Privacy Policy · Android app
Privacy Policy — PSL Daily Challenge
Effective 5 November 2026. This Privacy Policy describes how Kurasa Africa Ltd, operating Problem Solvers League, handles personal information in the PSL Daily Challenge Android app (package com.psl.dailychallenge). It is not the Kurasa for Parents policy, and it is not a school Workspace contract.
Who is responsible
Kurasa Africa Ltd (“Kurasa”, “PSL”, “we”) operates PSL Daily Challenge. Nairobi office: 5th Floor, SUS Center, Keri Road, Madaraka, Kenya. Privacy contact: hello@kurasa.org. You may also use the privacy request form.
A parent or guardian holds the account. Learners in Grades 3–9 (typically ages associated with Kenyan CBC those grades) use the daily set through that adult account. We do not offer a standalone child login.
| Role | What that person does |
|---|---|
| Adult account holder | Signs in with email OTP, email magic link, or phone OTP. Adds learners, pays for optional extra practice, sets reminders. |
| Learner | Plays the daily five questions, extra practice, avatar, streaks, certificates and league identity. Does not own the parent login. |
| School / teacher (optional) | A parent may join a teacher code and give consent so a teacher can see agreed PSL activity. That is separate from a full Workspace record. |
What this app accesses, collects and sends
The published Android build talks to Kurasa at https://api.kurasa.co/api over HTTPS. It is not an on-device-only app. A local session is stored on the phone so the app can reopen quickly; the same family data is stored with Kurasa so you can sign in on another device.
| Category | What we use | Why | Where it goes |
|---|---|---|---|
| Account and contact details | Parent name, email and phone. Phone-only sign-in may create a placeholder email on Kurasa. Profile edits are sent to Kurasa. | Sign-in and parent controls. | Kurasa API; a session copy on the device (including a token in secure storage). |
| Learner profiles | First name, last initial, grade, school name, generated or uploaded avatar, credits, Exam Ready or unlimited status, streak, XP, certificates. | Run the daily set, extra practice and league identity. | Kurasa API. Avatar images you upload are stored with Kurasa. |
| Answers and progress | Answers, timing and progress on the daily set, extra practice, brand challenges and related reviews. | Mark work, streaks, certificates and reports. | Kurasa API. |
| Uploaded images | Avatar photo: uploaded. Optional “working” photo of paper during a typed question: kept on the device, not uploaded, and it does not change the score. | League identity; optional local working picture. | Avatar → Kurasa. Working picture → device only. |
| Payment references | M-Pesa number at checkout, package or Exam Ready selection, active learner, checkout and receipt references. No card number. Google Play Billing is not used in this build. | Credit the active learner after a confirmed STK payment. | Kurasa API; Safaricom M-Pesa for the STK prompt. |
| Notification tokens | This build does not register an FCM or Expo push token with Kurasa. Reminders are scheduled locally on the device. A weekly-report email toggle is stored on the device only in this build; it is not sent to the API. | Local reminders you choose. | Device only for those reminder settings. |
| Usage, device and diagnostics | First-party events (screens, buttons, play and payment funnel, API errors) posted to Kurasa. Every signed-in request may send an app-minted device id, app version, build, install source, a local session id, platform, and, on app open, OS, manufacturer, model, locale and timezone. Not an advertising ID. This app blocks the Android AD_ID permission. | Run and improve the app. | Kurasa API only. No Mixpanel, Sentry or Firebase Analytics SDK is shipped in this app. |
| Community and league | Follows, template community posts (sets and badges, not free-form chat), cheers, reports, first name plus last initial, school name, avatar. | League boards and community you choose to use. | Kurasa API; visible to other PSL families who follow or find that learner, at the scope of the board (class, school, county or national). |
SDKs and providers
Firebase, Mixpanel and Sentry SDKs are not included in this app’s source dependencies. A Firebase messaging label may appear in the Android manifest from the notifications template; this build does not register a remote push token.
| Provider | Role in this app |
|---|---|
| Kurasa (api.kurasa.co) | Accounts, daily sets, league, community, credits, teacher links, PSL Show features where enabled. |
| Safaricom M-Pesa | STK payments for optional extra practice. |
| Google Play / Expo | App delivery. Local notifications via Expo. Android SMS User Consent (Play Services) may read one branded OTP message to fill a 6-digit code; the app does not hold the READ_SMS permission. |
| YouTube | PSL Show video, if you open it. The player is a standard embed; do not put learner data into it. |
| WhatsApp (optional) | Help can open a WhatsApp community link you choose to follow. That leaves the app and is under WhatsApp’s terms. |
Children, Families and visibility
The app is designed for school-age learners with a parent or guardian in control. League names use first name and last initial (for example, Amani W.). School names may appear on school boards. Community posts are templates from completed sets and badges, not private chat. A parent can report a post; it is hidden for that learner and stored for review.
We do not show third-party ads. We do not sell personal information. We do not collect precise location, contacts, call logs, payment cards or government IDs. Optional working photos stay on the device.
This description is intended to match a Families-directed learner experience under an adult account. If a child has created a parent login, write to hello@kurasa.org.
Security, storage and retention
Traffic to Kurasa uses HTTPS. The device may back up some app data under Android backup rules for this build. We do not claim a certification or encryption-at-rest standard.
Kurasa keeps the family account while it is active so you can sign in again. Uninstalling or clearing storage removes the on-device session. After a valid deletion we delete or de-identify the family account and associated PSL Daily Challenge data we control, except payment, security, dispute or legally required records. Backups may lag until they rotate. Website privacy-request messages are kept for two years from last contact.
Kurasa may process information on infrastructure outside Kenya in order to run the service. The product is aimed at families in Kenya.
Account and data deletion
This app’s current screens provide Sign out, not an in-app delete-account button. Sign out is not deletion.
To delete the parent account and associated PSL Daily Challenge data, use Delete account — PSL Daily Challenge or email hello@kurasa.org with subject “Privacy — PSL Daily Challenge” and the email or phone on the account. We will review identity and authority before acting. Submission of the form does not itself finish deletion.
Uninstalling removes the local copy only.
Your choices
You can skip camera, photos, calendar and notifications and still complete the daily set. You can turn reminders off, unfollow, report a post, or skip extra-practice purchases. You may ask us to access, correct or delete personal information we hold, subject to Kenyan data-protection law, and you may contact the Office of the Data Protection Commissioner (Kenya).
Changes
If the shipped app’s data practices change in a material way, we will update this page and the effective date. See also website privacy.
App Terms of Service · Delete this app account · Kurasa for Parents Privacy Policy · Website privacy
