Privacy Policy

Last updated: 23 October 2026

Hello! Magic Spider is a personal project made by one person who is building an app for the first time. I am doing my best, but there may be mistakes along the way. Thank you for your patience and kindness. If you find something wrong, please tell me at magicspiderteam@gmail.com and I will fix it as soon as I can.

This policy explains how Magic Spider (“we”, “us”) collects, uses and protects personal data when parents and children use our learning app, on the website and in the Android and iPhone apps. We aim to follow Singapore’s Personal Data Protection Act 2012 (PDPA).

1. Who we are

Magic Spider is a personal project run by an individual developer in Singapore, not by a company. For any privacy question or request, please write to magicspiderteam@gmail.com.

2. Personal data we collect

• Parent account: email address and password. Passwords are stored only in a scrambled (hashed) form, never as plain text.
• Child profiles (created by the parent): first name or nickname, school grade, and subject levels.
• Learning activity: answers, scores, points, mock exam results, written answers, and when activities were done.
• Feedback: if a parent uses the feedback chat, we keep the star rating, the choices they pick, any message they write, whether we may email them back, the platform (website, Android or iPhone), the app version and the account it came from. Please do not put your child’s full name or other personal details in the message.
• On your phone: the Android and iPhone apps keep your sign-in on the phone in its secure storage, and your theme choice. The apps have no advertising or analytics tools.
• Delivery details (only if you order a physical item): name, phone number and address.
• Payments: handled by our payment provider, Stripe. We do not see or store your card number.

3. How we use it

• To run your account and let your children practise, track progress and see results.
• To show parents progress reports and to improve our questions and features.
• To process purchases and deliver items you order.
• To keep the service safe, prevent misuse, and meet legal requirements.

We do not sell personal data, and we do not show advertising to children.

4. Children’s data

Child profiles can only be created by a parent or guardian, who gives consent on the child’s behalf. We ask only for what we need: a first name or nickname is enough. Parents can view their child’s activity at any time and can ask us to correct or delete it.

5. Sharing

We share personal data only with service providers who help us run Magic Spider, such as our hosting provider (Amazon Web Services, servers in Singapore), Google (which delivers the emails we send, such as sign-up codes) and Stripe for payments on the website, and only for that purpose. We may also disclose data where the law requires it.

6. AI tools and your data

• Our questions are generated and checked using AI tools, including Claude (Anthropic). We use these tools to create question content such as wording and answer options.
• We do not send your child’s name, your email, or any account or learning record to these AI tools. Only general instructions about the type of question needed are sent.
• AI can make mistakes. Please see our Terms of Use and check other valid sources if something looks wrong.

7. Payments and payment risk

• Payments are processed by Stripe (cards and PayNow). We receive limited information such as the plan bought, amount, payment status, and a customer reference. We do not store your card number.
• Stripe and your bank handle your payment data under their own privacy and security terms. Online payments carry risks such as fraud, phishing, wrong transfers and unauthorised charges. Keep your login private, check amounts before you pay, and contact your bank and us if something looks wrong.
• We keep payment records as required by law (for example for accounting and tax).

8. Sending data overseas

Our servers are in Singapore. Some providers, such as Stripe and AI tool providers, may process data in other countries. Where this happens we take reasonable steps to make sure the data is protected to a standard comparable to the PDPA.

9. Cookies

We use one essential cookie to keep you logged in. We do not use advertising or tracking cookies.

10. How long we keep data

We keep personal data while your account is active. When you close your account, we delete or anonymise your data within a reasonable time, unless we must keep some records by law (for example, payment records). You can delete your account and your children’s data yourself in Settings on the website or in Me in the apps; this also deletes your feedback.

11. Your rights

You can ask to access or correct your personal data, withdraw your consent, or have your account and your children’s data deleted. Email magicspiderteam@gmail.com and we will respond within a reasonable time. Withdrawing consent may mean we can no longer provide the service.

12. Keeping data safe

We make reasonable security arrangements to protect personal data from unauthorised access, use or loss. No online service can be completely secure, so please keep your password private.

13. Data breaches

If a data breach is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as required by the PDPA.

14. Changes

We may update this policy from time to time. We will post the new version here with a new date, and tell you about important changes.