Privacy Policy

TOPIT is a Malaysian learning platform for children aged 4 to 12. Parents create an account, add a profile for each child, pay a subscription per child, and set the goals and limits their child plays under. The children play curriculum-aligned games and earn experience points, levels, coins, streaks and badges.

The service is operated by [TO CONFIRM: the registered legal name of the business operating TOPIT, and its Companies Commission of Malaysia (SSM) registration number], of [TO CONFIRM: the registered business address to publish as the data user’s address]. In this policy, “we” and “us” mean that business.

This policy covers the public website, the parent dashboard where you manage children and billing, and the games app your child signs into. Malaysia’s Personal Data Protection Act 2010 (PDPA) governs how we handle personal data, and this policy is written to describe our practice under it.

It does not cover anything you reach by leaving our service — for example the payment gateway’s own checkout page, which has its own privacy notice.

Almost every privacy question about this product has two answers, because there are two people involved and they are treated differently.

• You, the parent. You hold the account. You give us your name, email address and — if you choose to — a mobile number, and you are the person we bill and the person we write to.
• Your child. Your child never gives us anything directly at sign-up. You create the profile, you choose the name that appears on it, and you decide the age band. Your child signs in with a username and a four-digit PIN and nothing else.

We never ask a child for an email address, a phone number, a date of birth, a home address, a school, or a photograph. There is no column in our database for any of those things on a child profile.

Your identity

Sign-in is handled by Clerk, an authentication provider. Clerk holds your name, your email address and its verification status, your password or social sign-in link, and the session and device records that keep you signed in. We read your name and verified email from Clerk to show them in the dashboard and to address the emails we send you.

In our own database we store only your Clerk user identifier and your email address, so that your rows can be found and so that scheduled emails have somewhere to go.

What you tell us

• A mobile number, if you give one. It is optional at sign-up and you can clear it at any time from Settings. We store it in one normalised form beginning +60, and we only accept Malaysian mobile numbers.
• A preferred language for the messages we send you. English and Bahasa Malaysia work today.
• Your notification choices — which events reach you, whether they arrive as a daily digest, and which channel you prefer.
• The settings you apply to each child — daily screen-time caps, the hours play is allowed, and the goals and rewards you set.

Billing

When you subscribe, we record the plan, its status, the current billing period, the payment method you chose, the amount charged, the gateway fee, any coupon code you used, the payment gateway’s reference for the transaction, and a link to the gateway’s invoice.

To open a checkout we send the gateway your name, your email address and — for BayarCash — your mobile number if we hold one, together with the amount and an order reference. The gateway needs these to raise the payment and to send you its own receipt.

Technical records

• Your IP address is used as a rate-limiting key on the endpoints our payment gateways call, to stop them being flooded. It is held briefly in a Redis cache for that purpose and is not written into our database against your account.
• Application error logs. When something fails we record the error code and the operation that failed. We deliberately do not log the underlying database error text, because it can contain an email address.

The profile you create

• A display name — whatever you type. It does not have to be your child’s real name, and there are good reasons to choose something else (see the next clause). We strip invisible characters from it and reject a short list of offensive terms.
• An age band — either 4–6 or 7–12. We do not ask for or store a date of birth. The band is what decides which questions and games your child is served.
• An avatar, if you pick one: a single emoji.
• A username, which must be unique across the platform, and a four-digit PIN.

What your child does in the app

As your child plays, the app records what they did so that you can see progress and so that the game can award rewards:

• Play sessions — the subject, which game, when it started and ended, how many seconds it lasted, the experience points earned and the score.
• Running totals — experience points, level, coins, the current and longest streak, how many badges have been earned, and when your child was last active. The same totals are also kept per subject.
• Milestones — a feed of events such as a finished session, a level-up, a new badge, a streak gained or lost, and a goal achieved.
• Rewards — the badges earned, the cosmetic items bought with in-game coins and which one is equipped, quest progress and the daily goals generated for that day.
• Requests to you — when your child is locked out because the subscription has lapsed or the daily limit is used up, they can send you a request to open the app. We store that request and the reason.
• Weekly summaries — a per-child summary of minutes, games finished, experience points, streak, strongest subject and a day-by-day breakdown, kept so you can read past weeks in the dashboard.

Sign-in records

• Session tokens, stored only as a SHA-256 hash, so that a copy of our database does not hand anyone a live session as your child.
• Login attempts — the username tried, whether it succeeded, when, and the IP address the attempt came from. This is an anti-abuse record that lets us throttle someone guessing PINs. It is the one place where a network identifier is written to durable storage in connection with a child’s account.

