Privacy policy

Who we are

TopCuber is a speedcubing trainer for children, operated by Robert Companies LLC. Children do not create their own login. A parent or legal guardian creates the family account and consents before a child profile is added, and before saving continues for a child profile that already exists.

Robert Companies LLC
5900 Balcones Dr, Suite 100, Austin, TX 78731
Email: topcuber@robertcompanies.com
Phone: (214) 308-5938

Information from the parent

We collect the parent's email address, a password stored only as a hash by the login provider, an optional name, and a consent record: the time, the method (email confirmation), the notice version, and the IP address of the confirmation. That IP address is a record of the request we received.

Information in a child profile

After consent, a child profile stores a nickname the parent chooses, an avatar color, and practice data: cases learned, the review schedule, algorithms chosen, drill grades, solve times, scrambles, penalties, how a time was entered, trophies, streaks, settings, and whether a session started before 7:00 or after 21:00 on the device clock. We do not collect a free-text note from the child. We also store a sign-in session on the device and internal account ids.

Hosting and database logs may include an IP address and browser type. We use those logs to run and secure the service. We do not use them to profile a child, contact a child, or show ads. The app serves its own fonts.

Third parties

These companies process information to run TopCuber. We do not sell children's information or share it for advertising.

• Supabase, through Lovable Cloud, stores accounts, the database, and login email.
• Lovable hosts the website and receives error reports that contain the error message and the page route. Visitor analytics is a switch in that hosting project. While the switch is on, the host may still receive a page view. The pages children use also remove known analytics scripts after the app loads. Removing a script tag does not undo a script that has already run, so the hosting switch has to be off.
• Resend sends the consent email, the follow-up that explains how to withdraw, and the notice to families whose saving was paused. Resend receives the parent's email address and the message. It does not receive a child's practice data.
• Stripe is not connected. If Family Pro payments are added later, Stripe would receive the parent's payment details only, and would not receive children's information.

Consent, and refusing further collection

The direct notice is shown when a parent creates an account and is included in the consent email. Confirming the link records consent to that notice version. When the notice version changes, saving stays off until the parent confirms the new notice.

Agreeing to this collection lets TopCuber collect and use the information described here. A separate consent is required before we disclose children's information to anyone for that person's own use. We do not ask for that separate consent.

A parent can refuse further collection at any time. In Who's cubing?, pause one cuber or every cuber. While saving is paused, new practice is not stored. The parent can also withdraw consent, which pauses every cuber and blocks new child profiles until the parent consents again.

How long we keep information

• Practice data, including backups, stays until the parent deletes that child profile or the whole family account. Backups are deleted with the cuber. A scheduled job also deletes backups older than 90 days and keeps at most 10 backups per cuber.
• A new account with no child profile, and no confirmed consent, is deleted 7 days after it is created.
• An account that already has a child profile and has never confirmed consent is paused at once. After we email the notice, if the parent still has not confirmed 7 days later, we delete the account and the practice data stored with it. If the email cannot be sent, we do not delete that family on this timer.
• After the account is deleted, we keep a consent archive for 3 years: the parent email, the consent method, the notice version, and the times of consent, confirmation, and withdrawal. That archive does not include the confirmation link, the IP address, or any child data. The scheduled job deletes archive rows when the 3 years are up.
• The admin action log is kept for 2 years. When an account is deleted, that parent's email is removed from the log. The list of parents waiting for a consent email is deleted 90 days after the email is sent.
• Hosting and database providers keep their own operational logs for the periods they set.

Parent choices

A parent can review practice data in the app, correct a nickname or avatar, delete one child profile, or delete the family account. Deleting a profile erases that cuber's practice and backups. Deleting the account erases every cuber. Email topcuber@robertcompanies.com to ask for the same help, or to ask a question about this policy.

Home · About & credits · Guides