What we keep, what we don't.

This is a U.S.-focused educational reference about the historic Oregon Trail. It is built for a general audience — parents, teachers, and students — and is not directed to children under 13. You can read every page without an account; an account is only useful if you want to keep your quiz history across devices.

• No behavioural advertising, no tracking pixels, no data sales.
• One first-party analytics tool (Google Analytics) with IP anonymisation and ad features off.
• Account sign-up is age-gated to 13+. Reading and quizzes do not require an account.
• Game reviews are the one feature that requires a Google sign-in — for spam protection.
• There is also a fully-offline local profile option that stores nothing on our servers.
• Parents: see Children under 13 below for how to remove data.

The Oregon Trail Archive (independent editors). The archive is non-commercial and built by independent editors and volunteers; it is not affiliated with MECC, The Learning Company, any school district, or any government body. Postal address available on request via the contact email. Privacy questions: contact@oregontrail.ws.

• We do not sell, rent, or share personal information with advertisers, data brokers, or third-party marketers. We have never received money for personal data and we do not intend to.
• We do not use behavioural advertising, retargeting cookies, or cross-site tracking pixels.
• We do not knowingly collect any personal information — name, email, phone, geolocation, photo, voice, persistent identifier — from a child under 13. The neutral age screen at sign-up exists precisely to prevent that. See the section below.
• We do not use social-media share buttons that contact Facebook, X, TikTok, or similar networks on page load.
• We do not fingerprint your device, profile your browsing across sites, or build advertising audiences.

We collect the smallest amount of information needed to run the archive. Everything below applies only to users who self-identify as 13 or older, except for anonymous analytics which apply to all visitors.

• Anonymous analytics. If a visitor has not opted out, we use Google Analytics 4 to count page views and referrers. IP addresses are anonymised at collection (the last octet is dropped before storage), Google Signals is disabled, advertising features are off, and ad personalisation / ad storage are denied by default. We use the data to understand which pages help readers and which do not. We do not export this data to any other product.
• Account data — 13+ only. If you choose to create a Google-backed account, we store an email address (used for sign-in and account recovery), a display name you choose, and the timestamps of your activity. Authentication is handled through Google OAuth; we never see or store your Google password. An account is optional — it exists so you can keep your quiz history across devices and so the admin can ban abusive users. You can delete it from your dashboard at any time.
• Local profile — stored only on your device. As an alternative to a Google account you can create a "local profile" with a username and a password you choose. The credentials are encrypted on your device using AES-256-GCM with a key derived from your password (PBKDF2, 250 000 iterations), then saved to your browser'slocalStorage. Nothing about a local profile is transmitted to our servers — not the username, not the password, not the hash. Clearing your browser data deletes it. We cannot recover a forgotten local password.
• Quiz activity (any visitor). Quiz scores can be submitted by anyone, with or without an account, under a chosen display name. The display name and the score are public on the leaderboard. We require a display name (limited to 64 characters, cannot be an email address) so the leaderboard can show a name; we do not need or want your real name. If you are signed in, the submission is also linked to your account so you can see your history.
• Game reviews (Google sign-in required). Posting a review is the only feature on the site that requires a Google sign-in. This is a deliberate anti-spam measure — without an authenticated user row to attach a submission to, automated review-spam has nothing to hold onto and a human moderator does not have to spend evenings hiding it. Your reviewer name on the page is the pseudonym you choose in your dashboard, not your Google name. Reading reviews never requires an account.
• Server logs. Our hosting provider keeps standard request logs (URL, timestamp, status code, truncated IP) for up to 30 days for security and abuse prevention. Logs are not used for analytics and are not joined with account data. They are deleted on a rolling 30-day window.
• Anti-spam fingerprints. When an anonymous user submits a review or a quiz score we compute a short SHA-256 hash of the connecting IP address as a rate-limit bucket. The hash is kept in process memory only (never written to the database, never logged) and is dropped on process restart. We do this to stop a single source from posting hundreds of reviews; we do not use it for any other purpose.

The Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq., and the FTC's COPPA Rule (16 C.F.R. Part 312) place specific obligations on operators of sites that are directed to children under 13 or that knowingly collect personal information from them. We treat this seriously.

This site is not directed to children. It is a general-audience educational reference about a 19th-century U.S. historical event. The reading surface — encyclopedia, glossary, map, quiz, game pages, the playable game itself — does not require an account and does not collect any of the categories of personal information defined at 16 C.F.R. § 312.2 ("first and last name, home address, online contact information, persistent identifier, geolocation, photo, audio, video, etc.") from any visitor, child or adult, beyond the anonymous analytics described above.

The only feature that needs an account is posting a game review. Reviewing is gated behind a Google sign-in for spam protection, and the sign-up flow is gated behind the 13+ neutral age screen described below — so a child under 13 is never offered the option to submit a review here. Reading reviews, like everything else, is open.

Account creation is restricted to users 13 and older. The sign-up flow includes a neutral age screen — we ask for a year of birth in a way that does not default to an age or encourage falsification, as required by the FTC's COPPA guidance. If the answer indicates the visitor is under 13, account creation is refused and the visitor is invited to keep using the site without an account. We do not collect or store the date of birth itself after the gate runs; we only store a short-lived cookie noting that the gate was answered.

If a child under 13 reaches us anyway. If we learn that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly — typically within seven days. We do not condition a child's participation in any site activity on the disclosure of more personal information than is reasonably necessary to participate, because no participation on the site requires personal information from children in the first place.

Parents and guardians — your rights under COPPA. If you believe your child has provided personal information to this site, you may:

• Review any personal information collected from your child;
• Direct us to delete it;
• Refuse to permit further collection or use.

To exercise any of those rights, email contact@oregontrail.ws with the subject line COPPA — parental request. Please include enough detail for us to find the account or submission (the display name used, an approximate date, the URL of the page). We will confirm receipt, verify the request is genuine to a reasonable standard, delete the data, and reply within seven calendar days.

FTC contact. You can also file a complaint with the U.S. Federal Trade Commission at reportfraud.ftc.gov.

We use a small number of strictly necessary cookies for sign-in sessions, CSRF protection, your light/dark theme preference, and the answer to the neutral age screen described above. With your consent we also set a Google Analytics cookie that records an anonymised visitor identifier. There are no advertising cookies and no third-party tracking cookies on this site.

The local-profile feature uses your browser'slocalStorage(not a cookie) to keep an encrypted copy of your local username and password on your own device. The data never leaves your browser. Clearing site data removes it.

Account data, reviews and quiz scores are stored in a Postgres database hosted in the United States. Anonymous analytics are processed by Google and governed by their privacy policy. We do not transfer personal data outside the U.S. for processing. Only the two volunteer administrators have read access to the database, and only for moderation, abuse-prevention, and responding to user / parental requests.

If you have an account, you can delete it from your dashboard at any time, which removes your email, display name, scores, and votes. California (CCPA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA) and EU (GDPR) residents have additional rights to access, correct, port and object to processing of their data. To exercise them, email contact@oregontrail.ws from the address on the account. We respond within 30 days, free of charge, and we do not discriminate against users who exercise their rights.

The in-browser game page (/play) may display a single classroom-friendly display ad to help cover the cost of streaming the emulator. The ad slot is contextual only — it does not use behavioural targeting, does not personalise based on previous browsing, and does not run when an account-holder is signed in. The rest of the archive is ad-free.

If this policy changes in a way that materially affects what we collect or how we use it, we will update the Effective date at the top, post a banner on the home page for at least seven days, and — for changes that affect the COPPA section — send a direct notice to the contact email of any account-holder we believe to be a parent or teacher. Continued use of the site after a change counts as acceptance only for non-material changes.

Privacy questions, COPPA parental requests, CCPA/VCDPA/GDPR requests: contact@oregontrail.ws. We answer real email; we read every message.