Privacy Policy

1. What this Policy covers

This Policy explains what we collect, why we collect it, how we use/share it, your rights as a data subject in Kenya, and how to contact us or the Office of the Data Protection Commissioner (ODPC). Kenya's Data Protection Act, 2019 (the DPA) and the Data Protection (General) Regulations, 2021 apply.

2. Personal data we collect

• Account & profile: name/alias, email address, and authentication identifiers provided when you sign up or log in via Clerk.
• Gameplay & progress: levels played, scores, time-on-task, quiz results, attempts, and error patterns.
• Device & usage: IP address, browser or app version, pages visited, feature interactions, crash reports, and analytics SDK identifiers.
• Payments (if used): payment reference, amount, and status from Paystack; we do not store full card or M-Pesa details.
• Marketing attribution: UTM parameters, Google and Meta click identifiers, Meta browser identifiers, and the original landing page/referrer when you arrive via a tracked or paid link. These are used solely to measure which channels bring users to the platform and match confirmed purchases to ads.
• Support & feedback: the content of messages, attachments, and satisfaction ratings.

3. Why we collect it (lawful bases)

We process personal data only where a lawful basis applies (consent, contract, legal obligation, legitimate interests, or vital/public interest). Typical uses include providing and improving the service, personalising difficulty and feedback, managing accounts and billing, and sending direct marketing with opt-in consent.

4. Children

TBG is not intended for children under 18 unless a parent/guardian has provided verifiable consent and ongoing supervision. To request deletion of a child account, contact us.

5. Retention

We retain data only as long as necessary for the purposes collected, then securely delete or anonymise it.

6. Security

We use appropriate technical and organisational measures (encryption, hashed passwords, least privilege access, vendor due diligence).

7. Data sharing & processors

We do not sell personal data. We share data only with the vetted processors listed below, under written data processing agreements:

• Clerk (US-based) — identity and authentication; stores your email address and sign-in credentials.
• PostHog (US-based) — product analytics; receives your user ID, email, access pass status, and behavioural events (pages visited, levels played, quiz results) to help us understand how the platform is used and improve it. We also use session replays to understand navigation, scrolling and interactions on phones and desktops. Text and form inputs are masked, and console logs and network request bodies are not recorded. Session replays are retained for 30 days.
• Paystack — payment processing; receives payment amount and reference. We do not store full card or M-Pesa details.
• Resend (US-based) — transactional email delivery; receives your email address to send account and access pass notifications.
• Replit — hosting and database infrastructure; your data resides on servers managed by Replit.

8. International transfers

Several of our processors are based in the United States: Clerk (authentication), PostHog (analytics), and Resend (email). When your data is transferred to these processors we rely on contractual safeguards (standard contractual clauses or equivalent data processing agreements) to ensure your data receives an adequate level of protection consistent with the Kenya Data Protection Act, 2019.

9. Automated decisions & profiling

If we use automated decision-making (e.g., adjusting difficulty), we will explain the logic and allow human review.

10. Direct marketing

We only send direct marketing where you consent or where otherwise permitted, and always provide a simple opt-out.

11. Your rights (Kenya)

You have rights to be informed, access, correction, objection, deletion, and portability (within 30 days). To exercise rights, email us.

12. Cookies & similar tech

We use essential cookies for authentication and analytics. You can control cookies in your browser.

13. Breach notification

If a notifiable data breach occurs, we will notify the ODPC within 72 hours and affected individuals without undue delay.

14. Registration & ODPC guidance

Under current ODPC guidelines, TBG is not required to register as a data controller or processor because our processing activities are low-risk, small-scale, and do not involve sensitive data. We will, however, review this status regularly and register if our processing expands or ODPC requirements change.

15. Contact us & complaints

16. Changes to this Policy

We'll post updates here and notify you of any material changes. Continued use after updates means acceptance.