Duditopia is a free games website for the whole family (Mi Súper, Mi avatar, Mis criaturas and a live trivia game), with channels on YouTube, Twitch and TikTok. The site is in Spanish; this is the English version of our privacy policy. It explains, without fine print, what data we process, why, for how long and how you can ask us to delete it.
Who is responsible
Duditopia is a non-profit personal project run by a private individual living in Spain (on this page, "the Duditopia operator", "we" or "us"). There is no company behind it. For anything about your data, write to [email protected].
In short
- No accounts, no sign-up, no ads, no tracking cookies and no third-party analytics tools.
- Progress in the kids' games (Mi Súper, Mi avatar, Mis criaturas) is stored only on your device.
- If you play the trivia game, we store your player name and points for the public leaderboard. You can ask us to delete them.
- We do not sell or share data with anyone, and we never send any of your data to any artificial intelligence.
What data we process, why and for how long
1. When you visit the website. The site is served from our own server in Spain through Cloudflare (a content delivery and security network). To deliver the pages, Cloudflare receives your IP address and the technical details of the request, and may give us aggregated statistics (for example, visits per day or per country) that do not identify you. Our server records each request in a technical log without your IP address or browser details: only the date and time, the page requested and whether it worked. We use it only to fix errors; it does not identify anyone and it deletes itself (only a few megabytes of recent entries are kept).
2. Anonymous play time. When you leave a game, the page sends only which game it was and how many seconds it was open and visible (for example, "Mi Súper, 240 seconds"). No identifier is sent and nothing is stored on your device for this: we only add up, per game and day, how many sessions there were and how long they lasted, to learn which games people enjoy. To prevent abuse we limit submissions per connection using a temporary fingerprint (a keyed hash of the IP address with a key that changes every day) that exists only in memory and is wiped every night.
3. What is stored on your device. Mi Súper (shops, coins, settings), Mi avatar, Mis criaturas and stars,
whether sound is on, and the age you pick on the home page are stored in your browser's local storage
(localStorage). That data never leaves your device and never reaches us. You can delete it at any
time from your browser settings ("clear site data"); doing so erases the progress.
4. Mi Súper for two. If two devices play together, the game state goes through our server only while playing, using a 4-digit code that must be accepted on the device that owns the shop. There is no chat and no names: only game actions and a few fixed reactions (emojis). The game lives in memory and is deleted automatically when you stop playing. To curb abuse, the IP address is used in memory for one minute at most and is not stored. We only count how many two-player games are created each day.
5. The live trivia game (on the website at /jugar, in the Twitch chat or in the YouTube chat):
- On the website you choose a player name (3 to 16 characters; do not use your real name). Your device stores that name and a random identifier to recognise you in the next game.
- On Twitch or YouTube we use your public username, your display name, the public identifier of your account on that platform and the text of messages that are game answers or commands. The rest of the chat is not stored: it is processed on the fly.
- We store your points, correct answers, streaks and wins with that name to show the leaderboards, which are public on the stream, on the website and in the chat.
- If you report a mistake with
!reportar, we store the report, the question and your username to review it. - To stop anyone playing with many identities, each question limits the number of players per connection using the IP address only in memory, without storing it.
Legal basis: our legitimate interest in offering the game you choose to join. Scores are kept for as long as the game exists, to keep the leaderboards; reports, for as long as they help fix questions. You can ask us to delete them at any time.
6. If you email us. If you write to [email protected], we receive your email address and whatever you tell us. Mail is forwarded by Cloudflare to a Gmail (Google) mailbox. We use it only to reply and delete it when it is no longer needed for your request.
Children and families
- The kids' areas (Mi Súper, Mi avatar and Mis criaturas) have no accounts, no chat, no ads and no forms, and never ask for names, photos or any personal data.
- Their progress is stored only on the device. All we receive is the anonymous play time and, when playing for two, the game actions while the game lasts.
- The live trivia game and its chat are for the whole family, but writing in the Twitch or YouTube chat requires an account on that platform, with its own minimum age. In Spain, children under 14 cannot consent to the processing of their data on their own: if they are under 14, they should take part together with an adult.
- Videos aimed at children are marked "made for kids" on YouTube, so YouTube limits their features (for example, comments).
- If you think we hold any data about a child that we should not, write to us and we will delete it.
Cookies and local storage
Duditopia's public pages do not use cookies: no advertising, analytics or tracking cookies. We only use the browser's local storage as explained in point 3, which is technical and stays on your device. The private admin panel uses one technical session cookie for the operator only.
Please note: the /directo page shows the Twitch player, and links to videos open YouTube or TikTok. Those services may set their own cookies and apply their own policies, which we do not control (links below).
Our YouTube, TikTok and Twitch accounts (use of their APIs)
Duditopia uses these platforms' APIs only to manage its own accounts. Website visitors never sign in with them or give us access to their accounts.
- YouTube (YouTube API Services). With the YouTube API we upload our videos to our own channel (with title, description, thumbnail and subtitles), manage our live streams, read the chat of our own live streams so the game works, and check our channel's statistics. From viewers we only process what they write in the chat of our live streams, as explained in point 5. We do not share that data with anyone. When you use YouTube, the YouTube Terms of Service and the Google Privacy Policy apply. Any access granted to an application can be revoked on Google's security permissions page.
- TikTok (Login Kit and Content Posting API). The operator connects only Duditopia's own TikTok account from the private admin panel to send our own videos (as drafts or posts). With that permission we read, from that account only: the basic profile (identifier, display name and avatar), its statistics (followers, following, likes and video count), the list of its videos with their view, like and comment counts (numbers only) and the posting options. They are shown only in the private panel. The access token is stored on our server, in a private file that is not shared; it renews automatically and expires after one year at most. Clicking "Disconnect" in the panel revokes access on TikTok and deletes the token; permission can also be removed from the security settings of the TikTok app. We do not access data of other TikTok users. TikTok Privacy Policy.
- Twitch. We stream the trivia game at twitch.tv/duditopia and read its chat for the game (point 5): the usernames of players appear on the stream and in the leaderboards. We also read aggregated numbers about our channel (viewers, followers). Twitch Privacy Notice.
Who data is shared with
We do not sell or share data, there are no ads and we send no data to any AI. Only the services needed to run everything are involved: Cloudflare (website delivery and email forwarding), Google (YouTube and Gmail), Twitch and TikTok. Some are companies outside the European Union that process data under their own policies and safeguards for international transfers. The trivia leaderboards are public by nature.
Artificial intelligence
We use artificial intelligence (Claude, by Anthropic) to prepare content before publishing it, but we never send any of your data or children's data to any AI. More in How we make our content.
Security
The site always uses HTTPS. Platform access keys are kept on the server in restricted-access files. We keep the bare minimum: almost everything works on your device or in memory and is deleted automatically.
Your rights and how to delete your data
You can ask to access, correct or delete your data (including your score), or to object to or restrict its use, by writing to [email protected] with your player name and platform (website, Twitch or YouTube). We will reply within one month at most. Data stored on your device can be deleted by you from your browser. If you are not satisfied, you can complain to the Spanish Data Protection Agency (aepd.es) or the authority in your country.
Changes
If we change anything important, we will update this page with its date. If the Spanish and English versions differ, the Spanish version prevails. More: Terms of use · How we make our content.