In-game coins are play money. There is no column anywhere in the children’s side of the product that holds real money, and a child can never spend or be charged anything.

This deserves its own clause, because it is the only place where something about your child is visible to someone outside your family.

Each game has a leaderboard — daily, weekly and all-time. It shows the display name you chose, the avatar, the score and the rank of the top players of that game, to the other children playing it. No identifier that links back to your child’s profile, your account or your family leaves the database with it, and there is no way for another child to act on what they see: there is no messaging, no friend list, no comments and no profile page to open.

[TO CONFIRM: whether leaderboards are enabled at launch, and whether parents should be given a per-child opt-out — none exists in the product today]

• To run the service — to sign you in, to show your children and their progress, to serve age-appropriate content, and to apply the limits you set.
• To take payment — to raise a checkout, to confirm it succeeded, to unlock the child it was for, and to give you a receipt and an invoice history.
• To tell you things you asked to be told — the weekly report, the event notifications you switched on, and reminders when a trial or a paid period is about to end.
• To keep the service safe — rate-limiting sign-in and checkout, recording failed child logins, and verifying that a payment notification genuinely came from the gateway.
• To support you — to answer an email you send us, including a request to close your account.

We also cache some of what you see on the dashboard — your children’s names, avatars and headline numbers — for up to sixty seconds, so the page is fast. Each cached entry is keyed to your account and cannot be served to anyone else.

• We do not sell personal data, and we do not share it with data brokers or list providers.
• There is no advertising in the product — no ad network, no ad slot and no tracking pixel exists anywhere in the games or the dashboard.
• We do not build advertising profiles of you or your child, and we do not use your child’s learning data to target anything at them.
• There is no way for a stranger to contact your child through the product. There is no messaging, no comments, no friend requests and no user-to-user feature of any kind.
• We do not currently run any analytics or behavioural tracking tool — no product analytics, no session recording and no error monitoring service is connected to the application today. [TO CONFIRM: whether analytics or error monitoring (the pre-launch checklist names PostHog and Sentry) will be live at launch — if either is added, this clause and the processor list must be updated in the same change]

We use a small number of specialist companies to run the service. They process data on our instructions, for the purposes below and nothing else. This is the complete list of third parties that personal data actually reaches.

Clerk— parent and administrator sign-in

Your name, your email address and its verification status, your sign-in credential, and the session and device records that keep you signed in. Clerk is the system of record for your identity; we read it, we do not duplicate it. Children never touch Clerk.

Supabase— database, scheduled jobs and the child sign-in service

Everything described in this policy that we store ourselves: your account row, every child profile, all play and progress data, subscriptions and payment records, and the settings you apply. Supabase hosts the database and the scheduled jobs that build weekly reports and send reminders.

BayarCash— payment gateway (default)

Your name, your email address, your mobile number if we hold one, the amount, and an order reference. BayarCash collects your banking or card details on its own page; those never reach us. It returns the outcome of the payment and its transaction reference.

CHIP— payment gateway (alternative)

Your name, your email address, the amount and an order reference, when you choose to pay through CHIP rather than BayarCash. As with BayarCash, payment credentials are collected on its page and never reach us.

Resend— email delivery

Your email address, and the contents of the emails we send you. Because the weekly report is an email, that includes your child’s display name and their weekly totals.

Upstash— Redis cache and rate limiting

IP addresses, held briefly as rate-limit counters, and short-lived copies of the dashboard data you are looking at — which includes your children’s display names, avatars and progress numbers — kept for up to sixty seconds and keyed to your account.

[TO CONFIRM: the hosting provider for the web application and the parent dashboard, and whether Cloudflare sits in front of it in production — the code reads a Cloudflare client-IP header and the launch checklist plans for Cloudflare, but neither is confirmed live]

We may also disclose personal data where the law requires it, or where it is necessary to establish or defend a legal claim.

Our database and the services above are cloud services, which means some of the data described here is stored and processed outside Malaysia. Under section 129 of the PDPA, that transfer is made on the basis that the receiving provider applies protections comparable to those required here, and it is limited to what is necessary to run the service you signed up for.

[TO CONFIRM: the region each provider actually runs in — the Supabase project region, the Upstash Redis region, and the region of the web hosting — so this clause can name the countries instead of describing the arrangement in the abstract]

We would rather be exact than reassuring here.

