Privacy policy

What this policy covers

This policy explains the personal information Mindlah collects from hosts and players, how it is used, and the choices you have. We handle personal data in line with Malaysia's Personal Data Protection Act 2010 (PDPA).

What we collect from hosts

When you sign up, we store your name, email address and password. The password is stored as a hash, not as the original text, so we cannot read it ourselves.

After you sign up, we send one email to verify your address, and keep the date it was verified.

Optionally, you can add an account type (teacher, student, personal or work), the name of your school or workplace, and an avatar.

We also store the quizzes you build, including pictures you upload. Pictures are re-encoded on upload, and hidden details such as GPS location are removed.

When you buy a pass or a subscription, we keep a record of the purchase: the product, amount, date, the time it is valid for and a reference number. We do not keep your card or bank account details. Purchase records are kept for accounting even after an account is deleted, with nothing linking them to you.

What we collect from players

Players do not sign up for an account. We do not ask for their email, phone number or real name.

For each game, we store the nickname chosen, the answers, response times, score, rank and team. This record becomes part of the host's game history.

We encourage players, especially children, to choose a nickname rather than their full name.

Cookies and browser storage

We use only necessary cookies, which keep a host signed in securely. Your chosen language is carried in the page address, not in a cookie.

A player's browser stores one small code so they can reconnect to a game if the connection drops. A host's browser remembers whether sound is muted.

We do not use advertising cookies or third-party analytics tools.

IP addresses

Your IP address is used briefly to limit repeated attempts, such as too many sign-in tries. It is not stored in our database.

How we use information

We use this information to run games, show results to the host, keep accounts secure, and count which library quizzes are played most.

We do not sell personal data and do not use it for advertising.

Who can see information

A host can see the nicknames, answers and scores of players in the games they host. During a game, nicknames and scores are shown on the big screen.

Mindlah administrators can see host account details for support and plan management.

The verification email is sent through Resend, an email delivery provider, which receives your name and email address for that purpose only.

The hosting providers that run servers on our behalf process this data for us. Beyond that, we disclose information only when the law requires it.

How long we keep it

We keep accounts, quizzes and game history for as long as the host's account exists. When a host deletes their account, the account, all its quizzes and all its game history, including player records, are deleted too.

Your rights

You have the right to ask for access to your personal data, to correct it, to withdraw consent, and to ask for it to be deleted.

Hosts can edit their profile and delete their own account on the My account page. Players can ask the host of that game, or write to us through the Contact us page.

Children

Mindlah is used in schools and at family gatherings, so players may be children. They play with a nickname only, in games hosted by a teacher, parent or guardian.

Anyone under 18 needs permission from a parent, guardian or teacher to sign up for a host account.

Security

Passwords are hashed, and each host can reach only their own quizzes and history. No system is completely secure, but we work to protect your data and will tell you if an incident affects your account.

Changes to this policy

If this policy changes, we will update the date above. For major changes, we will tell hosts by email or inside the app.

Contact us

For any privacy question or a request about your data, write to us through the Contact us page.