Oasis Kids privacy policy

Version [date]. Oasis Kids is a library of learning games for children aged 3 to 7, made for Muslim families, on iPhone and iPad, Android, and the web. This policy explains what we keep about you and your children, why, for how long, who else sees it, and what you can do. We have written it for parents. There is a short version for children in the app, read aloud by one of our characters.

Who we are

Oasis Kids is run by Fluxter Limited, a company registered in England and Wales, company number 13135508, registered office 92 Station Lane, Hornchurch, Essex, United Kingdom, RM12 6LX ("we"). We decide how your family's data is used: in data protection law we are the controller. Write to us at [email protected] about anything in this policy, or by post to the address above. [Our data protection officer: name or service, and contact.] [Our representative in the EU or the UK: name and contact.] We are registered with the UK Information Commissioner's Office, registration number [number].

The short version

• We keep only what the games and the parent area need, and we use it only for that.
• We never show ads, never sell data, and never let other companies track your children.
• Nothing about a child leaves the device until you, the parent, have agreed.
• You can see, download, change, and delete everything we keep, at any time, in the parent area.
• Oasis Kids is made for Muslim families, so using it can show that your family is Muslim. We treat everything we keep about your family as sensitive data, and ask for your explicit consent to it.

What we keep about you

• Your account: your email address, your name if you give it, how you sign in (passkeys, or a password, which we store only as a secure hash), the devices you sign in, and the carers you invite.
• Your consent: when and how you gave it, which version of the notice you saw, and the choices you made, so we can show that you agreed.
• Your subscription: whether your family has access, and the store's transaction details (ids, the plan, the dates). If you pay on our website, Paddle takes the payment (see below), and we keep the amounts for our accounts. We never see your card details.
• What you tell us: your answers to our short questions, and messages you send us.
• Messages you turn on: if you ask for progress messages or notifications, we send them; they are off until you turn them on.

What we keep about your children

Children never type their names, and never share anything with other people in Oasis Kids. For each child you add, we keep:

• The profile: the first name or nickname you choose, a picture from our own set, the school year, and the child's settings.
• What they learn: a record of each answer in a game, and the skills worked out from them. Oasis Kids works out which skills your child has learned from normal play, so it can choose the right level and show you their progress. It is not a test, it makes no decision about your child beyond the next level to play, and it never compares children.
• When and what they play: when each session and activity starts and ends.
• Play signals: more detail about play, such as where your child left an activity or needed help, so you can see where they got stuck and the games can offer activities they enjoy at the same level. On for every child; you can switch them off for each child.
• Feedback moments: now and then, from reception age, a game asks your child with a tap whether they liked an activity. The answers show you what they enjoy and help choose between activities at the same level. On for every child; you can switch them off for each child.

We never ask for or keep a child's date of birth, surname, photo, voice, video, location, contacts, or advertising or device identifiers, or anything a child writes.

Why we use it, and our legal basis

What	Why	Legal basis (UK and EU GDPR)
Your account and subscription	To run your family account and give your family access	Our contract with you
Your children's profiles, learning records, and play records	To run the games, choose the right level, and show you each child's progress	Our legitimate interests in providing the learning service you signed up for, which we have balanced against your children's interests in our data protection impact assessment
Play signals and feedback moments	To show you where your child got stuck and what they enjoyed, and choose activities they enjoy	Our legitimate interests, as part of the learning service; you can switch each off
Learning from many children together	To find, from groups of at least 30 children, where games work and where children struggle, and improve them. Only for children whose parent has left play signals on	Our legitimate interests; in the UK, the law's allowance for statistics that improve a service. [EU: as the legal review of item 0082 answers.]
Everything we keep about your family	Using an app for Muslim families can reveal your religion, which is special category data	Your explicit consent, which you give when you sign up
Server, security, and error logs, including the IP address of each request	To keep the service running and safe, and to find and fix problems	Our legitimate interests, and our legal duty to keep data secure
Tax and accounting records	The law requires them	Legal obligation

In the United States, we ask for your verifiable parental consent before we collect any personal information from your child, under the Children's Online Privacy Protection Act (COPPA). We do not let your child give more information than a game needs to play, and we never make a child's play depend on giving more.

Who else sees it

We never sell your family's data or share it for advertising. Nothing about your children goes to Apple, Google, Paddle, or any other company except the ones that work for us below.

