Golden Boy Labs · Privacy

Privacy

Our apps are built so your work stays on your own device. This page says, app by app, what little does leave it, why, how long it is kept, and how to have it removed. Last updated 2 November 2026.

In short

• No account and no email are needed to use any of our free apps. (Salpakan 3D lets you claim a player name for ranks and leaderboards if you want one; it needs no password and no email.)
• What you make (Gawa projects, Timpla recipes, Stratify strategies, ChipmATE files) stays on your device unless you choose to share it.
• We count visits and users without knowing who you are: network addresses are only kept as scrambled codes for a day or two, and the user count uses a random number your app makes.
• When you share something to the Tambayan (called Community outside the Philippines), it shows with the name you choose. You can take it down at any time.
• We never sell or rent personal information, and there are no advertising trackers on our sites.

What stays on your device

Gawa projects, Timpla recipe books, Stratify strategies and price files, Lipad rockets, game progress and your settings are kept in your browser's storage on your device. They are not sent to us. Clearing your browser's site data deletes them, so download anything you want to keep (Gawa: File → Save; Timpla and Stratify: their export buttons).

ChipmATE Community reads STDF test data inside your browser. Your files are never uploaded; only the visit counter and anything you type into the Community panel go online.

AgapATE Lite reads, converts and emulates test programs inside your browser. The program files you open, the converted files and the emulated STDF stay on your device and are never uploaded; like the other apps, it only adds to the anonymous counters below, and the "Request the full version" form sends only what you type into it.

Guhit (the drawing app for kids) keeps every drawing on your device only. It has no accounts, chat, sharing or ads, and it sends nothing your child draws; like the other apps, it only adds to the anonymous counters below.

Kwenta (bookkeeping, tax and payroll) keeps every business's books, contacts, TINs, employees and pay records in your browser's storage on your device. Nothing you enter is uploaded or sent to us, and Kwenta makes no AI calls. Encrypted backups are made on your device with your own passphrase (AES-256-GCM, key from PBKDF2), and exports (XLSX, CSV, BIR DAT files) are files you save yourself; we cannot open your backups or recover a lost passphrase. Clearing the browser's site data deletes the books, so keep a backup. Like the other apps, Kwenta only adds to the anonymous counters below, with no financial data. Deadline reminders are worked out and shown on your device; if you tap "Add to Google Calendar", only that deadline (form, period and due date, never your business details) goes to Google.

AralAI (AI-literacy courses) keeps your progress, quiz and exam scores, name and certificates in your browser's storage on this device; nothing is uploaded and there are no accounts. Certificate IDs are checked on the verify page inside your browser. Export and import move your progress as a file you control. Like the other apps, it only adds to the anonymous counters below.

Parokya Ko demo (the try-out at /parokyako/) keeps the sample parish, your design, any logo you add, and the requests and family registrations you try in your browser's storage on your device; nothing is sent while you try it. Only if you press "Send this design to Golden Boy Labs" do we receive what you type in that form (name, role, parish, email, optional mobile and message) and the design (with the logo if it is small). We use them only to reply to you about your parish's app, keep them with the request, and delete them when you ask (privacy@goldenboylabs.dev). Like the other apps, it only adds to the anonymous counters below.

Programs you write in Gawa → Programming run in your browser with no internet access.

Counters (visits, installs and users)

So we know which apps people use, each app tells our server, at most once per day, that it was opened (and whether it runs as an installed app). The server turns your network address into a scrambled code mixed with the date, uses it only to avoid counting you twice that day, and deletes it after two days. It also keeps the country your network is in (from our hosting provider), to know where the apps are used and to show "Tambayan" in the Philippines.

The "people use it" count works with a random number the app creates on your device. The server stores only a scrambled version of it, so it can count each device once. It cannot tell who you are. Public badges appear only from 100 users and are rounded.

Tambayan / Community (shared designs, recipes, ideas)

When you choose to share something, we keep: what you shared (for example a Gawa design, a Timpla recipe and its photo, a Lipad rocket, a Stratify strategy, an idea), the name to show (a first name or nickname), and anything optional you add (a note, a city, a country, a school). We also keep a private key that lets you, on the same device, check its status or take it down, and a scrambled code of your network to stop spam.

