Privacy Policy

1. Who we are

A Daily Challenge account is held by a parent or guardian, not by the child who uses the daily set. We do not offer accounts to children acting on their own. If you are under 18, ask a parent or guardian to set up the app or website signup.

League names show first name and last initial only (for example, “Amani W.”). School names may appear on school leaderboards. We do not ask for a full last name, ID number, or home address for Daily Challenge.

2. The PSL website

This section applies to psl.mykurasa.com, including school registration and orders, the paper QR page (/dc), Daily Challenge on the web, resources, and related Kurasa portals.

Whose information we handle

• School staff who register a school or zone, place an assessment order, or check delivery and payment status.
• Parents and guardians who sign a child up for Daily Challenge, scan a QR code from a PSL paper, or continue from the website into an app.
• Learners, whose names, grades, schools, practice answers, and assessment-related scores are provided by the school or the parent so we can deliver papers, results, and daily practice.

What we collect on the website

School orders and PSL administration. School name, workspace code, region, county and sub-county, contact name, phone number, email, grade and paper counts, delivery contact and location, payment references, and order status.

Daily Challenge on the web. Parent name, phone number, email, child’s name, school, grade, and parental consent. We send a one-time SMS code to the phone number to confirm it. We do not ask for a password on the paper QR page.

Practice on the website. Sample and session answers, whether they were correct, and progress for that visit. Before login this is stored in a guest session and cookies on the device.

Payments. When you pay with M-Pesa we use the phone number you give us to send a payment prompt and to match the transaction to the school or Daily Challenge account. We do not store card numbers. M-Pesa is processed by Safaricom and our payment partner.

Print-batch and campaign tracking. If you arrive from a QR code or a shared link, we may store batch or UTM parameters (for example source, medium, campaign) so we can see which print run or school the visit came from.

Technical data. IP address, browser type, device type, pages viewed, and roughly when you used the site. Funnel events on /dc (landing, sample answered, OTP sent, session finished, app link clicked) may be stored with a visitor id and a masked phone number.

Public leaderboards. After a learner is on Daily Challenge on the web, first name, school, points, and rank may appear on public leaderboard pages used for practice motivation. The paper QR landing page does not show a national leaderboard.

Why the website uses it

• To register schools, print and deliver assessment papers, and share results with the school.
• To let a parent or child try Daily Challenge, complete today’s questions, and continue in an app or at app.kurasa.co.
• To confirm a phone number with SMS OTP and to send service messages (codes, payment prompts, practice reminders where you have opted in).
• To take M-Pesa payment for assessment orders or Daily Challenge access, including the Kurasa Gold school carve-out where it applies.
• To answer support requests on WhatsApp or email.
• To understand which print batches and pages convert, and to fix problems on the site.

Cookies and similar tools (website only)

We use a session cookie so the site works (for example, so a sample answer is not lost when you enter your phone number). On the paper QR page we may also set cookies so we recognise a returning visitor and do not ask for OTP again on the same phone for a period of time.

We use Google Analytics and Microsoft Clarity to see how the site is used. Clarity may record session replays (mouse movement and taps on the page). These tools set their own cookies. You can block them in your browser; the site will still load. The Android preview app does not embed these tools.

Who else sees website information

• Schools. Teachers and school admins see their own learners’ PSL and Daily Challenge information in Kurasa.
• Payment and SMS providers. Safaricom (M-Pesa) and our SMS/OTP service receive the phone number and the amount or message needed to complete the request.
• Google Play. If you tap through to an app listing, Google’s Play Store terms and privacy policy apply to the download.
• WhatsApp. If you message 0208 000 208, that conversation is on WhatsApp (Meta).
• Analytics providers. Google and Microsoft, as described above.

We do not sell personal information. We may share it if the law requires it, or with a processor who only uses it to run PSL or Daily Challenge for us.

How long we keep website data

School order and payment records are kept for as long as we need them to deliver papers, reconcile M-Pesa, and meet accounting and education-record needs. Daily Challenge accounts on the web stay active while the parent or school uses the product, then for a limited period afterwards so we can restore access or handle a dispute. Guest session answers on /dc last for the browser session (and related cookies for up to about 30 days). OTP codes expire in minutes.

Website security

We use HTTPS, limit staff access, and mask phone numbers in some logs. No online service is perfectly secure. Do not share an OTP SMS with anyone. We will not ask you to send passwords by email.

3. The PSL Daily Challenge Android app

This section applies to package com.psl.dailychallenge. A parent or guardian creates and controls the account. They add learners, choose reminders, and (when billing is live) manage extra practice. A learner uses the daily five-question set, avatar, streaks, certificates, and league identity.