• Companies that work for us (processors), under contracts that let them use the data only to run Oasis Kids, never for their own purposes:
  • our cloud host, [name], which runs our servers in [UK or EU region] and holds everything above;
  • our email provider, [name], in [UK or EU], which sends the emails you need and the ones you turn on;
  • Cloudflare, a US company, which delivers the game files to your devices quickly from servers around the world. It sees your device's IP address and which game file was requested, never who you are, and keeps that in its records for at least 31 days. Its contract protects the data under the EU-US Data Privacy Framework, its UK extension, and standard contractual clauses.
• Companies that take payment and decide for themselves how to use your payment details, under their own privacy policies:
  • Paddle ([Paddle's entity]) takes payment when you subscribe on our website, as the seller (merchant of record). It receives your name, email, billing details, and country, and an id that links the payment to your family, never anything about your children. [Paddle's privacy notice: link.]
  • Apple takes payment when you subscribe in the iPhone or iPad app. We send Apple only a random code to link the purchase to your family. [Apple's privacy policy: link.]
• Push messages, if you turn them on: Apple and Google carry a message to your phone that says only that something is ready, never a name or anything about your child.
• When the law requires it, for example a court order, we may have to give data to the authorities. We will tell you unless the law forbids it.

Where it is kept

On your family's own devices, and on our servers in [the UK or the EU]. Apple, Google, and Paddle, as above, may handle the parts they receive outside the UK and the EU, under their own safeguards. Cloudflare's network is worldwide.

How long we keep it

We never keep anything forever. The periods below are our written data retention policy:

What	How long
Your account	While it is open; deleted within 30 days after you delete it
Proof of your consent and of deletion	6 years after the account is deleted, the time a legal claim could be made; it holds no data about your children
A child's profile, learning records, and skills	While the profile exists, so you keep the record of your child's progress over the years
When and what a child plays, play signals, and feedback answers	12 months, then deleted
Your answers to our questions	12 months, then only totals are kept; messages you send us, 12 months after the matter is closed
Totals for groups of at least 30 children	As long as useful; they hold nothing about any one child
Subscription records	Access while the account is open; transaction records 6 years after the end of the financial year, as UK company law requires
Server request logs, with each request's IP address	Kept only briefly: newer lines replace them, and they are never copied elsewhere or analysed
Security and error logs	30 days
Records of game downloads on our own server	Only in the server request logs above (Cloudflare, above, keeps its own for at least 31 days)

If your family stops using Oasis Kids: after 24 months with no sign-in, no play, and no subscription, we email you; 30 days later, unless you sign in, we delete the account and all your children's data.

When you delete something, it disappears from the app at once, leaves our servers within 30 days (normally within a day), leaves our backups within 35 days, and leaves your other devices the next time they connect.

Your choices and rights

In the parent area, behind the parental gate, you can:

• see each child's progress and a page of everything we keep about them, with each setting;
• switch off play signals and feedback moments for each child; recording stops at once, and what they covered is deleted within 30 days;
• change a child's name, picture, or school year, remove a session, or start a child's progress again;
• download everything we keep about your family, ready within minutes;
• delete a child's profile or the whole account, which also takes back your consent. On iPhone and iPad, deleting starts in the app; everywhere, it can be done on our website.

You also have the right to ask us for a copy of your data, to correct it, to delete it, to limit or object to how we use it, and to take it elsewhere. Write to [email protected]; we answer within one month. In the United States you can review your child's information, ask us to delete it, and refuse any further collection at any time. If you are unhappy with how we handle your data, please tell us first; you can also complain to the UK Information Commissioner's Office (ico.org.uk), the data protection authority where you live, or, in the United States, the Federal Trade Commission.

Cookies and storage

The apps keep your children's records on the device, so the games work offline. The website's parent area uses only the cookies it needs to keep you signed in. We use no advertising or analytics cookies, and no tracking of any kind.

Security

We protect your family's data as sensitive data: it is encrypted on the way to us and on our servers, and only the few people who run Oasis Kids can reach it, only to answer your request, for security, or when the law requires, and every access is recorded. If something ever goes wrong with your family's data, we will tell you and the regulator as the law requires.

Changes

If we change this policy in a way that matters, we tell you in the parent area and by email first, and ask for your consent again when the law requires it.