Privacy Policy

Code SHEROs is a story-driven coding education platform for children, operated by Codebloom Digital Technologies Limited ("Code SHEROs," "we," "us," or "our"), a company registered in Zambia. This policy explains what information we collect, why we collect it, how we protect it, and the choices you have.

Because our platform is designed for children aged 7 to 12, we take extra care with children's data and follow the Children's Online Privacy Protection Act (COPPA), the Zambia Data Protection Act 2021, the EU General Data Protection Regulation (GDPR) where it applies, and Google Play's Families policy.

Code SHEROs has two kinds of user, and we treat their data differently.

The parent or guardian owns the account. They sign up first and create the child's profile. We rely on the parent to provide consent before their child uses the platform.

The child is the learner. A child cannot create an account on their own. Their profile is created by their parent, and we deliberately collect as little information about the child as possible.

From the parent or guardian

• Email address — this is the parent's login identity and how we send account information and a child's progress updates.
• Name — used only to personalise the progress reports we send. Providing it is optional.
• Password — stored only in a securely hashed form so that no one, including our own staff, can read it.

From the child

• Nickname — a display name chosen by the child. We ask that this is not the child's real name.
• PIN — a short login secret for the child, stored only in a securely hashed form.
• Avatar choice — the character a child picks (Byte, Pixel, or Nova). This is for engagement, not identity.
• Profile photo (optional) — a child may choose to add a picture to their profile. This is entirely optional, is the most identifying item we hold, and can be deleted by the parent or child at any time.
• Learning activity — progress through lessons and missions, coding attempts, hints used, points earned, and the code a child writes while learning. We use this to save progress, award badges, and understand where learners need more help.
• Lesson answers — the free-text answers a child writes during a lesson. See the next section on how these are used.

We do not collect a child's real name, phone number, home address, precise location, or contact list. We do not use advertising identifiers to profile children.

To give a child helpful, encouraging feedback on their coding, the free-text answers and code a child submits during a lesson are sent to OpenAI (which provides the GPT-4o model) to generate that feedback.

We send only the learning content needed to generate feedback. We do not send a child's nickname, PIN, photo, or parent email to OpenAI alongside these answers. OpenAI processes this content to return feedback and does not use data submitted through its API to train its models. We encourage children to write about the coding task and not to include personal information in their answers.

• To create and secure parent and child accounts.
• To deliver lessons and missions and save a child's progress.
• To generate learning feedback, badges, and certificates.
• To send parents account information and progress updates.
• To keep the platform safe, prevent misuse, and fix problems.
• To meet our legal obligations.

We do not use children's personal information for behavioural advertising, and we do not sell any personal information.

A child's account is created by a parent or guardian, who provides consent for their child to use Code SHEROs. As a parent or guardian, you have the right to:

• Review the personal information we hold about your child.
• Ask us to correct or delete your child's information.
• Delete your child's profile or your whole account at any time.
• Withdraw your consent, after which we will stop collecting new information from your child and delete existing data on request.

To exercise any of these rights, email us at hello@codesheros.co.zm from the email on the account, and we will respond promptly.

• All data sent between your device and our servers is encrypted in transit using HTTPS and TLS.
• Passwords and child PINs are stored only as secure hashes, never in plain text.
• Access to accounts uses time-limited session tokens, and signing out invalidates the session.
• A child's code runs in an isolated sandbox in the browser, separated from our systems.
• We collect the minimum data needed, which keeps the most sensitive information out of our systems for most children.

No online service can promise perfect security, but we work to protect your information using appropriate technical and organisational measures.

We do not sell personal information. We share information only with service providers that help us run the platform, and only to the extent needed to provide the service:

• Hosting and infrastructure — providers that run our servers and database.
• OpenAI — to generate learning feedback, as described in section 4.
• Email delivery — to send account and progress emails to parents.

We may also disclose information if required by law, or to protect the safety of a child or another person.

We keep account information for as long as the account is active. When a parent deletes a child's profile or the account, we delete the associated personal information, except where we are required to keep limited records for legal, security, or fraud-prevention reasons.

Code SHEROs may be used by families in other countries. Wherever a child is located, we apply the child-protection practices in this policy. If you are in a region with additional data rights, such as the EU or UK, you may exercise those rights by contacting us.

We may update this policy from time to time. If we make a material change to how we handle children's data, we will notify parents by email and update the date at the top of this page. Continued use after an update means you accept the revised policy.

If you have any questions about this policy or your child's data, please contact our privacy point of contact:

Codebloom Digital Technologies Limited
Email: hello@codesheros.co.zm
Lusaka, Zambia