Privacy Policy

1. Introduction

This policy explains what Learning Ability collects when you use the Platform, what never leaves your device, and how to have it corrected or removed. It is written for the Protection of Personal Information Act (POPIA) and sits alongside the Terms of Service.

2. What you give us

• Name — the display name on your account.
• Email address — your login identifier, and the only way back in after a lost password.
• Password — stored as a hash. Nobody at Learning Ability can read it.
• An avatar — only if you upload one; it is stored as media and shown in the account menu.

3. What we record as you use the Platform

• which scenes you reached in a story and which choice you made at each one;
• each practice paper attempt: the score, your answers, the correct answers and how long you took;
• the turns of a freeform story and any picture you save to your account;
• your credit balance, every ledger entry, every purchase, coupon redemption and referral;
• which art styles you unlocked and which stories you opened with credits.

That is the whole list. There is no analytics tool and no advertising tracker on the site, so nothing is being profiled in the background.

4. What stays on your device

The heavy work happens in your browser. Scene illustrations are drawn locally with a one-step Stable Diffusion model over WebGPU; the freeform narrator runs a small language model on your device (WebGPU, or wasm if your browser cannot) and falls back to written prose if it will not start; the language-course voices are device or locally-run synthesis.

Model weights are downloaded once from a public content-delivery network and cached in your browser, so that request — not your story content — is the only thing the model work sends anywhere. Your sketch strokes stay on the device unless you save the picture.

5. Cookies and browser storage

One cookie carries the Payload authentication token that keeps you signed in. Browser local storage holds what makes a reload painless: your draft stories and their images, practice-paper attempts, and your voice and sound preferences.

Clearing site data signs you out and discards those local drafts; the cached models re-download next time you need them. Disabling the cookie means the Platform cannot remember who you are between requests.

6. Server logs

The web server records ordinary request data — IP address, user agent, timestamp, the path asked for — because a server that cannot see that cannot be secured or debugged. We do not build a profile from it and we do not sell it.

7. Why we use your information

• to sign you in, keep the session, and let a confirmed address reset a password;
• to resume a story where you stopped and to mark a practice paper;
• to answer support and privacy requests;
• to reconcile a payment, issue a receipt and reverse a refund;
• to spot abuse, and to keep records the law requires.

8. Email

Only the messages you asked for: the verification link, the password reset, a purchase confirmation, a refund confirmation. No newsletters, no marketing, and no third-party email tracking.

9. Who else sees it

• iKhokha, our payment provider, receives what it needs to take a payment and tells us when one succeeded;
• the hosting and email providers that run the Platform on our behalf;
• anyone we must tell to comply with the law or a court order;
• a successor, if the business or its assets are transferred.

We do not sell your personal information and we do not share it to build advertising profiles.

10. Security

Postgres behind TLS, hashed passwords, admin access limited to the small number of people who need it, and database backups taken on the hosts we control. None of that is unbreakable, so use a password you do not use anywhere else.

11. Children

The Platform is written for learners aged 13 and older and we do not verify ages — registration asks for a name, an email and a password, nothing else. A younger learner should use an account a parent or guardian sets up and can see. If we learn an account belongs to a child under 13 without that consent, we delete it.

12. How long we keep it

For as long as the account is open. Purchase and ledger records stay as long as tax and legal record-keeping requires, which is longer than the account itself.

There is no self-service delete yet: a person does it. Write to the privacy address and the account, its progress and its uploads are removed, leaving only what the law makes us keep.

13. Your rights

Under POPIA you may ask to:

• see what we hold about you;
• correct something inaccurate;
• have it deleted;
• object to a processing you do not accept.

Send the request to privacy@learning.ability from the address on the account. We act on a verified request within 30 days. If you are unhappy with how we handle it, you can complain to the Information Regulator of South Africa.

14. Changes

We update this page when our practices change, with the date at the top showing which version applies. A material change comes to you by email or an in-app notice.

15. Contact

privacy@learning.ability for anything about your information. The registered entity name and postal address are not published yet; ask and we will send what we have.