Privacy Policy

Effective October 7, 2026

Rocko’s World (“Rocko’s World,” “we,” “us”) runs the grown-ups’ side at rockosworld.com — accounts, Treat Time parental controls, and the Rocko Pals shop — and the kids’ play site at wheresrocko.com. We built Rocko’s World to keep children’s data out of the picture: kids never create accounts, and we never collect personal information from children.

Who this covers

• Parents/guardians (adults) who register on rockosworld.com.
• Children who play on wheresrocko.com — anonymously, with no account.

What we collect

From parents (rockosworld.com):

• Account details: your email address and a securely hashed password.
• Treat Time settings you choose (limits, schedule, earn rules).
• Payments: subscriptions and Rocko Pals purchases are processed by Stripe. We never see or store your full card number.
• Basic technical data: a sign-in session cookie and standard server logs.
• Visit statistics: on rockosworld.com’s public pages we use Cloudflare Web Analytics to count visits. It uses no cookies, doesn’t track you across sites, and reports only totals (pages, referring sites, country, device type). It doesn’t run on your account pages or on the kids’ site.

From the kids’ site (wheresrocko.com):

• No accounts and no personal information. A paired device stores only an anonymous “family token” — a random identifier with no personal data.
• Anonymous gameplay events (which game, a win/solve/complete, minutes) used to run Treat Time. These are linked to a family, never to a child’s identity.

How we use it

• To provide and secure your account, run Treat Time, and process purchases.
• To operate, maintain, and improve the service.

We do not sell your personal information.

Sharing

We share data only with the service providers that help us run Rocko’s World — principally Stripe (payments), Cloudflare (hosting, infrastructure, and cookie-free visit analytics), Resend (sending account emails such as password resets), and Google Fonts (serving the site’s typefaces — your browser requests the fonts from Google, which receives your IP address), each under its own terms. We may disclose information if required by law.

Referral program (Rocko Ambassadors)

Grown-ups can share Rocko’s World through our referral (“Ambassador”) program. It stores only what’s needed to give credit and pay referrers:

• Referral cookie (rw_ref): a first-party cookie set only on rockosworld.com. It holds a referral code for up to 60 days after someone clicks a referral link, so the right person is credited if that visitor later creates an account. It is never shared with other sites and is not used for ads or cross-site tracking.
• Clicks: each referral-link click records the code, the time, the country, the browser type, and which Rocko site the link pointed to. No account or name is attached.
• Signups: if a parent creates an account after following a referral link, we record which code referred them, kept for as long as the account exists. Purchases on that account then earn the referrer a commission; we keep the amount, date, and the purchase it came from for accounting.
• Ambassadors (referrers): we store their code, name, email, and the country they live in (to choose the right tax form and payout method and to meet sanctions rules), plus their earnings and payouts. A tax form is collected before a first payout.
• Payouts: we pay commissions through our payout provider (Stripe), which receives the Ambassador’s name, contact details, and bank or payout details in order to send the money.
• Deleting your account removes you from the referral program; earning amounts are kept for our records but are no longer linked to you.
• Children: nothing referral-related is ever shown to, or collected from, children. Referral links, codes and the Ambassador program are for grown-ups only.

Ambassadors in the EU/UK: we process this data to run the Ambassador agreement you accepted (our legal basis). We keep it while you’re an Ambassador and, for payment records, for as long as tax law requires. You can ask for access, correction, or deletion at [email protected].

The Arena (optional leaderboards, 13+)

The Arena is an optional leaderboard feature for players 13 and older. It never appears on children’s sites. Joining is opt-in and requires a Rocko’s World account; the account holder confirms they are 13 or older when they join. It stores only what’s needed to run the boards, in a separate database (rockosworld-arena), keyed to your account:

• Your player profile: a display name you choose (3–16 letters, numbers or underscores) and a preset emoji icon — both shown publicly on the boards — plus the time you confirmed you’re 13+.
• Your runs: for each game you play into the Arena we store the game and board, your score, the start and finish time, and the day/week it counts toward (US Pacific time). A run that fails an anti-cheat sanity check is kept for review and never shown on a board.
• Game connections: when you connect a game, that game stores a random token in your own browser (localStorage, rocko_arena:<game>); on our side we keep only its SHA-256 hash, which game it’s for, and when it was created and last used. The one-time code that links the two is stored only as a hash and expires in about five minutes.
• What the boards show: only your display name, icon, score, and roughly when you played — never your email or anything else about you.
• Name safety & reports: every name you choose is checked for safety against word lists and, when enabled, an automated check by Cloudflare Workers AI that receives only the name text — never your email, account id, or anything else. A name awaiting a human check is hidden behind a placeholder (e.g. “Player 1234”) until an administrator approves it; we store a review status and the reason. Players can report another player’s name; we store the reported name, the reason, who reported it, and the time, and we never tell the reported player who reported them. Reports are deleted when either account is deleted.
• Rate limiting: to prevent abuse we briefly record anonymous request markers (a category label and a timestamp, deleted within a day). For redeeming a connect code, that marker is keyed to your IP address.
• Your control: “Disconnect” in a game revokes that game’s token; deleting your Rocko’s World account removes your Arena profile and runs; and an administrator can hide a player from every board.

Children’s privacy (COPPA)

Rocko’s World is designed so children do not register, and we do not knowingly collect personal information from children under 13. The kids’ site holds only an anonymous token and anonymous gameplay events. Parents set up and control everything from their rockosworld.com account. If you believe a child has provided us personal information, contact us and we will delete it.

Cookies

We use a strictly necessary session cookie to keep you signed in. We don’t use tracking cookies to profile you or your family, and we never track children. Our visit statistics (Cloudflare Web Analytics) are cookie-free.

Data retention & your choices

We keep account data while your account is active. You can permanently delete your account and all of its data anytime from your parent dashboard (“Delete account”), or by contacting us.

Your rights

Depending on where you live, you may have rights to access, correct, or delete your personal data. Email us to exercise them.

Changes

We may update this policy; we’ll revise the effective date above.

Contact

Questions? Email [email protected].

This is a preliminary policy provided for transparency and may be updated as Rocko’s World launches its accounts and payments features.