Privacy Policy

Otakids (otakids.co) is a family chores, rewards and life-skills app operated from Malaysia. This policy explains what we collect, why we collect it, how long we keep it, and the choices you have. We handle personal data in line with the Malaysian Personal Data Protection Act 2010 (PDPA).

The short version: we collect the minimum needed to run the app for your family, we run our own privacy-preserving analytics instead of third-party trackers, there are no ads, and we never sell your data.

• Email address and password — to create and secure your account. Passwords are handled by our authentication provider and stored only in hashed form; we never see them.
• Family name — the display name you choose for your family.
• Parent passcode — the 4-digit code that locks parent settings, stored only as a hash.

Kids don't have accounts, email addresses, or passwords. You (the parent) create their profiles, and each profile contains only:

• A first name or nickname — whatever you choose to type.
• An emoji avatar and a colour — no photos.
• An optional age (7–12) — only if you set it, to pick the right learning level. We never ask for a date of birth.
• An optional kid passcode, stored only as a hash.

We collect no photos of children, no location, no school details, and we never contact children. Everything about a child's profile is created, controlled, and deletable by you.

Our free Skills Check at /checkcan be taken without an account. If you choose to unlock the report, we store: the email address you enter, the child's first name and school year you typed, and the answers given during the check. We use this to show you the report at its private link and to follow up by email about the results and about Otakids. No child account or profile is created, and we collect nothing else about the child. You can ask us to delete a Skills Check record at any time via support.

To make the app work, we store what your family does in it: chores created and completed, points, streaks, badges, reward redemptions, pocket-money balances, and lesson/quiz progress in Power Skills. This data is scoped to your family — other families can never see it — and it exists solely to run these features for you.

• Card payments are processed by Stripe. Your card number goes directly to Stripe and never touches our servers. We keep the plan, amount, date, payment status, and a Stripe customer reference.
• DuitNow QR payments: the payment happens inside your own banking app. You upload a receipt screenshot to confirm it; we store that image privately as part of your payment record.

• Push notifications are strictly opt-in. If you enable them we store a delivery token for your device; disable them anytime in settings or your browser and the token stops being used.
• Analytics: we run our own simple page counter — no Google Analytics, no Meta pixel, no ad trackers. It records the page viewed, your browser type, and a one-way salted hash of your IP address (which cannot be reversed into your IP). That's it.
• Cookies: only the essential sign-in cookies that keep you logged in. No advertising or cross-site tracking cookies.
• Activity listings: if you tap to contact an organizer of a kids' activity, we count that tap (which listing, which channel) so organizers know their listing works. Any message you then send goes directly from you to them.

We share data only with the service providers that run Otakids — our database, authentication and hosting providers, and Stripe for card payments. Each receives only what it needs to do its job. We do not sell or rent personal data to anyone, and we disclose it beyond these providers only if the law requires us to.

• Account and family data — kept while your account is active. When your family is deleted, all profiles, chores, points, progress and related data are deleted with it.
• Payment records (including DuitNow receipts) — kept as long as Malaysian tax and accounting law requires, up to 7 years, even after account deletion.
• Push tokens — until you disable notifications.
• Analytics — kept only in the pseudonymous form described above.

If your subscription lapses, your data is not deleted — it waits safely so you can pick up where you left off if you return.

Under the PDPA you may ask us to access, correct, or delete the personal data we hold about your family. Message us on WhatsApp from your registered family and we'll act on deletion requests within 30 days (payment records excepted, as above).

If we change this policy we'll update this page and the date at the top; for significant changes we'll tell you in the app. Questions? Reach us on WhatsApp (+60194437939). See also our Terms of Service and Refunds & Cancellation policy.