Privacy notice

The short version

• Kids can start SLICE! Episode 1 without signing in. A parent or guardian signs in or allows the device at the first choice so reading can continue. A kid link from the parent account also allows reading. We don’t ask kids for a name, email, or photo.
• Your account keeps your kid’s reading progress (how far they read, the endings, the choices and fractions in the report) so we can show it to you and email you a short report after an ending. We use it for nothing else.
• The comic also counts taps and records the screen anonymously under a random id that goes away when the tab closes, to improve the story. No ads or ad trackers run in the comic.
• Meta’s ad pixel runs only on the pages for grown-ups who are choosing: our home page, Browse, For parents, How it works, Pricing, and the series pages (SLICE!, RAMP, MIX, PUSH, FIZZ, and LOOP). Never in the comic, never in your account.
• Parents can sign in with an email and password, Google, Facebook, or an email sign-in link. We never ask for card details. You can delete your account, and everything tied to it, from your account page.

Children’s privacy (COPPA)

SLICE! is made for children, so the US Children’s Online Privacy Protection Act (COPPA) applies to the comic.

• We don’t ask a child for personal information. The story has no chat or open-ended text answers. Kids can share a reading request or a link to what comes next with a grown-up.
• Your consent comes first. Reading progress is tied to an account only after a parent or guardian, 18 or older, signs in and allows reading. Before any progress is saved, you confirm that you’re a parent or guardian, 18 or older, and the sign-in screen explains that the account keeps your kid’s reading progress for your reports. On another device, you also approve the reading request when asked. Every new account gets one welcome email that explains what we keep and how to delete it.
• What we keep about your kid: a made-up reader name we generate (like “Comet Fox 27”, never a real name), which hero they read as, where they stopped, their choices and answers, hints used, and endings found. Ending reports include how many fraction challenges they solved on the first try. We don’t collect open-ended text answers, photos, voice, or location.
• How we use it: only to run the comic, to show you their progress on your account page and to email you a report. We don’t use it for ads, we don’t share it with Meta or any other ad company, and we don’t sell it.
• Anonymous screen recording of the comic: to see where the story is hard to follow, we record how the comic screens are used (the scenes shown, taps and scrolling) under a random id that the browser tab keeps for at most 6 hours and deletes when the tab closes (a tab the browser restores or copies can keep it until then). It is not linked to your account, to the kid link or to any recording of a grown-up’s visit, and the comic’s analytics sent with it leave out the tab’s session id. Anything typed and the grown-up screens inside the comic are hidden. It runs in the US and Canada (outside Quebec), or where a grown-up allowed analytics on this device, and never when the browser sends Global Privacy Control or analytics was turned off here. To know the country, each comic page asks our own server; nothing about it is stored. We keep the recording for 30 days in PostHog’s EU cloud. We use it only to improve the comic, never for ads.
• The kid link you can send from your account opens the comic on your kid’s device with no sign-in. It holds a random code that lets that device read and save progress for your account. It can’t see your email or your account settings. You can turn it off, or replace it with a new one, at any time.
• Unlocking the comic on your kid’s device: if you create an account or log in at the comic’s first choice on your kid’s device, you stay signed in to your account on that device until you sign out there. While you are signed in, that device can open your account page, and turning it off on your account page doesn’t sign you out of it.
• The story shows no prices or payment forms. To create an account or continue at checkout, an adult presses a button under the line “By continuing, you confirm you’re a parent or guardian, 18 or older”. We never ask for a year of birth.
• Deleting: “Delete my account” on your account page deletes your account, the kid link and all reading progress and reports at once. You can also write to us (see “Your choices”).

On the comic screens

These are the pages your kid uses: the start screen and the episode, including its story choices, fraction challenges, and endings.

What we collect

• Reading progress for your account (see “Children’s privacy” above), sent to our database while your kid reads.
• A random session id for analytics. The browser tab makes it, and it goes away when the tab closes. It is not linked to your account.
• Taps in the story for analytics: the scenes your kid reached, the choices and fractions they picked, how many hints they asked for, and the ending they reached.
• An anonymous screen recording of the comic under its own random tab id (see “Children’s privacy”). It hides anything typed and is not linked to your account.
• Campaign tags from the ad link, if you arrived from an ad (for example, which campaign it was). They name the ad, not you.