What we store on this device

All of the following is saved locally on the phone (using on-device storage). It is not uploaded in this preview.

Parent or guardian. Name; email address (used for the simulated sign-in field); phone number, if entered; referral code; reminder preferences (on/off, time, days, which learners, quiet hours, weekly report toggle).

Learner. First name and last initial; grade and school name; avatar (character, colour, hat); credits and any Exam Ready-style entitlement shown in the prototype; streak, XP, certificates, and completed dates; answers, hints used, and progress on the daily set and extra practice; optional photo of working.

App activity. Which learner is active; in-app notifications (streak, credits, league); follows and league posts in the prototype feed; checkout and credit-history records created in the prototype (nothing is billed).

Photos

Camera or the photo library is used only if a learner chooses “Add a photo of my working.” The photo is compressed on the device, stays on the phone, is not uploaded, and does not change the score. The app works fully without a photo.

Audio

The app may play short sound effects. It does not record a child’s voice or use the microphone for speech.

What we do not collect in this preview

• Precise location
• Contacts, SMS, or call logs
• Advertising IDs used to track across apps
• Payment card details (checkout is simulated)
• Health or government ID numbers

Why the app stores it

We do not use this app data for advertising, sale to third parties, or cross-app tracking.

Permissions

Android may show these permissions. They are optional unless you use the related feature.

You can refuse these permissions and still complete the daily set.

Sharing (app preview)

In this preview we do not share personal information with PSL servers, other companies, advertisers, or other users’ devices.

League rows and “discoverable learners” you see in the app are demo or local data on this phone, not a live national network.

If a future version sends data to PSL (for example real sign-in, cloud backup, or a live league), we will say so here, name the service, and update Google Play Data safety before that release.

Retention and deletion (app)

Because data lives on the device in this preview:

• Uninstalling the app removes the stored profile, progress, and photos held by the app.
• Clearing the app’s storage in Android settings has the same effect.
• There is no PSL cloud copy of the app preview to delete until a server exists.

When cloud accounts exist, we will add an in-app way for the parent to download or delete the family account, and we will honour a deletion request sent to psl@kurasa.co within a reasonable time.

App security

This preview does not transmit your data. The phone’s lock screen and Android app storage protect what is on the device. Do not use a shared or rooted device if you want that local data to stay private. Future online features will use encryption in transit (HTTPS).

Payments in the app

The five-question daily set is free. Credits and Exam Ready in this build are prototype screens only. Nothing is charged. If we later sell extra practice on Android, we will use Google Play Billing for those digital goods and update this policy. Website school orders and web Daily Challenge payments, if any, remain M-Pesa as described above — they are not processed inside this preview app.

Third-party services (app)

This preview does not embed advertising SDKs, crash reporters, or analytics SDKs that send personal data off the device.

Expo / Google Play infrastructure may process technical information when you download the app from Play (for example device compatibility). That is Google’s processing, described in Google’s own policies.

International use (app)

The product is aimed at families in Kenya. This preview does not transfer family data to PSL systems in other countries because it does not leave the phone.

4. Children

PSL papers and Daily Challenge are for school-age learners with a parent, guardian, or school in control.

• We do not knowingly let a child create a standalone parent account.
• We minimise what is shown in the league (first name + last initial).
• We do not show third-party ads in the app preview. The website is not used to advertise unrelated products to the child.
• Optional photos in the app are for working, not for a public profile picture network.
• There is no private chat between learners.

If you believe we have information about a child without a parent or school’s involvement, write to psl@kurasa.co. For the app preview we will help you delete it from the device (uninstall or clear storage). For the website we will look into the account or order record.

This approach is intended to align with Google Play Families requirements and with Kenya’s Data Protection Act, 2019 for children’s data, as the products stand today.

5. Your choices (Kenya Data Protection Act, 2019)

App preview. You already control the data: you can edit the parent and learner profiles in the app, skip photos, turn reminders off, or uninstall.

Website. You can ask us to access, correct, or delete personal information we hold, or to explain how it is used. School workspace and order records may need to go through the school, because they are the school’s records as well as ours.

When a PSL server holds a family Daily Challenge account from the app, a parent will be able to ask us to access, correct, or delete that data, subject to the law. Contact psl@kurasa.co. You may also contact the Office of the Data Protection Commissioner (Kenya) if you have a complaint we cannot resolve.

6. Changes

We will update this page and, for the app, the in-app “Privacy & permissions” screen when the product changes in a material way — especially if we start sending app data to a server, add ads, or turn on real in-app payments. The effective date at the top will change.