Shhquad

Privacy

Last updated 12 October 2026

Shhquad is a study room for children and the friends they already know. We built it to collect as little as possible.

What we never ask for

• Children never need an account or a sign-up.
• We never ask a child for a name, email, phone number, password, photo or location.
• Names in rooms are made up by Shhquad from a colour and an animal (for example “Blue Dolphin”).

What stays on your child’s device

Their character, the made-up name, the timer, focus beans, unlocked places and clothes, saved room codes and the study record (minutes per day and per subject) are stored in the browser on that device. We can’t see them unless you use one of the two options below. Clearing the browser’s site data for shhquad.com deletes the copy on that device.

Moving to another device (move code)

If you tap “Move to another device”, that progress is sent to our server and kept under a 6-character code for up to 1 hour. It is deleted as soon as the code is used once, or after 1 hour, whichever comes first. The code travels inside the request, not in the web address.

Saving with a parent’s email (optional)

• A grown-up can choose to save the progress with their own email, so it can be brought back on any device. Children are asked to fetch a grown-up first.
• To sign in we email a 6-digit code. Cloudflare delivers that email for us, so it sees the address in order to send it. It’s the only email we send: no newsletters, no ads.
• Our server doesn’t keep the email address. It keeps a one-way scrambled form (a keyed hash) that can’t be turned back into the address, so we can’t read your address or write to you later.
• What we keep: each child’s progress (the items listed above, under the made-up name) and a random code for each device that saves. When the same child uses two devices, their progress is combined.
• Delete it any time: sign in again in the app and choose “Delete everything saved with this email”, or delete one child’s save. If nothing is saved or opened for 400 days, we delete it automatically.
• To stop guessing, we limit how many codes one email and one network address can request or try. The address is used only for that count; we don’t keep it.

What passes through our server during a room

When friends are in the same room, our server passes these between them: the made-up name, the character’s look, the timer status (focusing or on a break, the subject, minutes left, whether they have stepped away) and emojis, plus which place the room is in. There is no chat, so there are no messages to pass. This is held only while the room is open; when the last person leaves, the room is cleared.

To stop people guessing room codes, the server counts how many rooms one network address tries to open or join in a minute. The address is used only for that one-minute count; we don’t keep it. We have turned off server request logs.

Visit counts

We count visits with Cloudflare Web Analytics: page views, the country and the kind of device and browser. Cloudflare says this does not use cookies or fingerprinting. We see totals, not individual visitors.

What we don’t do

• No advertising and no third-party trackers.
• We don’t sell or share data.
• Nothing can be bought. Focus beans can only be earned by focusing.

Who runs it

Shhquad is made by a dad in New Zealand and hosted on Cloudflare. Questions: hello@shhquad.com.