Privacy notice

CoasterLab is operated by Cosmo Star Labs LLC, a limited liability company registered in the United States ("we", "us"). We are the data controller for the personal data described here. Questions go to support@coasterlab.kids.

Who the account belongs to

CoasterLab accounts are created and owned by a parent or guardian. Child profiles inside an account are a nickname and a train colour chosen by the family — we do not ask children for an email address, a real name, a photo, a birthday, or a location.

What we collect

• Account data — the parent's email address and login credentials, used to create and secure the account (legal basis: performance of our contract with you).
• Child profile data — nickname, train colour, and the daily Park Hours limit you set, used to run the family features you asked for (contract).
• Content you create — the coasters your family builds and any coaster you choose to share by link, stored so you can load them again (contract).
• Play-time records — the number of active seconds played per day, used only to enforce Park Hours and free daily play (contract).
• Membership status — subscription state, renewal date and the identifiers our payment provider gives us, used to unlock membership access (contract).
• Technical and security data — IP address, device and browser information, and error logs, used to keep the service working and prevent abuse (legitimate interests in security and reliability).
• Support messages — what you send us and our reply (contract and legitimate interests).

We do not run advertising, we do not use advertising or cross-site tracking technologies, we do not build behavioural profiles of children, and we never sell or rent personal data.

Payments

Our order process is conducted by our online reseller Paddle.com, which is the Merchant of Record for all our orders. Paddle handles the checkout, payment, billing, tax and invoicing, and provides customer service inquiries and returns. Card details are entered with Paddle and are never received or stored by us. Paddle processes your data under its own privacy notice.

Who we share data with

• Service providers who host our application, database and authentication.
• Paddle.com, our Merchant of Record, for the sale of the membership, subscription management, payments, tax compliance and invoicing.
• Professional advisers such as legal and accounting, where needed.
• Authorities where we are required to by law.

Retention

Account, profile and coaster data are kept while your account is open. Play-time records are kept for up to 24 months so limits and history work. Billing records are kept as long as tax and accounting law requires. When data is no longer needed it is deleted or anonymised. If you close your account, we delete account and child profile data within 30 days apart from records we must keep.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or port it elsewhere, and you can withdraw consent where we relied on it. US residents including California residents may also ask what categories we collect, request deletion, and opt out of sale or sharing — we do not sell or share personal data, so there is nothing to opt out of. Email support@coasterlab.kids and we will respond within 30 days. We will not treat you differently for exercising a right.

Security

We use appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls on our database, and least-privilege access for administrators.

Cookies and local storage

We use strictly necessary cookies and browser local storage to keep you signed in, to remember your in-progress coaster, and to count guest play time. We do not use analytics or marketing cookies. You can clear this at any time in your browser settings, though signing in will stop working until you sign in again.

Changes

If we change this notice we will update the date above and, for significant changes, tell account holders by email.