Privacy Policy · Android app
Privacy Policy — Kurasa for Parents
Effective 5 November 2026. This Privacy Policy describes how Kurasa Africa Ltd handles personal information in the Kurasa for Parents Android app (package com.kurasa.mobile). It is not a school Workspace contract, and it is not the PSL Daily Challenge policy.
Who is responsible
Kurasa Africa Ltd (“Kurasa”, “we”) operates Kurasa for Parents. Registered in Kenya. Nairobi office: 5th Floor, SUS Center, Keri Road, Madaraka. Privacy contact: hello@kurasa.org. You may also use the privacy request form.
This app is for an adult parent or guardian. Learners do not hold this app’s login. A learner appears because a school Workspace has linked them to the parent account, or because the parent uses in-app PSL access for a linked learner.
| Jukumu | What that person does |
|---|---|
| Adult account holder | Registers and signs in with email and password. Sees linked learners, school updates, reports and optional PSL practice. |
| Mzazi au mlezi | The intended account holder. School staff must have linked the family before learner records appear. |
| Mwanafunzi | Does not sign into this app. Their school profile, attendance, assessments, reports, photo and PSL activity may be shown to the linked adult. |
| Shule | Controls who is linked, which records are released to families, and the underlying Workspace record. Deleting this app account does not by itself delete the school’s record. |
What this app accesses, collects and sends
The published Android build talks to Kurasa at https://api.kurasa.co/ over HTTPS. It is not an on-device-only app. Information is stored on the phone (app preferences, a local bookmark database, an optional notification token) and on Kurasa servers so you can sign in again and see current school records.
| Category | What we use | Why | Where it goes |
|---|---|---|---|
| Account and contact details | Email, first name, last name, phone number, password (sent at register, login, password change or account deletion). Gender and date of birth may be stored if the Kurasa account already has them; this app’s register screen does not collect them. | Create and secure the parent account. | Kurasa API; a copy of profile fields is kept in app storage until you sign out. |
| Learner profiles and school information | Linked-learner name, admission number, NEMIS number where supplied, school name, cohort, workspace identifiers, attendance, assessments, homework, comments, report files and teacher details that appear on a feed item. | Show the family the records the school has released. | Kurasa API. Selected learner identifiers are cached on the device. |
| Uploaded images | A JPEG the parent takes or picks for a learner profile, sent with that learner’s id. | Update the learner photo the family and school record can show. | Kurasa API (multipart upload). Requires camera or gallery permission if you use the feature. |
| Answers and progress | PSL daily-challenge answers and question identifiers, subscription status, leaderboard rank, points, accuracy, learner full name, nickname and avatar URL. | Optional PSL practice and school/neighbour leaderboards inside this app. | Kurasa API. |
| Payment references | M-Pesa phone number, plan identifier, learner ids, optional voucher or campaign code, and payment-status checks. No card number is collected. Google Play Billing is not used. | Start and confirm PSL access the parent buys in the app. | Kurasa API; Safaricom M-Pesa receives the number and amount for the STK prompt you confirm on the phone. |
| Notification tokens | Firebase Cloud Messaging device token, stored locally and posted to Kurasa. | Deliver school and account notifications. | Kurasa API and Google Firebase Cloud Messaging. The in-app notification toggle only changes a local preference; it does not currently unregister the token on the server. |
| Usage, device and diagnostics | App version; screens and button events; crash and performance telemetry from packaged Google Firebase libraries; Mixpanel events in the Play release build, identified with name, email and phone after login. HTTP request logging may include request metadata in diagnostic logs. | Operate, secure and improve the app. | Kurasa API, Google Firebase (project kurasamobile), Mixpanel. The Play services measurement libraries that ship with Firebase may read an advertising ID. This app does not show ads. |
| Feedback you send | A title and description from the in-app feedback form. | Support. | Kurasa API. |
SDKs and providers
These services are in the published Android build. We do not describe the app as offline-only.
| Provider | Role in this app |
|---|---|
| Kurasa (api.kurasa.co) | Accounts, learner records, reports, comments, PSL access, notification token storage. |
| Google Firebase Cloud Messaging | Active. Device token for push notifications. |
| Google Firebase Analytics, Crashlytics, Performance and Remote Config | Included in the app. There is no extra in-app configuration beyond the standard SDKs; they may collect diagnostics, crash traces, performance data and instance identifiers automatically. |
| Mixpanel | Active in the Play (release) build. Screen and button events; people properties name, email and phone after login. Disabled in debug builds. |
| Safaricom M-Pesa | STK payment when you buy PSL access in the app. |
| Google Play | Install, in-app updates and in-app review prompts. Google’s terms apply to Play itself. |
Children and school records
This app is directed at adults. It is not a child-only login. It does process children’s education records because a school has linked those learners to the parent.
A school decides who may see a learner’s Workspace record. Leaderboards inside this app can show a learner’s full name, nickname, avatar, rank and scores to other people in the same PSL workspace views (students, schools, schoolmates, neighbours). Sharing from a feed uses the Android share sheet and can include the learner’s name and scores in plain text you choose to send.
We do not use this app to serve third-party advertising. We do not sell personal information. If you believe a child has an adult login of their own, write to hello@kurasa.org.
Security, storage and retention
Traffic to Kurasa uses HTTPS. The app sets Android backup off for its private data. We do not claim a specific certification, encryption-at-rest standard, or uptime guarantee.
Kurasa keeps the parent account and linked product data while the account is active. Website privacy-request messages are kept for two years from last contact. After a valid deletion we delete or de-identify the parent app account and associated family-app data we control, except records we must keep for payment, security, dispute or legal duty, and except school-managed Workspace records the school still holds. Copies may remain in backups for a limited time until those backups rotate. Mixpanel and Firebase retention follows those providers’ settings for our projects; we have not published a separate consumer-facing purge clock for those copies.
Kurasa may process information on infrastructure outside Kenya in order to run the service.
Account and data deletion
In the app: open Account → Delete Account, confirm with the account email and password. That calls Kurasa’s delete-user-information endpoint. On success the app returns you to onboarding. It does not currently clear the local bookmark database or sign you out of stored credentials; uninstalling or clearing app storage removes the on-device copy.
On the web, without opening the app: use Delete account — Kurasa for Parents. The form is a request for review. We may need to confirm that you control the email. Submission does not itself finish deletion.
A school’s learner record is not removed only because the parent app account is deleted. Ask the school as well if the Workspace record must change.
Your choices
You can refuse camera or notification permission and still sign in. You can skip buying PSL access. You can ask us to access, correct or delete personal information we hold, subject to the school’s role in school-managed records and to Kenyan data-protection law. You may contact the Office of the Data Protection Commissioner (Kenya) if we cannot resolve a complaint.
Changes
If the shipped app’s data practices change in a material way, we will update this page and the effective date. The public website notice is separate: website privacy.
App Terms of Service · Delete this app account · PSL Daily Challenge Privacy Policy · Website privacy
