Privacy Policy

1. Introduction

Kusoma ("we", "us", "our") is committed to protecting the privacy of every user — parents, teachers, and learners alike. Kusoma is available as a web application and as a mobile app on Android (with iOS coming soon). The mobile app is designed specifically for learners, including children under 18 and under 13, to access educational content.

This Privacy Policy explains what personal data we collect, why we collect it, how it is shared between roles on the platform, and your rights regarding that data. By using the Kusoma platform — whether through the website or the mobile app — you consent to the practices described in this policy. If you do not agree, please do not create an account.

2. Data We Collect

2.1 Parent / Guardian Data

Username, email address (required for account verification and teacher communication).
Password (stored securely using one-way hashing; we never store plain-text passwords).
Payment information (processed by our payment provider; we do not store full card details).

2.2 Teacher Data

First name, last name, username, and email address (required for verification and parent communication).
School name (optional, self-reported; may be overridden by a School Code in the future).
Auto-generated Teacher Code (unique identifier shared with parents).

2.3 Learner Data

Learners access the mobile app using a Learner Code and PIN generated by the parent. No email address, phone number, or other contact information is collected from the child.

Display name (chosen by the parent; does not need to be the child's legal name).
Date of birth (optional; used to personalise the learning experience).
Grade level and curriculum selection.
Auto-generated Learner Code and parent-set PIN (used for mobile app login).
Learning progress tracked within the app: lesson completions, subject progress, quiz scores and attempts, XP earned, mastery bands, badges, time-on-task, and last activity timestamps.

2.4 Data Collected Automatically

Web platform:

Device type, browser, and operating system.
IP address and approximate location (country/region level only).
Pages visited and features used (analytics).
Cookies and local storage for session management and preferences.

Mobile app:

Device model, operating system version, and app version.
Offline cache data (lesson content stored locally for offline access).
Basic crash and error reporting data to help us fix bugs.

The mobile app does not access or collect location data, contacts, photos, camera, microphone, or any other device sensors.

3. How Data is Shared Between Roles

Kusoma facilitates communication and oversight between parents and teachers. The following data sharing occurs only when a parent voluntarily links their learner to a teacher using a Teacher Code:

3.1 What Teachers Can See

When a learner is linked to a teacher, the teacher gains access to:

The learner's display name, grade level, curriculum, and active status.
The learner's progress data: XP, lesson completions, quiz scores, mastery bands, and last activity date.
The parent/guardian's name and email address (so the teacher can communicate with the parent about the child's learning).

3.2 What Parents Can See

Parents can see the name of any teacher their learner is linked to and can remove the link at any time.

3.3 Unlinking

Parents may remove a teacher link at any time from their dashboard. Once removed, the teacher immediately loses access to that learner's data and the parent's contact information.

4. Children's Privacy (Including Under-13 Protections)

Kusoma is designed for children under 18, including children under 13. We take children's privacy very seriously and have designed the platform so that children are never required to provide personal information directly.

4.1 Parental Consent

Children never interact with the sign-up or registration process. A parent or legal guardian creates an account on the Kusoma website, registers one or more learner profiles, and provides the child with a Learner Code and PIN to access the mobile app. By creating a learner profile, the parent provides verifiable consent for the collection of learning activity data described in this policy.

4.2 Data We Do NOT Collect From Children

Real names (display names can be nicknames, initials, or any name the parent chooses).
Email addresses or phone numbers.
Physical addresses.
Photos, videos, or voice recordings.
Precise geolocation data.
Contacts or data from other apps on the device.

4.3 Data We DO Collect From App Usage

When a child uses the Kusoma mobile app, the following data is generated and stored:

Lesson completions and subject progress.
Quiz scores and attempts.
XP earned, mastery bands, and badges.
Time spent on lessons (time-on-task).
Device model, OS version, and app version (for crash reporting and compatibility).

This data is used solely to deliver the educational service and to provide parents and linked teachers with progress reports.

4.4 Parental Controls

Parents can review all learner data from their web dashboard at any time.
Parents can modify learner display names, grade levels, and curriculum selections.
Parents can delete a learner profile at any time, which permanently removes all associated progress data.
Parents can unlink a learner from any teacher, immediately revoking the teacher's access to that learner's data.
Parents can change the learner's PIN at any time.

4.5 No Advertising or Data Sales

We do not serve any advertising — behavioural or otherwise — to learners in the mobile app or on any learner-facing surface.
We do not sell, rent, or trade learner data to any third party.
We do not use learner data for third-party ad targeting or profiling.

5. How We Use Your Data

Provide the service: Deliver lessons, track progress, generate reports for parents and teachers.
Account verification: Send confirmation emails to verify your identity.
Communication: Send transactional emails (verification, password reset, account alerts). We do not send marketing emails without consent.
Improvement: Analyse usage patterns to improve content, features, and performance.
Security: Detect and prevent fraud, abuse, or unauthorised access.

6. Third-Party Services

We use the following third-party services to operate the platform:

ZeptoMail (by Zoho) — Transactional email delivery (verification emails, alerts). ZeptoMail processes recipient email addresses and message content. See ZeptoMail Privacy Policy.
Google OAuth — Optional sign-in via Google. When you choose Google sign-in, Google shares your name and email with us. See Google Privacy Policy.
Google Analytics — Anonymous usage analytics to help us understand how the platform is used. See Google Privacy Policy.
Cloudflare — Content delivery, security, and object storage (Cloudflare R2) for delivering lesson bundles and media assets to the mobile app. See Cloudflare Privacy Policy.
ElevenLabs — AI-generated narration audio for lessons. Only lesson text is sent to ElevenLabs for voice synthesis; no child data, learner identifiers, or personal information is transmitted. See ElevenLabs Privacy Policy.

We do not sell your data to any third party. No learner-identifiable data is shared with any third-party service.

7. Cookies and Local Storage

Web platform:

Session cookies: Essential for keeping you logged in. These expire when you close your browser or after a set period.
CSRF cookie: Protects against cross-site request forgery attacks.
Local storage: Used by the web app to cache lessons for offline access and store user preferences.
Analytics cookies: Used by Google Analytics to understand usage patterns (anonymised).

Mobile app:

The mobile app uses local device storage to cache lesson content, media, and progress data for offline access.
No cookies are used in the native mobile app. The learner's session is managed entirely via the Learner Code and PIN.
Cached data is stored only on the device and is removed if the app is uninstalled.

8. Data Retention

Account data is retained for as long as your account is active.
If you delete your account, personal data is permanently removed within 30 days, except where we are legally required to retain it.
Learner progress data is deleted along with the learner profile when a parent removes a learner or deletes their account.
Audit logs (which record actions like sign-ups and data changes) are retained for up to 12 months for security purposes, after which they are anonymised.

9. Your Rights

You have the right to:

Access the personal data we hold about you and your learners.
Correct inaccurate data via your dashboard or by contacting us.
Delete your account and all associated data by contacting us.
Withdraw consent for data processing at any time (this may mean you can no longer use the platform).
Unlink your learner from any teacher at any time, immediately revoking the teacher's access.

10. Data Security

We implement industry-standard security measures including:

HTTPS encryption for all data in transit.
Password hashing using Django's secure hashing framework.
Role-based access controls ensuring users only see data they are authorised to access.
Regular security reviews and updates.

While we take security seriously, no system is 100% secure. If you become aware of a security vulnerability, please report it to [email protected].

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notification. The "Last updated" date at the top of this page reflects the most recent revision.

12. Contact Us

For any questions, data requests, or concerns about this Privacy Policy, contact us at:
[email protected]