Every share is checked before anyone sees it (see the community rules). Once approved it is public: anyone can open it, and it may appear in the apps and on goldenboylabs.dev with your name. Counts of how often it was opened, liked or cooked are kept to make the top lists.

Please don't put your full name, phone number, email, address, or anything private in what you share.

Gawa class spaces

A teacher can make a private class in Gawa's Tambayan / Community and give students a join code. What is posted in a class (the teacher's starter designs and students' work, with the name each person chooses and an optional note) is kept on our server and shown only to people with that class's code; the teacher sees everything, and students see each other's work only if the teacher allows it. The class name, school and country the teacher enters are kept with it. The teacher's key and the code that lets a student delete their own post are stored only in scrambled form. Nothing from a class becomes public unless the teacher chooses Make public; it then follows the Tambayan / Community rules above. Anyone with the code can see the class, so teachers can make a new code at any time. Teachers, students and parents can ask us to delete a class or a post at privacy@goldenboylabs.dev.

Leaderboards

When you choose a leaderboard name in a game, your results (points or wins, and the time) are kept with that name and a scrambled code of the random number your app made, so your points add up. Rude names can be reported; three reports hide a name until we look at it.

Salpakan 3D: player names, ratings and ranks

Playing Salpakan needs nothing from you. If you claim a player name (for rated battles, missions that earn rank points, a military rank and the leaderboards), we keep:

• The name you chose, shown publicly on the leaderboards and your profile, and a country taken from your connection when you sign up (from our hosting provider; you can correct it once). We show it as a flag.
• A scrambled code of the private key the game made on your device, and a scrambled code of your recovery code. We never keep either one itself, so we cannot tell you your recovery code if you lose it.
• Your rating, rank points, rank, badges and record (wins, losses, draws, missions cleared, the Daily Mission streak), and a history of rated battles and every rating change (when, against whom or which computer level, how it ended, and why a battle was not rated). The history is kept to keep the ratings fair; your public profile shows a rating graph from it.
• For the limits that stop abuse (new names per network, recovery tries, reports), a salted daily code of your network address, deleted after two days.

Rated battles and missions that count are played through our server, which runs the arbiter and holds the hidden ranks while the battle lasts. Battles against the computer played offline stay on your device and are not sent. Names reported as rude by three networks are hidden until we look at them. To delete your player, email privacy@goldenboylabs.dev with the name.

Salpakan tournaments

Tournaments are public pages that anyone can open without an account. For each tournament we keep, and show publicly:

• The tournament details the organizer entered: its name, the organizer's name and type (school, club, community or other), the description, start time, settings and prizes text, and the organizer's player name. The country comes from the organizer's player.
• The entrants (player name, flag, rating and rank when they joined, seed) and the results: the bracket, every match score, every game (who won, how, and in how many moves), no-shows, forfeits and the organizer's decisions, and the champion.

Tournament games are rated games: they go into your rating history like any other. The join code is shown only to the organizer. For the limits against guessing codes we keep a salted daily code of your network address (and of your player), deleted after two days. Spectators send us nothing; their view of a game is the same for everyone and never shows a hidden rank before the game ends. Organizers who want a tournament taken down, or players who want their name removed from a finished bracket, can email privacy@goldenboylabs.dev; the results stay with the name replaced.

Accounts, Premium, payments and the waitlist

The free apps need no account. Premium features (Kwenta Premium, AralAI for schools and companies, Salpakan Organiser) need one, and they are not on sale yet. When they are:

