Privacy Policy

Effective 20 July 2026

Pandai is a children's learning app provided by Mantayay Sdn Bhd. This policy explains what information Pandai uses, why it is used, and the choices available to families.

Children's play

The seven standard learning games do not require an account, name, email address, precise location, advertising identifier, or payment. Pandai contains no advertising and does not sell personal information.

Microphone

Two music activities can use the microphone, with device permission, to recognize piano notes. Audio is analysed live on the device. Pandai does not record, store, or transmit microphone audio. The microphone stops when listening is turned off or the activity is closed.

Grown-up Creator Tools

Creator Tools are behind the grown-up gate and an operator-approved admin tier. They are off by default. When a grown-up opens that area, Pandai creates random device credentials. The access credential is sent securely when checking permissions, but only its one-way hash is stored on our server.

For approved creator devices, Pandai may process:

• maps, titles, settings, and other content the grown-up creates;
• instructions or image prompts the grown-up sends to the creation tools; and
• a random device owner identifier used to keep private drafts separate.

Creator content is stored in Microsoft Azure PostgreSQL. Creation prompts may be processed by Microsoft Azure OpenAI to provide the requested editing or image-generation feature. Creator tools are not available to standard child profiles.

Curated learning marketplace

Creator maps are private while they are drafted and submitted. Mantayay reviews every map before it can appear in the child-facing marketplace. Approved maps show a pseudonymous creator identifier rather than a real name or contact information.

Families can report a map or creator by choosing a structured safety reason. Reports do not accept free-text details. A report also stores one-way hashes of the reporting device's random credential and network address so duplicate reports and abuse can be limited. Blocking a map or creator is stored only on that device.

Service providers and security

Pandai uses Vercel to deliver the web application and Microsoft Azure for database and approved creator processing. Information is encrypted in transit. These providers may process limited technical logs, such as IP address, browser type, and request timing, to operate and secure their services.

Retention and deletion

Standard game progress is not stored on our server. Approved creator maps remain until the creator deletes them or asks us to remove them. Reports remain while they are needed to investigate and document a safety decision. Device entitlement records remain while access is active or needed for security and audit purposes. A parent or guardian may request access deletion or creator-content deletion by contacting us.

Contact

Parent or guardian questions and privacy requests may be sent to Mantayay Sdn Bhd at mantayayaiman@gmail.com.

Changes

We may update this policy when Pandai changes. The effective date above will be updated, and material changes will be communicated through the app or store listing where appropriate.