Run the adventures
Remember activity, restore a learner's place, show reading and writing history, calculate summaries, and suggest a next activity.
PRIVACY NOTICE
Clear choices. Small data. Honest limits.
This notice describes what the current Super Gio code stores on a device, what can move to an optional parent account, and the choices available to signed-in parents.
Five things families should know.
- Account-free play stays on the device. Quest progress, reading records, accessibility choices, and complete Writing Workshop text use browser storage.
- Accounts are intended for parents. A parent supplies the username, email, password, and a child's first name or nickname.
- Signing in enables sync. Supported progress, reading summaries, and compact writing records can be sent to the account service.
- Complete writing is not intentionally synced. A short excerpt and surface-level metrics can sync, so children should still avoid private details.
- No commercial tracking was found. The current application code contains no advertising, third-party analytics, behavioral profiling, or data-sale integration.
Parent-supplied information and child activity are different.
The source of information matters. The list below describes the current code; it does not make a legal determination about every record.
- Information supplied by a parent
- The registration form asks the adult for a parent username, parent email address, password, and the child's first name or nickname. The child's name is information about a child, but the form is intended to be completed by the adult, not by the child.
- Information created through a child's activity
- The browser creates learning records such as completed missions, stars, scores, mastery checks, practice dates, texts marked read, rereads, and time recorded in the independent-reading tool. A child may also type original writing into the Writing Workshop.
- What remains on the device
- Complete Writing Workshop drafts and snapshots, detailed decodable-passage history, accessibility preferences, and account-free progress are stored in browser storage. Clearing site data, changing browsers, or losing the device can remove this copy.
- What parent-enabled sync can include
- When a parent signs in, the dashboard merges supported progress into the account. Current compact evidence can include a writing excerpt of up to about 150 characters, genre, draft or published status, date, and automated writing counts, plus reading totals, stages reached, rereads, a next-reading suggestion, and update time. The dashboard does not intentionally add the complete writing draft to this sync record.
- What the excerpt button does
- Reveal or Hide short excerpt changes only what is visible in the Parent Dashboard. It is not a permission or sync switch. The parent enables compact evidence sync by connecting the account.
- Routine request information
- Cloudflare handles ordinary network requests, which normally include an IP address and request headers. For rate limiting, the application derives a one-way hash from the request IP, action, and time window and stores the hash with a request count. This review did not inspect Cloudflare's live logs or settings.
Purposes stay close to the service.
Provide parent access
Create and authenticate an optional account, merge supported records, maintain a session, and help a parent recover access.
Protect the service
Limit repeated registration, login, and reset attempts; reject some cross-origin account changes; and investigate operational or security problems.
No extra commercial use found
The current application code does not use these records for targeted advertising, third-party analytics, behavioral profiling, or sale.
The visible code uses a short provider list.
- Account session cookie
- After parent sign-in, the application sets an sg_session cookie for up to 30 days. The code marks it HttpOnly, Secure, and SameSite=Lax and stores a SHA-256 hash of the session token in the account database. This describes the application cookie; live hosting or security configuration was not audited for additional operational cookies.
- Cloudflare
- Cloudflare serves the site, runs the account worker, provides network and security services, and can host the account database when the production bindings are configured. Live bindings, logs, and provider retention were not verified in this review.
- Resend
- When password-reset email is configured and a parent requests a reset, the worker sends Resend the parent's email address and a reset message. The current message includes the child's name and a one-time reset link. Reset delivery is unavailable when the provider key or sender is not configured.
- Advertising, analytics, and profiling
- No advertising network, third-party analytics SDK, tracking pixel, behavioral profiling, or personal-data sale integration was found in the current application code. This was a code review, not a live network-traffic audit.
Code safeguards are useful, but they are not a certification.
Passwords
The worker transforms passwords with PBKDF2-SHA-256, a random per-account salt, and 210,000 iterations. It does not store the readable password.
Reset links
Reset links use a random token, store a SHA-256 hash, expire for use after 30 minutes, and are single-use. A successful reset ends existing sessions.
Request controls
The code checks the origin for account-changing requests, marks API responses not to be cached, rate-limits selected actions, and asks browsers to disable camera, microphone, and geolocation permissions. Account deletion additionally requires an active parent session, the current password, and typed account confirmation.
Unverified operations
No external security assessment, incident-response process, vendor assurance review, or written information-security program was confirmed. No online service or browser storage can promise perfect security.
Current behavior is clear; a complete schedule is not yet in place.
- Device records
- Browser progress, detailed reading history, and complete writing remain until site data is cleared or the browser or device removes it. The current code does not apply an automatic deletion date.
- Parent account and remote progress
- The current worker does not set an automatic expiry for the parent profile or synced progress. A signed-in parent can permanently delete the account and its remote progress from the Parent Dashboard. A broader automatic retention schedule has not been established in the project.
- Sessions, reset records, and rate limits
- A session can be used for up to 30 days and a reset link for 30 minutes. Account deletion removes every session and reset row linked to that parent, plus the account-specific deletion throttle row. Shared one-way-hashed IP rate-limit rows are operational anti-abuse records and are not linked to a parent account. This review did not confirm their automatic cleanup schedule.
- Self-service account deletion
- A signed-in parent can open Parent Account & Privacy in the dashboard, type the username, re-enter the current password, and delete the remote account. The parent separately chooses whether to clear local learning data. Review or correction questions can still be sent to [email protected], although mailbox delivery and response operations have not been technically verified.
Choose the smallest setup that works.
- Use Super Gio without an account. Learning records stay with that browser and device.
- Use a nickname or first name. Do not enter a full legal name, school, address, birth date, or child contact details.
- Know what sign-in enables. Connecting an account syncs supported progress and compact evidence; it does not sync complete Writing Workshop drafts through the current dashboard path.
- Remove the device copy. Clear supergio.com site data in the browser to remove local progress, detailed reading records, and writing.
- Stop future sync. Sign out and do not sign back in. Signing out does not delete records already stored locally or remotely.
- Delete the remote account. Use Parent Account & Privacy while signed in. The deletion form requires the current password and typed username confirmation.
- Choose separately about this device. Account deletion leaves local learning data in place unless the parent explicitly checks the separate device-clearing option.
Child-directed learning does not create a compliance shortcut.
Super Gio presents learning activities to Grade 1 children. Its account form is intended for a parent or guardian, but the service also creates records from learning activity. The legal treatment of a particular record depends on who supplied it, how it is combined, and how the operator handles it.
What still needs an operator decision.
- Operator details. The project does not identify an operator legal name, postal address, or telephone number. The FTC says a covered online notice must provide specified operator contact information.
- Direct notice and consent. No verified direct-notice or verifiable-parental-consent workflow was established by this review. A privacy-policy link or checkbox alone is not presented as sufficient.
- Retention and security programs. Written, implemented, and periodically reviewed programs were not confirmed.
- Parent request operations. Self-service account deletion is implemented, but verified mailbox delivery, a process for other parent requests, response targets, and identity checks outside the signed-in flow remain unresolved.
- Production verification. Live Cloudflare bindings, database contents, provider logs, mailbox routing, Resend configuration, and network traffic were not audited here.