Peer WebRTC: Online matches communicate directly browser-to-browser via encrypted WebRTC DataChannels. Match moves are not processed or stored on our servers.
• Purchases: Web payments are processed securely via PayPal Business. In-app purchases are handled via Google Play Billing. We never store credit card numbers.

5. Data Retention & Account Deletion

Users have the right to request the deletion of their accounts and associated data at any time. Visit our Account Deletion Page or email [email protected]. All personal records are purged within 30 days.

6. Your Rights Under UK GDPR & ICO Registration

Flightless Code Ltd is registered with the UK Information Commissioner's Office (ICO). You hold full statutory rights under the UK GDPR, including the Right of Access, Right to Rectification, Right to Erasure, and Right to Data Portability.