Smart Safari Kids — Privacy Policy
Last updated: 1 June 2026, 18:00 SAST
Operator: Smart Safari Kids
Contact: hello@smartsafari.kids
1. Plain English Summary
We made Smart Safari Kids for South African kids and their parents. Here's the short version of how privacy works:
- By default, your data stays on your device. If you create a parent account, your kid profiles sync to the cloud so you can recover them on any device; premium adds full progress sync.
- We don't ask children for their email, phone, or last name. Just a first name and a username they pick. Only a parent provides an email, and only to create an account.
- We don't sell anything to anyone. No ads, no tracking pixels, no data brokers.
- Parents have full control. Edit profiles, delete data, all from inside the app.
- You can wipe everything anytime by clearing your browser data, and request deletion of your cloud account by contacting us.
The rest of this document is the formal version required by South African law (POPIA — Protection of Personal Information Act, 2013).
2. Who We Are
Smart Safari Kids ("the App") is operated by Smart Safari Kids, based in South Africa.
Responsible Party (POPIA term): Smart Safari Kids
Information Officer: Fakazi Ngcobo — hello@smartsafari.kids
If you have any privacy concerns, questions, or requests, contact us at the email above.
3. What Information We Collect
Smart Safari Kids is designed to collect as little information as legally and technically necessary.
From children (users under 13):
- First name only — used to personalise the experience (e.g. "Welcome back, Mholi!")
- A username — a unique handle on your device (e.g. "@mholi"), chosen during setup
- Grade level — used to deliver age-appropriate content (Grade R through Grade 7)
- Avatar choice — an emoji picture they select
- Gender (optional) — a parent may optionally select "Boy", "Girl", or "Prefer not to say" during profile setup. This is never required and can be left blank. Why we ask: it helps us understand which games children of different groups enjoy, so we can improve the games and make the play experience more fun for everyone. We only ever look at this in aggregate (overall counts) — for example "55% of players are boys" or "girls play the spelling game more" — and never in a way that identifies an individual child. A parent can leave it unset or change it at any time in the Parent Center.
- Game progress — questions answered, coins earned, level reached, items unlocked
- Anonymous performance statistics — average response time, subjects practiced, time spent playing, and which games are played (used to improve the games and the play experience)
From parents (optional):
- Parent email address — when a parent creates an account, used to sign in, recover profiles across devices, and (if premium) sync progress. Children are never asked for an email.
- A 4-digit PIN — to protect the Parent Center from children
We do NOT collect:
- ❌ Last names
- ❌ Phone numbers (parent or child)
- ❌ Physical addresses
- ❌ ID numbers
- ❌ Photos or biometric data
- ❌ Geographic location data
- ❌ Device IDs or advertising IDs
- ❌ Banking or payment information (no payment processing is active)
- ❌ Browsing history outside the App
4. How We Store Information
By default, all information is stored locally on the user's device in the browser's built-in storage (localStorage). This means:
- Guest and free use stays on your device. If you don't create an account, no data is sent to us.
- Data persists between sessions so your child's progress is remembered when they return.
- If you clear your browser data, all locally-stored Smart Safari Kids data is permanently deleted.
Cloud sync (premium feature)
If you create a parent account, your account and kid profiles sync to secure cloud storage so you can sign in and recover them on any device. A premium subscription additionally syncs full game progress and history. Here is exactly how that works:
- Cloud sync requires a parent account (email + password). Children never have their own accounts — their profiles live under the parent's account.
- Cloud data is stored with Supabase, a reputable hosting provider, on servers in the European Union (Ireland region). Data is encrypted in transit (TLS) and at rest.
- Strict access isolation: database security rules ensure your account's data can only ever be read or written by you. No other account — and no child — can access another family's data.
- What syncs on a free account: the parent account (email, plan status) and each kid profile (first name, username, grade, age, avatar, optional gender, headline stats, achievements, and a small per-game play summary used for product analytics) — so you can recover your family on a new device.
- What additionally syncs on premium: detailed game progress and activity history.
- What does NOT sync: passwords are handled by Supabase's authentication system and are never stored by us in readable form. We do not store payment card details — payments are processed by Paystack.
- Deletion: you can delete local data anytime by clearing your browser data, and you can request full deletion of your cloud account and all associated data by contacting us at the email above.
Playing as a guest (without an account) keeps all data on the device only.
5. Why We Collect This Information
We process the limited information described above for the following purposes:
1. To run the App — show your child their progress, save their game state, restore their session
2. To personalise the experience — adapt difficulty, surface relevant rewards, show their name
3. To protect children — the Parent PIN keeps kids out of parental controls
4. To enable parental oversight — parents can see how their child is doing
5. To improve the games and play experience — we look at aggregate, non-identifying patterns (such as which games are most played, and the overall boy/girl mix of players) to decide which games to improve and build next, so children enjoy playing more. This is only ever done with combined totals, never with an individual child's record.
We do not process information for:
- Marketing or advertising
- Profiling
- Analytics
- Sharing with third parties
6. Children's Privacy (Special Protection Under POPIA Section 35)
Smart Safari Kids is designed primarily for children aged 5–13. We comply with POPIA Section 35 ("Processing of personal information of children") and applicable international standards (COPPA, GDPR-K).
Key protections:
- We never collect email addresses, phone numbers, or contact information from children.
