Privacy Policy

ZuriPlay is an educational mobile application developed and operated by ZuriPlay Ltd, a company registered in Nairobi, Kenya. When this policy says "we", "us", or "our", it means ZuriPlay Ltd.

This policy applies to the ZuriPlay mobile app, this website, and any related services we operate. It describes how we handle personal information about parents, guardians, and the children in their care.

We collect only what we need to run the service:

• Account information — your name, email address, and password when you register as a parent or guardian.
• Child profiles — the name and optional age you provide when creating a child profile. We do not collect dates of birth, photos, or contact details for children.
• Game activity — session records including game played, score, difficulty level, and timestamp. This powers the parent dashboard.
• Device information — device type, operating system version, and app version, used for crash reporting and compatibility.
• Usage data — aggregate, anonymised data about which features are used. This never identifies individual users.

Your data is used for these purposes only:

• Creating and authenticating your account securely.
• Displaying progress, scores, and session history in the parent dashboard.
• Sending account-related emails such as password resets (no marketing without opt-in).
• Improving app stability and fixing bugs using anonymised crash data.
• Complying with legal obligations where required by law.

We process your data on the legal basis of contract performance (to provide the service you signed up for) and legitimate interest (to keep the app secure and stable).

ZuriPlay is designed for children aged 3–10 to use under parental supervision. We take children's privacy very seriously and comply with applicable child data protection laws.

• Child accounts are created and managed exclusively by a verified parent or guardian.
• We collect the minimum data necessary for child profiles: a name and optional age. No email, phone number, or photo is required.
• Children's game data is linked to the parent account and is only accessible to that parent or guardian.
• We do not serve advertisements to children and do not allow in-app purchases within children's sessions.
• Parents may request deletion of all child data at any time via the Export or Delete options in Settings, or by contacting us.

We do not sell, rent, or trade your personal data. We share it only in the following limited circumstances:

• Infrastructure providers — our app runs on MongoDB Atlas (database) and Render (hosting). Both are contractually bound to process data only on our behalf.
• Legal requirements — if required by a court order or applicable law, we may disclose data to authorities. We will notify you where legally permitted to do so.
• Business transfers — if ZuriPlay is acquired or merges with another company, your data may transfer to the new entity under the same privacy commitments.

Your data is stored on servers located in the European Union (MongoDB Atlas) and processed via Render's infrastructure. We use the following safeguards:

• Passwords are hashed using bcrypt — we never store plaintext passwords.
• All data in transit is encrypted via TLS/HTTPS.
• Authentication tokens (JWT) expire and are invalidated on logout.
• Access to production data is restricted to authorised team members only.
• Rate limiting and security headers are applied to all API endpoints.

No system is perfectly secure. If we become aware of a data breach that affects your rights, we will notify you within 72 hours as required by applicable law.

Depending on your location, you may have the right to:

• Access — request a copy of your personal data.
• Correction — update inaccurate data via Settings → Edit Profile.
• Deletion — delete your account and all associated data via Settings → Danger Zone.
• Export — download your data via Settings → Export My Data.
• Objection — object to processing based on legitimate interest.
• Restriction — request we limit how we process your data.

To exercise any right not available in the app, contact us at hello@zuriplay.com. We respond to all requests within 30 days.

The ZuriPlay mobile app does not use cookies. This website uses only a single session cookie for navigation — no analytics trackers, advertising pixels, or third-party scripts are loaded.

We may update this policy from time to time. When we make material changes, we will notify you by email and display a notice in the app at least 14 days before changes take effect. Your continued use of ZuriPlay after that date constitutes acceptance of the updated policy.

Questions about this policy or your data? We are happy to help.