Where it goes

Reading progress goes to our database (Supabase), through our own web address. The analytics taps go to PostHog, our analytics service, in its EU cloud, also through our own web address. We set PostHog to drop IP addresses and to skip heatmaps and automatic click tracking. The comic’s anonymous screen recording goes to PostHog too and is kept for 30 days. Fonts and pictures load from our own site.

What stays on the device

• Your sign-in, or the kid link’s random code, until you sign out, turn the link off or clear this site’s data.
• The endings your kid found (ending names only), until you clear this site’s data.
• Reading progress, including choices, answers, and hints, so reading can continue after the tab closes. Clearing this site’s browser data removes the local copy.
• A random id for the comic’s anonymous screen recording, and the few seconds of recording waiting to upload, for at most 6 hours. Closing the tab deletes them.

What we never collect from your child

Name, email, photo, voice, location, or contacts. The comic loads no Meta pixel, ads, or third-party advertising trackers.

Your Ahaboom account

What we store

• Your email, and that you confirmed you’re a parent or guardian, 18 or older.
• Sign in with Google is optional and for parents only. Google gives us your name, email address and profile picture link; we use only your email and name.
• Sign in with Facebook is optional and for parents only. Facebook gives us your public profile and email address; we use your email and name to create and manage your account. You can delete your account and its data using the instructions under “Your choices” below.
• Whether you ticked the news box, and the plan you picked on our pricing page, if any.
• Your kid’s reading progress and reports, as described under “Children’s privacy”.
• The welcome and report emails waiting to be sent to you.

What we never collect

Card details. Passwords are handled by Supabase Auth and are not stored in our application tables.

Emails we send

One welcome email when you create an account, saying what we keep and how to delete it. If you sign up with an email and password, we may also send a link to confirm the address. Sign-in or password reset links when you ask for one. After your kid reaches an ending, a short report, at most one a day. News about new episodes only if you ticked the box.

The Episode 2 email list

• The grown-up check stores a 30-minute pass on this device.
• If you type your email on the Episode 2 form, we store it with: whether you came from a plan or the free link, the plan and price you picked (if any), whether you ticked the news box, the sign-up date and the confirmation date. This list is separate from accounts.
• We store nothing from your child’s play next to that email.

Emails we send

First, one email asks you to confirm the address is yours. If you don’t confirm within 14 days, we delete the address, unless you gave it at checkout (“Continue to payment”): that address stays on the early-access list until you ask us to remove it, for 12 months at most. After you confirm, we email you once when Episode 2 is out, and about new episodes only if you ticked the box. Every email has an unsubscribe link.

Meta (Facebook and Instagram ads)

• Meta’s pixel runs only on our home page, Browse, For parents, How it works, Pricing, and the series pages (SLICE!, RAMP, MIX, PUSH, FIZZ, and LOOP). On each it records a page view, and one “view content” event when you tap “Get your kid’s free episode” (on the SLICE! page, “Read Episode 1 free”).
• It sets two cookies on our site: _fbp, a random browser id, and _fbc, Meta’s click id when you arrived from an ad.
• We remove the click id (fbclid) from the address bar. When advertising is allowed, we keep it with the first campaign’s tags so we can connect a parent’s sign-up to the ad that brought them here.
• The pixel doesn’t load on the comic, on the grown-up screens after it, on the sign-in pages or your account page, on Help, About and Terms, or on this page.
• It loads only when advertising is allowed (see “Cookies and analytics”), and stays off when your browser sends Global Privacy Control.
• For parents in the US, when advertising is allowed, our server can report a new parent account registration to Meta through its Conversions API, including whether you signed up with email, Google or Facebook. It reports a saved membership checkout intention and your selected plan separately; this is an expression of interest after seeing the price, not a payment.
• These server reports include a one-way SHA-256 hash of the parent’s email, the _fbp and _fbc values when available, the browser’s user agent and the request’s IP address. Meta can use the hash to match the report to an account. We do not send the plain email, or anything about your child.
• The reports use our site’s home address, without a page query or sign-in code. Global Privacy Control stops these reports. Starting a comic does not send a sign-up report: a parent must complete the account or checkout action first.

