Privacy & safety

Who can enter a room?

Hosts need an existing active account. Guests use a private invitation or code and wait for the owning host’s approval. Guests have no permanent account and are not asked for names, ages, diagnoses or reasons for joining. This does not make room contents anonymous.

Consent and younger guests

Your professional host explains how they intend to use MellowPlay and obtains and documents any required consent through their usual practice process. Participation is optional: ask questions, decline to join or leave the playroom at any time. MellowPlay does not collect consent forms or verify consent, age or guardianship. An invitation or admission is an access decision, not a record of informed consent.

Consent discussed or recorded in another system should cover the use of MellowPlay and its handling of temporary boards and operational records. Consent to a separate video service does not automatically cover this playroom. MellowPlay remains responsible for its own data handling and privacy obligations.

Children are an intended future audience once the release reviews below are complete. Before involving a child, the host must follow applicable consent and capacity requirements, involve an authorized parent or guardian where required, and explain the activity and privacy choices in a way the child can understand. Parental approval does not replace safeguards or override the child’s applicable rights.

The Canadian and Alberta regulators’ consent guidance discusses capacity and authorized parent or guardian consent. Alberta’s regulator does not set one fixed age threshold in that guidance. Hosts should also follow their professional requirements. This overview is general information, not a determination of consent for a particular guest.

What happens to shared activities?

Current boards support activity switching and authorized reconnects during the room. They have an expiration deadline; ending a room triggers deletion, with retry cleanup after failures. They are not saved rooms, exports, histories or progress records. Drawings and toy arrangements can still be sensitive personal information.

What information is kept?

Host/admin accounts use an email, display name and authentication records. Invitations and guest access use temporary credentials stored as hashes or protected cookies. Minimal room status/timestamps and fixed security events help operate the service.

Current application settings schedule closed-room metadata for deletion after 7 days and security events after 30 days. Inactive host accounts become eligible after 90 days without account changes, once they own no retained rooms. Active accounts remain while needed for access; administrators require operator offboarding. Expired authentication records are swept.

Cleanup depends on the worker and services being available and can be delayed. Application deletion does not establish immediate removal from infrastructure logs or backups. Their locations, access and retention must be reviewed before real use.

Who can access information?

Application administrators have bounded account and operational access, without room contents, participant credentials, impersonation or room controls. Infrastructure operators and vendors can have technical access beyond these application permissions. We do not promise end-to-end encryption, zero operator access or guaranteed deletion.

Communication and sound

MellowPlay has no built-in calls, camera/microphone capture, chat, uploads, recording, transcripts or AI analysis. Professionals use their existing systems for communication, scheduling, consent, records and care. Ending or leaving this room does not end an external call. These separate responsibilities do not remove MellowPlay’s own privacy obligations.

Optional bundled soundscapes only play locally after you enable them. Your volume, mute and off choices stay on your device. They do not capture or transmit speech.