• Your account is your email address, signed in with a one-time code or link we email you (no passwords). We keep the email, when the account was made and last used, your plans and receipts, and, only if you add them for a business receipt, a name, TIN and address. Sign-in sessions are kept as scrambled codes.
• Payments are handled by a licensed payment provider (PayMongo, or Xendit). You pay on their page; we never see or keep your card, GCash, Maya or bank details. We receive whether you paid, the amount, the method (for example "gcash") and their reference, and keep an invoice record with a receipt number.
• Licences: a signed licence file is saved in your browser so the apps can unlock Premium offline. It holds your account number, plans, limits and expiry; no email, and none of your app data. Apps check it on your device: your Kwenta books and AralAI progress are never sent to check your plan. A signed-in device asks for a fresh licence about once a day.
• Kwenta cloud backup (Premium, optional): each backup is encrypted on your device with your passphrase before it is uploaded. We store only the encrypted file, in Cloudflare R2 (storage with an Asia-Pacific location hint), with the size, time, app version and the device name you chose; we never receive the passphrase, cannot open the backups and cannot recover a lost passphrase. We keep the last 30 daily and 12 monthly versions of each business; they are deleted with your account, or 90 days after your Kwenta plan ends (the account page warns you 30 days before).
• AralAI organisations: if your school or employer gives you a code and you join, you choose to share a summary with your organiser: your name as you type it, topics done, best final-exam score and certificate per track, and when you last studied. Nothing else. Leave at any time in AralAI → Settings, and your shared summary is deleted. A verified certificate puts its name, track, date, score and organisation in our register, so anyone with the ID or QR code can check it.
• Salpakan Organiser: you can link your player to your account so tournaments know your plan.
• The waitlist: if you join it, we keep your email, which apps you are interested in and when you agreed, and use it only to tell you when Premium opens. Ask us to remove you at any time.

You can delete your account on your account page. Receipts are kept without your email for as long as tax rules require.

Ask Golden Boy (the assistant)

Questions you type to Golden Boy, on the website or inside an app, are sent through our server to Anthropic's Claude service to write the answer. We don't store the conversation; it stays in your browser until you close the panel. We count how many questions each network asks per hour (using a scrambled code) so the service isn't overused. Please don't share passwords or personal details with Golden Boy. Anthropic's handling is described in its own privacy policy.

Gawa designs shared to the Tambayan are also read by the same service for the instant check (a summary of the design, its title and note, not your device or network details).

Forms and email

When you contact us, register interest in custom software, join the Salpakan early-access list, or leave a review, we keep what you send (for example your name, email and message) to answer you and do what you asked. Reviews show only the name and words you agree to show. We don't add you to any mailing list unless you ticked the box for it.

If you are under 18

You can use all our free apps without giving any personal details. Before you share something to the Tambayan or join a leaderboard, ask a parent, guardian or teacher. Use a nickname, and leave your school blank unless an adult says it's OK. Parents and teachers can ask us to remove anything at privacy@goldenboylabs.dev.

Other services our pages use

• Cloudflare hosts our websites and server; like any host it handles your network address to deliver the pages.
• Google Fonts serves some of the fonts on our pages.
• jsDelivr serves Python for Gawa → Programming, downloaded once when you first run Python.
• Anthropic (Claude) writes Ask Golden Boy's answers and does the instant check of shared Gawa designs.
• GitHub (private) keeps a weekly backup copy of the shared community content and the counters, so nothing is lost if something goes wrong.

How long we keep it

• Scrambled network codes: 2 days. Daily visit totals: kept as totals, with no codes.
• The scrambled device code for the user count: kept while the app is in use.
• Shared items: until you take them down, or we remove them. Leaderboard results: up to 400 days.
• Salpakan players (name, rating, record and rating history): while the player is in use; ask us to delete it at any time. A player with no battles for two years may be removed. Tournaments and their results: kept as a public record, until the organizer or a player asks us to remove them.
• Messages, interest forms and reviews: as long as needed to answer and keep records, then deleted on request.
• Accounts: until you delete the account. Waitlist emails: until Premium opens and we have told you, or you ask to be removed. Receipts and payment records: as long as Philippine tax rules require (without your email once the account is deleted). Kwenta cloud backups: the last 30 daily and 12 monthly versions, until you delete them or the account, and at most 90 days after your Kwenta plan ends.
• Backups: the last 8 weekly copies.

Your choices

• Take down what you shared: open the app's Tambayan / Community → My shared … → Take it down (same device).
• From another device, or anything else (a leaderboard name, a review, your messages): email privacy@goldenboylabs.dev with the link or name, and we remove it.
• Stop being counted: clear the site's data in your browser; the app will then count as a new device if you use it again.

We follow the principles of the Philippine Data Privacy Act of 2012 (transparency, legitimate purpose and proportionality). You can ask what we hold about you, ask us to correct or delete it, or object to how we use it.

Contact

Golden Boy Labs · privacy@goldenboylabs.dev · General questions: hello@goldenboylabs.dev

Community rules · goldenboylabs.dev