Privacy Policy

1. Who this policy is for

EdVentura accounts are created and managed by a parent or guardian (“you”). Children do not create their own accounts — they play through child profiles inside your account. As the account holder, you are responsible for the child profiles you add and for supervising your child's use of the app.

2. Information we collect

• Account details — your name, email address, and a password. Passwords are stored only as a securely hashed value, never in plain text.
• Google sign-in (optional) — if you choose “Continue with Google,” we receive your name and email from Google to create or link your account. We do not receive your Google password.
• Child profiles — the display name, school year, and chosen avatar you enter for each child. We recommend using a first name or nickname only.
• Learning activity — progress data such as XP, levels, daily streaks, topic mastery, quiz and battle results, badges, and certificates earned.
• Parent PIN — if you set a Child Lock PIN, it is stored only as a securely hashed value and is used solely to protect profile switching and parent settings.
• Payment information — when you buy a plan, payment is processed by our payment providers (ToyyibPay or Stripe). We store a record of the transaction (plan, amount, date, reference) but we never see or store your full card or bank details.
• Referral codes — if you share or use a referral code, we record it to apply the discount.
• Feedback — any messages you send us through the in-app feedback form.
• Technical & usage data — basic information needed to run the service, such as your device/browser type and app interactions, used to keep the app working and improve it.

3. Data stored on your device

To make the app fast and to support offline play, some information is stored locally on your device (in your browser's storage), not on our servers:

• Your language choice (English or Bahasa Malaysia).
• The currently selected child profile and any Device Lock setting (which ties a device to one child's games until you unlock it).
• Offline progress queue — if you play without internet, progress is saved on the device and synced to our servers when you reconnect.
• A service-worker cache of app files and lesson content so the app can run offline.

You can clear this at any time by signing out, clearing your browser data, or uninstalling the app from your home screen.

4. How we use your information

• To create and secure your account and child profiles.
• To run the learning games and save your children's progress, streaks, and certificates.
• To process one-time purchases and send receipts and plan-expiry reminders.
• To send essential emails — a welcome email, payment receipts (with a PDF invoice), expiry reminders, and an optional weekly progress digest.
• To operate multiplayer Quiz Battles and privacy-safe leaderboards.
• To respond to your feedback and provide support.
• To keep EdVentura safe, prevent misuse, and improve the app.

5. Children's privacy

EdVentura is designed for children but is set up and controlled by a parent or guardian. We ask that you provide only minimal information for child profiles (a first name or nickname is enough). We do not knowingly collect personal data directly from a child beyond the profile details you enter and the learning progress generated through play. Leaderboards and Quiz Battles display privacy-safe names only.

6. Sharing your information

We do not sell your personal data. We share information only with trusted service providers who help us run EdVentura, and only as needed:

• ToyyibPay and Stripe — to process payments securely.
• Resend — to deliver our transactional emails (receipts, reminders, digests).
• Google — only if you use Google sign-in, to authenticate you.
• Our hosting and infrastructure providers — to store data and run the service.
• AI content tools — used to help generate practice questions for the curriculum; these are not fed your children's personal profile data.

We may also disclose information if required by law or to protect the rights and safety of our users.

7. Cookies and similar technologies

We use a secure, HTTP-only session cookie to keep you signed in. We do not use advertising or third-party tracking cookies. The local storage described in Section 3 is used only to run the app and support offline play.

8. Data retention

We keep your account and learning data for as long as your account is active so your children's progress and certificates are preserved. Payment records are kept as long as needed for accounting and legal purposes. If you ask us to delete your account, we will remove your personal data and associated child profiles, except where we are required to retain certain records by law.

9. Security

Data is transmitted over encrypted (HTTPS) connections. Passwords and Parent PINs are stored only as securely hashed values. We restrict access to personal data to what is needed to operate the service. No system can be guaranteed 100% secure, but we take reasonable steps to protect your information.

10. Your rights (PDPA)

Under Malaysia's PDPA, you may request to access, correct, or delete your personal data, and you may withdraw consent for non-essential processing. Many of these actions can be done directly in the app — you can edit or delete child profiles from your Dashboard and set or remove your Child Lock PIN at any time. For anything else, contact us using the details below.

11. Changes to this policy

We may update this policy from time to time. When we make significant changes, we will update the “last updated” date above and, where appropriate, notify you in the app or by email.

12. Contact us

If you have questions about this policy or your data, contact us at privacy@edventura.net, or use the feedback form inside your Dashboard.