Privacy policy

Last updated 6 October 2026

The short version

• For children we keep a first name and last initial, a picture password and their game progress. Nothing else.
• No email address, phone number or surname for children. No ads. No selling of data.
• Only the child's own teacher, school or parent can see their progress.
• We follow the Nigeria Data Protection Act 2023. A parent or school can ask us to delete a child's data at any time: email privacy@kodakids.online.

Who this covers

KodaKids (kodakids.online) is a coding game for children, used by schools and families. Children's accounts are always created by a school or a parent, who agree to this policy when they sign up.

What we collect

• Children: first name and last initial, a chosen avatar, a picture password (stored scrambled, so we can't read it), which levels they played, stars, hints used, how long levels took, and the programs they tried.
• Parents, teachers and school staff: name, phone number or email (used only to log in and to contact you), and your school or family name.
• School pilot requests: the contact details you give us in the form, and the IP address it was sent from (to stop spam).
• Security: the internet address (IP) of devices that log in or look up a class code, to stop people guessing codes and passwords. We delete these after one day.
• On the device: the browser stores the login, the sound setting, and progress for children playing without logging in. This stays on that device.

How we use it

Only to run the game: to log children in, save their progress, show teachers and parents how children are doing, and keep accounts secure. We don't use children's data for advertising or profiling.

Who can see it

• A child's teacher and school admin (for school accounts), or their parent (for family accounts).
• Our small team, only when needed to support a school or family.
• Service providers that store and serve the app for us: Supabase (database, hosted in the European Union) and Vercel (website hosting). They may only use the data to provide their service to us.
• Bachs, our payment processor, when a school or parent pays online: they receive the paying adult's name, email address, payment details and the amount, to take the payment and send a receipt. They never receive children's data.

When we add SMS login codes or AI hints, we'll name those providers here before they start.

How long we keep it

While the school or family account is active. Login-security records are deleted after one day. Unused guest sessions are deleted after about a month. When an account is closed, or when you ask, we delete the children's data.

Your rights

Parents and schools can ask to see, correct or delete a child's data, or to close an account. Email privacy@kodakids.online and we'll respond promptly. You can also complain to the Nigeria Data Protection Commission.

Changes

If we change this policy in a way that matters, we'll tell schools and parents before it takes effect.