Privacy policy
Your child can play without giving us a name, age or email address. A parent can make an optional account to keep games across devices. There are no ads, and we don't sell your data.
On your device
Loftet stores games, an unfinished game, earned mascot buttons and settings. It also stores the files needed for offline play and anything waiting to be sent when you reconnect.
Games sent to us
When a game ends, including when it is abandoned, Loftet sends us a separate copy to help improve the toys. Offline games wait until the device reconnects.
The copy contains the moves, result, toy, game mode, helpers used and the day played. It also contains technical details needed to replay and assess the toy's moves. It also says whether this was the first game on the device, and the first that day. That lets us count how many play without knowing who. It also counts how often the toy fell asleep while waiting, and how many of your child's moves took over 35 or 60 seconds. That shows us whether the toys fall asleep too soon.
It contains no name, email address, account ID or device ID. It is separate from your account games. We keep these copies while we use them to improve the toys. We cannot find an individual family's copies to delete them.
Your account
An account stores your email address, an optional display name, games, mascot buttons, hidden games and bookmarks. It also stores your news preferences and records of consent, plus sign-in records for your devices.
You sign in with a code sent by email. There is no password. Your display name is not included in the separate game copies used to improve the toys.
You can change your display name and news preference in Settings.
Reporting a problem
A report includes your message, the toy you select, the page you were on, and the app and engine versions. The form removes detected email addresses and phone numbers from the message before sending it.
For a reply, enter your email in the separate field and confirm that you are a grown-up. That address goes to our support mailbox, not the stored report.
We keep stored reports for one year and delete support emails when the matter is closed.
Counts and errors
Loftet counts how many times its pages are opened each day, and when the app hits an error, it sends one line about what went wrong. Both go to our own server with no cookie, and we store no ID, no IP address and nothing about your child.
Deleting your data
In Settings:
- "Delete all games" removes saved games, the unfinished game and mascot buttons from this device. If you are signed in, it also removes the games and buttons from your account.
- "Sign out" leaves games on this device.
- "Delete the account" removes your account details and account games, ends its sign-ins, and deletes games and buttons on this device. You confirm with an email code.
Clear Loftet's site data in your browser to remove all local data. Do this on other devices too if you want to remove their local copies.
Deleting games does not recall the separate copies sent to improve the toys. Copies already waiting to be sent may still leave the device.
If you pay for the subscription
The subscription belongs to your account. You pay through Link, Stripe's payment service. You type your card number there, and it never reaches us. We give Stripe your Loftet account number and your email address, so the payment lands on the right account and the receipt reaches you. What Stripe itself keeps is in Stripe's privacy policy.
If you pay with Vipps, Sjakkpass AS sells you the subscription. You approve the agreement in the Vipps app, and Vipps takes the amount every month or every year. We give Vipps your Loftet account number, the price and what you are buying. We do not ask Vipps for your name or phone number, and we do not get them. What Vipps itself keeps is in Vipps MobilePay's privacy policy.
If you subscribe in the Loftet app on an iPhone or iPad, Apple sells you the subscription. On an Android phone, Google Play does. You pay them, and the receipt comes from them. Your card never reaches us. We get a purchase number from Apple or Google and tie it to your Loftet account, so the toys open on all your devices. We ask Apple or Google about that number to see whether the subscription is still running. What Apple and Google keep themselves is in their own privacy policies.
What we store about the subscription:
- which account it belongs to, and your customer number at Stripe or your agreement number at Vipps, or your purchase number at Apple or Google
- monthly or yearly, and whether it is active, cancelled or waiting for payment
- the day it started, and the day the period you paid for ends
- a number for each message from Stripe or Vipps we have received, and the day, so no payment is counted twice
If you withdraw from a card payment, we store a hashed print of the card and the day. If there is no card, we make the print from the email address on the payment instead. The print is not tied to the account and stays if the account is deleted, but only for 12 months. Then we delete it. That is how we see whether the same card has withdrawn in the last year, and if it has, we keep the price of the days already used. If you withdraw from a Vipps payment, you always get the full amount back, and we store no print.
If you delete the account, we stop the subscription first, so you never pay for an account that no longer exists. An Apple subscription is the exception: only you can stop it, in Settings on your iPhone or iPad. Then what we store about the subscription goes, along with the account. The payment records stay at Stripe and Vipps and in our accounts, because Norwegian bookkeeping law requires them to be kept for five years.
When you have bought, we send you one email with the terms and the withdrawal form, through Brevo, the same way as the code.
Our service providers
Cloudflare hosts Loftet. Its servers receive your IP address when you connect; Loftet does not store it with games or reports. Brevo sends account emails. These providers process the data needed to provide their services.
Your rights and contact
Sjakkpass AS is responsible for your personal data: org. no. 933 467 090, Osloveien 34A, 3511 Hønefoss, Norway.
Email support@sjakkpass.com to ask for access, correction, deletion or a copy of your personal data. You can also ask us to restrict its use or object where these rights apply. You can complain to Datatilsynet, Norway's data protection authority.
Last updated: 10 November 2026.