Effective from 15 September 2026.
Todi is a platform with games and learning for children, families, and classes. This document explains what information we collect about you and your child, why we need it, who we share it with, and how to delete it. We describe how the service actually works, not how these documents are usually written.
For the terms of use, see a separate document, User Agreement. Questions, requests to delete and download your data — use the feedback form on the website, or email info@todi.club.
The service is still under development: sections appear, change, and disappear, and so does the data we need to collect. This privacy policy will change more often than a mature service would, and it describes the situation as of the date above, not forever.
Practically speaking: do not entrust Todi with anything whose loss would hurt. We make backups and try not to lose anything, but it would be dishonest to promise data safety during beta.
Let's start with this, because it matters more than lists.
@name, interface color, an icon or an uploaded profile picture and cover. The profile is private by default and not visible to strangers.A child's account is created by an adult in the "Family" section. This account is different:
We don't verify age at registration and don't collect separate parental consent beyond the fact that the child account is created by an adult from their account. Restricting date of birth to the 3–100 year range is protection from typos, not an age limit.
We don't have object storage. Most uploads — profile pictures and covers, pictures in messages and on the board, cards, game archives, and photographs of children's work — are stored as bytes inside the database itself and end up in its regular backup. Separately, as files on the server disk, are only class board files and audio with documents from uploaded materials. Backups are handled by the server's standard tools.
There aren't many recipients, and we're specific about what goes to each.
There are four ways in. Email and password — then nothing leaves us at all. Google, Facebook or Yandex ID — then we ask the service to confirm the sign-in is yours and get from it the number of your account there, your email address and your name, and from Facebook and Yandex a date of birth as well, if you allowed it. We tell those services nothing about you. After that our own session takes over and the service takes no further part.
Only Google reports the address as confirmed — and Yandex, if the mailbox is in its own domain (yandex.ru and the like): signing into such an account is access to that mailbox. Facebook says nothing about confirmation, so we don't treat its address as confirmed and prove the mailbox is yours ourselves, by email.
Only by your explicit action. What leaves: lesson name with class name, lesson note, link to it, time, and time zone. Participant lists are never recorded in the event — otherwise Google would send invitations to addresses we didn't give it. The access refresh key is stored with us in encrypted form.
This is the most significant data transfer, and we ask you to read it carefully.
The Todi assistant runs on Google's Gemini model. When you or your child write to Todi, Google receives: the entire conversation with the assistant, age group, language, role, and the address of the open page.
Before sending, we substitute what we provide: names, @name links, and class names are replaced with tags like [[NAME1]]. But this doesn't protect free text. If a child writes "my name is Masha, I live in such-and-such a city," this goes to Google word for word.
Right now we use Google's free tier. Under its terms, conversation content may be viewed by Google employees and used to improve their products, including for training models. We consider this temporary and intend to review it, but we must tell you about it plainly right now.
The assistant is not available to everyone: it's enabled by a separate permission. If you don't want your child's data to reach Google, don't use the Todi assistant and explain this to your child.
The counter runs only where the page belongs to nobody: the home page, the catalogue, games, learning materials, the mini-school, the blog, the legal documents. In the cabinet, in a class, in chat, on the board, on the lesson screen and behind invitation links it is absent — going there switches it off rather than merely silencing it.
On public pages the following goes to Yandex: the address of the open page and its title, where you came from, information about your browser, language and screen size, your IP address, and an anonymous visitor number the counter keeps in a cookie on your device. Webvisor is on: it records mouse movement, clicks and scrolling together with whatever is visible on the public page at that moment. Your name, email, account number and anything you do in the cabinet never reach it.
You can opt out: block cookies for mc.yandex.ru, install a blocker, or turn on the data-collection opt-out in Yandex's own settings.
The emails that go through it: your support request from the feedback form, with your reply address; address confirmation; password reset; and sign-in linking (when the address that came from Facebook or Yandex matched one already confirmed here). We run no mailing lists.
If you enabled notifications, your browser's service — Google, Mozilla, or Apple, depending on your browser — can see the delivery address and the fact that a message was sent. Notification content is encrypted and is not available to them.
The conversation goes directly between participants, and when a direct connection is not possible — through our own relay server, which sits next to the platform and doesn't belong to third parties. Credentials for it are temporary, good for one hour. The public address detection server receives not a byte of the conversation. No recording is done.
Games uploaded by users may load Google fonts. This means that when opening such a game, your child's IP address and browser information will reach Google's servers. Loading third-party scripts and any requests to other external addresses from such games are forbidden by us permanently.
What parents should know: messages in classes and rooms are not moderated. A room owner can invite anyone via link, including people without an account. If your child uses classes and rooms, they may be in conversation with adults you didn't invite.
You have the right to know what data we have about you, request its correction or deletion, withdraw consent, and object to processing.
Straight up, how it works today: you can delete your account yourself — in settings, on the "Sign-in" tab. Your profile and everything attached to it is erased at once and for good: this step has no seven-day archive. There's no "download my data" button in the interface yet — write to us via the feedback form, and we'll do the export manually. A parent can delete their child's account themselves, from the "Family" section, anytime.
We understand that automatic export isn't convenience — it's your right, and we intend to add it.
We may change this policy. The date at the top of the document shows when it was last changed. For significant changes, we'll notify you in the interface.
Via the feedback form on the website, or by email to info@todi.club. We respond to requests to delete and download data.