- Parental consent: Before a parent account is created, an adult must complete a verification step (a multiplication question that an under-10 cannot easily answer in their head). This is a basic-good-faith age gate.
- Parent controls: Parents can view, edit, and delete any child profile from the Parent Center at any time.
- No third-party content: We do not display advertising, do not include third-party tracking scripts, and do not embed external services that could profile children.
- No social features: Children cannot chat with strangers, share content, or be contacted by others through the App. There is no "friends list" or "messaging" feature.
If you are a parent and believe a child has used Smart Safari Kids without your knowledge, contact us at hello@smartsafari.kids and we'll guide you through deleting the data.
7. Sharing of Information
We do not share, sell, rent, or trade your information with anyone.
Because all data is stored locally on your device, there is technically nothing for us to share — we don't have it.
The only exceptions where information might be disclosed:
- If required by South African law (e.g. a court order specifically directing us). To date, this has never happened.
- In the case of a business transfer, if Smart Safari Kids is ever acquired or transferred, any user data would be transferred under the same privacy protections — but again, we hold no user data on our servers, so there is nothing meaningful to transfer.
8. Cookies and Local Storage
Smart Safari Kids does not use advertising or tracking cookies.
We use the following browser storage and cookies strictly to make the App work:
- localStorage — saves your game progress and profiles on your own device so they persist between sessions.
- Authentication cookies / tokens — if you create a parent account, our cloud provider (Supabase) sets a secure session token in your browser so you stay signed in. This is essential for login to function; it is not used for advertising or tracking.
We do not use:
- ❌ Google Analytics
- ❌ Facebook Pixel
- ❌ Any third-party analytics or tracking
- ❌ Advertising networks
- ❌ Heat-mapping tools
9. Your Rights Under POPIA
As a data subject under POPIA, you have the right to:
1. Be informed about what data is collected and why (this document)
2. Access the personal information held about you — for Smart Safari Kids, this means opening the app's Parent Center and viewing your profiles
3. Correct inaccurate information — done through the Parent Center → Manage Profiles → Edit
4. Delete your information — done by Parent Center → Manage Profiles → Delete, OR by clearing your browser data
5. Object to processing — discontinue use of the App at any time
6. Lodge a complaint with the Information Regulator if you believe your rights have been violated:
- Information Regulator (South Africa)
- Email: inforeg@justice.gov.za
- Website: https://inforegulator.org.za
10. Data Security
For data kept on your device, the primary protection is your device's own security:
- Use a passcode/biometric on your phone
- Don't share your device with strangers
- Don't use Smart Safari Kids on public/shared computers if privacy is a concern
For data synced to the cloud (parent accounts), we rely on our hosting provider Supabase, which encrypts data in transit (TLS) and at rest, and we enforce database-level access rules so each account can only access its own data. Passwords are managed by Supabase's authentication system and are never stored by us in readable form.
We have implemented these technical measures within Smart Safari Kids:
- The parent account is protected by a 4-digit PIN
- Children cannot access the Parent Center or add new profiles without the parent PIN
- No external connections are made except to load the App itself
We acknowledge that no system is 100% secure. If we ever discover a security breach, we will notify affected users via the in-app interface and via email (if a parent email was provided).
11. International Transfers
If you use the App as a guest or without creating an account, no data is transferred anywhere — it stays on your device.
If you create a parent account, your account data is stored with Supabase on servers in the European Union (Ireland). This means your data is processed outside South Africa. POPIA permits such transfers where the receiving country offers comparable data-protection law (the EU's GDPR meets this standard) and where the data remains subject to security safeguards, which Supabase provides. The App's code itself is served via Netlify's global content delivery network.
12. Retention
Data stored on your device is retained until you delete the profile through the Parent Center, clear your browser data, or stop using the App.
For data synced to a parent account in the cloud, we retain it for as long as your account is active. If an account remains inactive (no sign-in or use) for 24 consecutive months, we will delete the account and its associated data. You may also request deletion of your account and all associated cloud data at any time by contacting us at the email below; we will action verified requests within a reasonable period.
13. Changes to This Policy
If we make significant changes to how we handle data (especially when we activate cloud sync), we will:
1. Update the "Last updated" date at the top of this document
2. Show a notice in the App on next launch
3. Email parents who have provided a parent email
4. Require fresh consent for any new data processing
Material changes will not be applied retroactively to existing users without their consent.
14. How to Contact Us
For all privacy-related matters:
Email: hello@smartsafari.kids
Subject line: "Privacy: [your question]"
Response time: We aim to respond within 7 business days.
For POPIA access/deletion/correction requests, please:
- Include the parent name and email you used (if any)
- Describe what you want (delete a specific profile, view all data held, etc.)
- We may ask for verification that you are the parent of the affected child
15. Plain Closing Statement
We built Smart Safari Kids because our own kids in South Africa needed something safe, ad-free, and made for their curriculum. We're committed to keeping it that way.
If you ever feel we're falling short of these promises, email us. We'll listen.
This privacy policy is provided in good faith and is intended to be aligned with POPIA. Smart Safari Kids includes optional parent accounts, cloud sync, and paid subscriptions. This is not legal advice; if you have questions about your rights, you may contact the Information Regulator (South Africa). We recommend parents review this policy periodically, as it may be updated; material changes will be communicated to account holders.