Specifically:

• Your account and your children — kept until you ask us to close the account.
• Learning and play data — kept for the life of the account so that progress, streaks and past weekly reports remain available to you.
• Child sign-in sessions — a session expires and stops working after its lifetime ends. The expired record itself is not automatically purged today.
• Failed login records — kept as an anti-abuse trail. There is no automatic expiry on them today.
• Payment and invoice records — retained after account closure, because records of money received have to be kept. [TO CONFIRM: the retention period for accounting and tax records that applies to this business, and the statute it comes from, so this clause can state a number]

[TO CONFIRM: whether a retention limit should be introduced for play and sign-in data — for example deleting activity sessions and login attempts older than a fixed period — and what that period should be]

We do not use advertising cookies and we do not use analytics cookies. What the site does set is:

• A session cookie from Clerk, which is what keeps you signed in. Without it the dashboard cannot work.
• A light or dark theme preference, saved in your browser’s local storage. It never leaves your device and is not sent to us.
• A sign-in token on your child’s device, held by the games app so your child does not have to re-enter their PIN on every visit. Only a hash of it exists on our side.

These are properties of how the system is built, not intentions:

• Row-level security is enabled on every table in the database. A parent’s session can only read rows that belong to that parent, and the rule is enforced by the database itself rather than by a filter in application code that could be forgotten.
• A child’s session cannot reach a parent’s data, and a parent’s session cannot use the children’s game interfaces. The two are separate credentials with separate permissions.
• PINs are salted and hashed with scrypt and compared in constant time. Session tokens are stored as SHA-256 hashes, never in the clear.
• Payment notifications are verified against the gateway’s signature or checksum before they are acted on, and each one is processed exactly once even if it is delivered repeatedly.
• Keys that bypass access control are server-side only and are never sent to a browser. A small number of dashboard reads use an elevated database connection, and in each case the code first confirms through the ordinary access-controlled path that the child belongs to you, and only then reads the narrow set of columns it needs.
• The administration area is closed by default. Access is limited to a server-side list of verified email addresses, checked again on every page and every action.

No system is perfect, and we will not claim otherwise. If you believe you have found a security problem, please tell us using the contact details below.

Under the PDPA you have rights over the personal data we hold about you and, as the parent who provided it, about your child. You may:

• Ask for a copy of the personal data we hold.
• Correct it if it is wrong or out of date. Your name, email address and password are changed in your sign-in account; your phone number, language, and every child’s name, avatar and age band are changed from the dashboard directly.
• Withdraw your consent to our processing. In practice that means closing your account, because the data we hold is what the service needs to function.
• Limit what we send you. Notification preferences are yours to change at any time from the dashboard, and switching everything off stops the messages without closing the account.
• Complain to us, and to the Personal Data Protection Commissioner of Malaysia if you are not satisfied with our answer.

Requests go to the address in the last clause. We will ask you to verify that you are the account holder before we act — on a children’s product, acting on an unverified request would be the greater risk. [TO CONFIRM: the response time we commit to for a data access or correction request]

There is a Request account deletion button in your dashboard Settings. We want to be straight about what it does, because it is not a delete button.

This is deliberate. Your parent account is the root of everything else: deleting it removes every child profile, all of their learning progress and badges, their sign-in credentials, your subscriptions and your payment history, and it cannot be undone. A one-click version of that would also leave a live subscription still charging you at the gateway, because cancelling there is a separate step. We would rather a person checked.

When the deletion is carried out, your account and your children’s profiles and learning data are removed from our database. Records of payments already made are kept, as described in the retention clause. Your sign-in record is deleted from our authentication provider. Cached copies of dashboard data expire on their own within a minute.

[TO CONFIRM: a monitored mailbox for deletion and privacy requests. The address currently shown in the app, support@topit.my, was invented during development and does not exist — a request sent there goes nowhere while the parent believes it was filed]

When we change this policy we will change the date at the top of the page. If a change materially affects what we collect or who we share it with, we will tell account holders by email before it takes effect rather than relying on you to notice the date.

For anything in this policy — a question, an access or correction request, a complaint, or a security report — write to [TO CONFIRM: the monitored email address for privacy and data-protection enquiries], or by post to [TO CONFIRM: the registered business address for written correspondence].

[TO CONFIRM: the name or job title of the person responsible for handling data-protection enquiries — the PDPA expects a reachable contact, and no such person is named anywhere in the product today]

Our Terms of Service cover the rest of the relationship — the subscription, what the service does, and what happens if something goes wrong.