Measuring parent sign-ups and checkout interest

When optional analytics or advertising is allowed, we can keep the first visit’s campaign tags on this browser for up to 90 days. They help us understand which ad led to a parent’s account or saved checkout intention. We do not collect these tags from the comic.

When analytics is allowed and Global Privacy Control is off, our server reports new parent account registrations and saved membership checkout intentions to our marketing dashboard, MCR. It receives whether you signed up with email, Google or Facebook, or selected a monthly or yearly plan, along with a random conversion ID, campaign tags, country, device type and, when available, a PostHog session ID, which links the report to the recording of that visit if there is one. A Meta click ID is included only when advertising is also allowed. MCR does not receive the parent’s email, name, phone number, a hash of them, or any child’s reading data. Logging in, resetting a password or joining the Episode 2 email list does not count as one of these conversions.

Cookies and analytics

• Necessary storage keeps sign-in, your cookie choices and reading progress working. It is always on.
• PostHog counts page visits and taps on every page, the comic included, without cookies. It never gets the part of a web address after “?” or “#”, where sign-in links keep their codes.
• Visit recordings (part of optional analytics): PostHog records how a visit moves through our pages for grown-ups: page changes, scrolling and taps, so we can see where the site is hard to use. Everything typed is hidden. On the sign-in, account, checkout and confirmation pages all text is hidden too, including the labels on buttons and pictures, and the kid link is never recorded. Recorded pages don’t share the comic’s session id, so a recording can’t be joined to what happens in the comic. For this, PostHog keeps a random ID in this browser’s storage instead of working without one. These recordings never include the comic, and they stay off when your browser sends Global Privacy Control. We keep them for 30 days. The comic has its own anonymous recording, described under “Children’s privacy”.
• Analytics (optional): Google Analytics shows us which pages parents visit and where they came from. It sets _ga cookies.
• Advertising (optional): Meta’s pixel tells Meta when someone from our ads visits, so we can measure the ads (see “Meta” below). It sets _fbp and _fbc cookies.
• Google Analytics and Meta’s pixel run only on our pages for parents: Home, Browse, For parents, How it works, Pricing, and the series pages. Never on the comic, your account, the sign-in pages, or this page. Advertising stays off when your browser sends Global Privacy Control.
• In the US and Canada (outside Quebec) optional analytics, visit recordings included, and advertising are on until you turn them off. Everywhere else they stay off until you choose, and a banner asks.
• Change your choice at any time with “Cookie settings” at the bottom of our home page. We keep your choice for 180 days. Turning something off removes its cookies. Turning analytics off also stops visit recordings and removes PostHog’s stored ID.

Global Privacy Control

If your browser sends a Global Privacy Control signal, we treat it as an opt-out. Meta’s pixel doesn’t load, and our server doesn’t report your account or checkout intention to Meta or MCR.

The Facebook and Instagram app browser

If you tap our ad inside the Facebook or Instagram app, SLICE! opens in that app’s own browser. Meta runs that browser and can see the pages it shows, the comic included. We can’t switch that off.

For more privacy, use the app’s menu to open SLICE! in Safari, Chrome, or another browser you use. The available options depend on your app and device.

Who handles the data for us

How long we keep data

Your choices

• On your account page: see your kid’s progress, turn off the kid link, or delete your account and everything tied to it.
• Write to hello@bomilab.com to ask what we hold about you or your kid, or to have it deleted. We reply within 30 days.
• Use the unsubscribe link in early-access and episode-update emails to stop those updates. Requested sign-in links and account-related emails are separate.
• Clear this site’s data in your browser to remove the endings and story progress from a device.
• Use “Cookie settings” at the bottom of our home page to turn analytics or advertising on or off.
• Turn on Global Privacy Control in your browser to keep Meta’s pixel off.

The analytics taps from the comic carry no name or email, and we never connect them to your account. They expire after 12 months.

Contact