YOUR INFORMATION

TinyNinza privacy policy

Effective date: 6 November 2026 · Version 1.0

TinyNinza is a game-based learning platform for children in Grade 1 to Grade 5, used by children, their parents, and the teachers and schools that work with them. This policy explains what information we collect, why, who can see it, how long we keep it, and the choices you have. It applies to the TinyNinza mobile app (on Google Play as com.sunomi.tinyninza), the TinyNinza teacher and school dashboards, and tinyninza.com.

TinyNinza is operated by Sunomi AI Labs, India (“we”, “us”). We are the data fiduciary for the personal data described here under the Digital Personal Data Protection Act, 2023.

1. Built for children, controlled by adults

• A child never creates a TinyNinza account alone. A parent or guardian creates the child’s profile in the parent app, or a school or tuition teacher creates it under the school’s recorded authority. A parent’s consent is recorded before the child’s data is processed, and a parent who later links to a school-created profile can add their own consent.
• The child’s side of the app has no chat, no messaging, no free-text input and no advertising. Display names are set by a parent or school, not by the child.
• Parents can see what the child does in TinyNinza, see and remove the child’s friends, and stop the child’s use of TinyNinza at any time (see sections 9 and 10).

2. What we collect

Parents and guardians. Name, email address, country, and either a password (stored only as a hash) or a Google sign-in identity. Your consent records: which Terms, Privacy Policy and child notice version you accepted, and when.

Children. Full name and preferred name, grade (Grade 1 to 5), an optional date of birth, country, a student code, an optional avatar choice, and a sign-in credential stored only as a hash. Links to the parent and to any school or teacher. Friend connections the child makes through TinyNinza friend codes, which a parent can see and remove.

Teachers and school staff. Name, email address, school or centre, and the grades and subjects taught; for school staff, a job title. A phone number only if the school provides one.

Learning and gameplay. For each game played: which game, which questions were shown, the answers chosen, whether they were right, the attempt number, hints used, response time, scores, difficulty, and active play time. Streaks, badges, rewards, challenge results, and multiplayer results.

Device and technical. IP address, device platform and the app or browser user agent, recorded for sign-in sessions and security events. Where remote push notifications are turned on, a device identifier and a push notification token for the device.

Support. The subject and text of any message you send to Help & Support. The message text is stored encrypted.

Payments. Subscriptions bought in the Android app are processed by Google Play. We receive the purchase token, product and plan, and store the plan, amount, currency and status; we never see card or bank details. Payments made outside the Android app are processed by Razorpay, and we store only the order and payment identifiers, plan, amount, currency and status.

We do not collect location, contacts, photos, camera or microphone input, voice recordings, biometrics, or advertising identifiers. The app does not ask for these permissions.

3. Why we use it

• To run the games and keep each child’s progress, streaks and rewards.
• To show parents reports by subject, weekly activity and monthly summaries, and to let parents and teachers set challenges.
• To let a child play with a parent, sibling, friend or classmate on two devices, with results shown to both players.
• To show reminders you have asked for, such as a waiting challenge or a daily learning reminder.
• To sign you in securely, prevent misuse, detect account compromise, and keep audit records.
• To answer support requests and manage subscriptions.
• To comply with law and respond to lawful requests.

We rely on the parent’s consent for a child’s data, on your consent for your own account, and on our legitimate need to keep the service secure and to meet legal obligations.

4. What we never do

• No advertising. There are no ad networks or advertising identifiers in TinyNinza.
• No selling or renting personal data.
• No profiling of a child for marketing, and no labelling of a child’s intelligence or ability. Reports describe practice done and topics attempted so that an adult can help.
• No third-party analytics or tracking SDKs in the app or the dashboards.

5. Who can see information

• Linked parents see their child’s activity, reports, friends and settings.
• Teachers and school staff see the students in their own classes or school: assignments, results and progress within that scope. Family challenges set by a parent are not shared with the school.
• Other players in a game or challenge the child joins see the child’s display name and the result. Challenge leaderboards show display names and scores to the children in that challenge. A child who looks up a friend code sees that child’s display name and grade.
• Our staff access personal data only when needed to run the service, answer a support request or investigate a security issue. Changes and exports made by staff are recorded in audit logs.

6. Service providers

We use a small number of providers to run TinyNinza. Each receives only what is needed for its task and may not use it for anything else.

Our servers and database are in India. Some providers listed above process data outside India, for example Google Play and notification delivery through Apple and Google. We do not transfer data to any country where such transfer is restricted by the Indian government.

7. How long we keep it

• Account and profile data is kept while the account is active.
• Learning records (game results, progress and reports) are kept while the child’s profile is active, so that reports and teacher assignments stay meaningful. When a child’s profile is anonymised, its learning records stay only as numbers that no longer identify the child.
• Sign-in records, with their device and network addresses, are deleted after 180 days.
• Payment and invoice records and the audit record of account changes are kept for 8 years, as tax and company law require.
• Consent records are kept so that we can show consent was lawfully obtained.
• Support messages are kept until the request is resolved and for a limited period afterwards.

8. How we protect it

All traffic between the app, the dashboards and our servers is encrypted (HTTPS). Passwords and child sign-in credentials are stored only as salted hashes. Our database is encrypted at rest, and support message text is encrypted in it. Access to production systems is limited to authorised staff. Resetting a password or deleting an account signs out every device.

9. Your rights and choices

Under the Digital Personal Data Protection Act, 2023, you can:

• Access a summary of the personal data we hold about you or your child.
• Correct or complete it. Parents can edit their own and their child’s profile in the app.
• Erase it, by deleting your account (section 10).
• Withdraw consent for your child’s use of TinyNinza at any time, by deleting your account in the app or by writing to us. We then stop processing the child’s data and erase or anonymise it.
• Nominate another person to exercise these rights for you if you are unable to.
• Complain to us first through our Grievance Officer (section 11), and, if you are not satisfied, to the Data Protection Board of India.

To exercise any of these, use Help & Support in the parent app or email support@tinyninza.com. We will verify that you are the account holder or the child’s parent before acting, and we respond within 30 days.

Reminders can be turned off at any time in the app or your device settings. Turning them off does not delete your records.

10. Delete your account and data

In the app: open TinyNinza and sign in as the parent, tap your profile picture at the top right to open Me, then tap Delete account. Confirm with your password or Google sign-in and type DELETE. Deletion happens immediately and cannot be undone. Your sign-in details, contact details and settings are erased, and each child linked only to you is anonymised.

If you can’t use the app: email support@tinyninza.com from the address on your account, or contact TinyNinza, and say which account or child profile you want deleted. We verify the request and complete it within 30 days.

A child who is also enrolled by a school, or linked to another parent, keeps their profile; only your link to the child is removed. For a child profile created by a school, contact the school, which controls that profile, or contact us and we will coordinate with the school. A subscription bought through Google Play must be cancelled in Google Play. Records we are legally required to keep are kept only for the periods in section 7. Full details are on the delete your account page.

11. Contact and Grievance Officer

Sunomi AI Labs, India
Grievance Officer
Email: support@tinyninza.com

We acknowledge privacy complaints within 48 hours and resolve them within 30 days.

12. Cookies and websites

The TinyNinza app sets no cookies. The teacher and school dashboards set only the cookies needed to keep you signed in, and run no third-party analytics. tinyninza.com sets no advertising cookies; it uses analytics and campaign measurement only if you allow them, as described in the website privacy notice.

13. Changes to this policy

We will post any change here with a new effective date and version. If a change materially affects how a child’s data is used, we will notify parents in the app and, where the law requires, ask for consent again before the change applies.