Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

• Tauschool Sdn Bhd
• Email: [email protected]
• Data Protection Officer Contact: [email protected]

2. Personal Data We Collect

Account Information (provided by you at signup):

• Full name
• Email address
• Phone number (optional, if you choose phone sign-in)
• Syllabus selection (KSSM or IGCSE)
• Year/Form selection
• Age confirmation (whether you are under 18)

Authentication Data (collected automatically):

• Firebase User ID
• Authentication method used (Google, email, or phone)
• Google profile photo URL (if signing in with Google)

Usage Data (collected automatically as you use the platform):

• Quiz history: subjects attempted, chapters attempted, quiz mode selected, scores, time taken, answers given, questions shown
• Progress data: recently seen questions, saved quiz progress
• Streak and activity data: last active date, total questions answered, total quizzes completed, average scores
• Device and browser information: browser type, operating system, screen size
• IP address (collected by Firebase infrastructure)

Data We Do NOT Collect:

• Malaysian IC (MyKad) number or passport number
• Payment or financial information (tauschool is currently free)
• Biometric data
• Sensitive personal data as defined by the PDPA
• Location data beyond what is inferred from IP address

3. Purpose of Data Collection

We collect and process your personal data for the following purposes only:

• Account creation and authentication
• Platform functionality — delivering quizzes, tracking progress, calculating scores, displaying performance data
• Avoiding question repetition
• Save and resume quiz functionality
• Platform improvement
• Account-related communications (not marketing)

We do NOT sell your personal data to third parties or use it for profiling or automated decision-making. Advertising on the free tier may be served by Google AdSense or equivalent partners; if and when this is implemented we will seek your explicit consent and update this policy.

4. Consent for Minors (Under 18)

In compliance with the Personal Data Protection Regulations 2013, if you are under the age of 18, we require the consent of your parent, guardian, or person with parental responsibility before we process your personal data. During signup, users under 18 must confirm they have obtained parental or guardian consent. We encourage parents and guardians to supervise their children's use of tauschool and to contact us at [email protected] with any questions.

5. Data Storage and Security

Your personal data is stored using Firebase (Google Cloud Platform). Firebase servers are located outside Malaysia, primarily in the United States. We implement the following security measures:

• Encryption (HTTPS)
• Firebase Authentication security protocols
• Firestore security rules restricting access to authenticated users' own data
• Secure password hashing
• One-time verification codes for phone authentication

No system is completely secure. If we become aware of a data breach likely to cause significant harm, we will notify you and the Personal Data Protection Commissioner in accordance with Section 12B of the PDPA.

6. Cross-Border Data Transfer

By using tauschool, you consent to the transfer of your personal data to servers located outside Malaysia (Google Cloud / Firebase infrastructure) under Section 129 of the PDPA. Google Cloud Platform maintains data protection standards providing adequate protection equivalent to the PDPA. For more information: https://firebase.google.com/support/privacy

7. Data Sharing and Disclosure

We do NOT sell, rent, or trade your personal data. We share data only with:

• Firebase / Google Cloud (platform infrastructure)
• Firebase Analytics (anonymised usage statistics)

We may disclose data if required by law or to protect the rights and safety of tauschool and our users.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, all data is deleted within 30 days except where retention is required by law.

9. Your Rights Under the PDPA

You have the right to:

• Access your personal data (Section 30)
• Correct inaccurate data (Section 34)
• Withdraw consent (Section 38)
• Prevent processing causing unwarranted harm (Section 42)
• Opt out of direct marketing (Section 43)
• Data portability (Section 43A)
• Request account and data deletion

Contact [email protected] to exercise any right. We respond within 21 days.

10. Account Deletion

Request deletion via Settings → Delete Account or email [email protected]. We will delete all user data, quiz history, saved progress, and your Firebase Authentication account within 30 days.

11. Data Breach Notification

If a breach likely to cause significant harm occurs, we will notify the Personal Data Protection Commissioner and affected users directly via email.

12. Cookies and Tracking

We use the following:

• localStorage for language preference (device-only)
• Firebase Authentication tokens (essential)
• Firebase Analytics (anonymised)

We do not use third-party advertising cookies. If advertising is introduced, we will update this policy and seek consent.

13. Changes to This Privacy Policy

Material changes will be communicated via email or in-platform notification. We encourage periodic review.

14. Contact Us

Data Protection Officer: [email protected]

Complaints may be lodged with:

• Jabatan Perlindungan Data Peribadi (JPDP)
• Level 8, Galeria PjH, Jalan P4W, Persiaran Perdana, Precinct 4, 62100 Putrajaya, Malaysia
• Tel: 03-8000 8000 (MyGCC)
• Email: [email protected]
• Website: www.pdp.gov.my