Privacy policy

Blaffie is used by children, so we have written this policy for the parent or guardian who is deciding whether to trust us with their child's information. It says exactly what we collect, why, who else sees it, and how to get it deleted.

1. Who we are

Blaffie is operated by Noldor Technologies (Pty) Ltd (Registration Number 2015/336648/07), a company registered in South Africa ("Noldor", "we", "us"). We are the responsible party for the personal information described here under the Protection of Personal Information Act 4 of 2013 ("POPIA").

Our Information Officer can be reached at info@noldor.co.za. That is the address to use for any question, complaint or request in this policy.

2. What we collect

From you, the parent

• Your email address, and your name if you give it. This identifies your account.
• Your password, which is handled by our authentication provider and is never visible to us or stored on our systems.
• A four-digit PIN, if you set one to switch out of your child's view. We store only a salted cryptographic hash of it, never the PIN itself, along with a count of failed attempts so we can lock the PIN temporarily after repeated wrong guesses.
• A record of your consent for each child — the date, the version of the consent wording, and the exact sentence you agreed to.

About your child

• A username and a display name that you choose. These do not have to be their real name, and we recommend they are not.
• Their birth month and year — not the day. We use this only to pitch content at roughly the right level.
• A collar colour they pick for Blaffie.
• Their learning activity: which questions they were asked, the answer they gave, whether it was right, how long they took to answer, whether they used a hint, and which misconception a wrong answer suggests.
• Their progress: which skills they have mastered and when, when a skill is next due for review, their placement results, and their paws, streaks, active days, daily-challenge results and achievements.

Your child does not need an email address or a password. They sign in by scanning a code that you show them.

What we do not collect

• No camera images. The app uses the camera only to read the sign-in code on your screen. Frames are processed on the device and are never transmitted or stored.
• No microphone access. The app does not request it and cannot record audio.
• No contacts, location, photos or files.
• No advertising identifiers, and no advertising of any kind.
• No third-party analytics or tracking. There is no advertising SDK, analytics SDK or social-media SDK in the app.

3. Why we use it, and our legal basis

Under POPIA we process this information on these bases:

• Your consent as the child's parent or guardian, which we ask for and record before a child profile is created. POPIA treats information about children as a special category, and consent from a competent person is the basis we rely on.
• Performing our agreement with you — we cannot run a learning account without storing what has been learned.

We use the information only to:

• Run your child's account and show them the right work next.
• Decide when a skill is mastered and when it should come back for review.
• Award paws, streaks and trophies.
• Show you your child's progress.
• Keep the service secure and working, and fix problems.

We never use your child's information for advertising, marketing or profiling, and we never sell it.

4. Who else sees it

We use a small number of service providers ("operators" under POPIA) to run Blaffie. They process information on our instructions only and may not use it for their own purposes.

Provider	What they do	What they see
Clerk	Accounts and sign-in	Your email, your password (hashed), your child's account identifier
Convex	Database and application hosting	Everything in section 2 except your password
Google Play	App distribution	Your download and, if you send one, your crash report — governed by Google's own policy

Beyond these, we share personal information only if the law requires it, or to establish or defend a legal claim.

5. Information leaving South Africa

Clerk and Convex host their infrastructure in the United States, so the information described above is stored and processed outside South Africa. POPIA section 72 permits this where the recipient is bound by rules providing an adequate level of protection; we rely on our contractual terms with each provider, which bind them to protect the information and to process it only on our instructions.

6. How long we keep it

• While the account is open. Learning history is the point of the product — a progress chart with last term deleted is not much use.
• After you ask us to delete. We delete your account, your children's profiles and their learning history within 30 days.
• Consent records are kept longer. We retain the record that consent was given, and its wording, for as long as we may need it to show we complied with POPIA.

7. Your rights

As the parent, and on your child's behalf, you may:

• Ask what personal information we hold and get a copy of it.
• Correct anything that is wrong.
• Have it deleted — see deleting your data.
• Withdraw your consent, which stops further processing and closes the child's profile.
• Object to how we process it.

Email info@noldor.co.za and we will respond within 30 days. If you are not satisfied you may complain to the Information Regulator (South Africa) at complaints.IR@justice.gov.za.

8. Security

• All traffic between the app and our servers is encrypted in transit.
• Passwords are handled by our authentication provider and never stored by us.
• Parent PINs are stored as salted scrypt hashes, compared in constant time, and locked out for 15 minutes after five wrong attempts.
• A child can only ever read and write their own data; the server checks this on every request.

No system is perfectly secure. If information is compromised in a way that creates a real risk to you or your child, we will notify you and the Information Regulator as POPIA requires.

9. A note on children specifically

Blaffie is designed for children roughly 6 to 12 years old and we assume every child user is under 18. There is no chat, no way for children to contact each other, no user-generated content, no public profile, and nothing a child can buy. Paws are points: they have no cash value and cannot be bought, sold or transferred.

10. Changes

If we change this policy we will update the date at the top. If a change materially affects how we handle your child's information, we will ask for your consent again rather than assume it.

11. Contact

Noldor Technologies (Pty) Ltd, Reg. 2015/336648/07 · Information Officer · info@noldor.co.za