Privacy Policy

MainBelajar is an educational games platform for Malaysian primary school students (KSSR / Cambridge Primary / US Common Core). This policy explains what personal data we collect, how we use it, and your rights under the Personal Data Protection Act 2010 (PDPA).

Sign-in is via Google only. We do not handle or store passwords — Google authenticates you and tells us only the minimum we need:

• Email address — used as your sign-in identifier and for important account communications.
• Name — displayed on your profile and in the navbar.
• Profile picture URL — your Google avatar (optional).

During onboarding you also tell us:

• Role — teacher, parent, or student.
• Date of birth — used to verify that teacher / parent accounts are 18 or older.

As you use the platform we also store:

• Play stats — which games you play, your scores, when you played them.
• Playlists — any game playlists you create (visible to you; visible to others only if you make them public).
• Login activity — timestamp and count of your sign-ins.

• We do not use third-party advertising trackers.
• We do not collect your address, phone number, IC number, or payment details.
• We do not access your device camera, microphone, or contacts.
• Guests (without an account) leave no personal data — only a device-local play counter in your browser.

We use your data only to:

• Provide the service (let you sign in, save progress, share playlists).
• Show you your own play statistics.
• Aggregate anonymous usage to improve content quality (e.g. identify broken or unpopular games).
• Contact you about important account or service changes.

We do not sell, rent, or trade your personal data to third parties.

Students under 13 should use the service under parental supervision. By selecting the "parent" role at sign-up, parents confirm they consent to their child's use of MainBelajar. Parents can request deletion of a child's account at any time by contacting us via the Feedback button on every page (see §10).

Data is stored on Convex (managed PostgreSQL-style backend, US-hosted) and our frontend is delivered via Cloudflare Pages. Both providers have industry-standard security practices. Authentication tokens are stored in your browser's localStorage.

If you sign in with Google, we receive your email address, display name, and profile picture URL from Google to create your account. We do not receive your Google password, contacts, calendar, or any other data. You can revoke our access at any time from your Google Account permissions page.

As a Malaysian data subject you have the right to:

• Access — see what data we hold about you (visit your profile page).
• Correction — update your name, role, or date of birth on the profile page.
• Withdrawal of consent — sign out and stop using the service at any time.
• Deletion — request permanent deletion of your account and all associated data via the Feedback button (see §10).
• Limit processing — ask us to stop processing your data for any non-essential purpose.

We keep your data while your account is active. If you delete your account, we delete your user record, play stats, and playlists. Aggregated, anonymised stats may be retained indefinitely (we cannot link them back to you).

We use only essential browser storage:

• Auth token (so you stay signed in).
• Language preference (BM or EN).
• Guest play counter (for the 3-games-per-subject preview limit).

No tracking cookies, no analytics cookies, no advertising cookies.

For data requests (deletion, correction, complaints) or any privacy question, use the yellow Feedback button visible at the bottom-right of every page on the site. Tell us what you need and we'll get back to you.

We aim to respond within 7 working days. If you are unsatisfied, you may lodge a complaint with the Personal Data Protection Department of Malaysia.

If we change this policy materially, we will notify signed-in users via a banner the next time they visit. Past versions are archived on request.