Privacy policy

1. Who is responsible

ELK Consulting LTD, Royal Road, Bain Boeuf, Pereybere, Mauritius, is the data controller. For any question about your data or your child’s: privacy@shekiverse.com. To report a security issue: security@shekiverse.com.

2. Using the app without an account

Games and the Academy work without an account. In this mode, ShekiVerse collects no personal data and sends nothing to its servers: the chosen language, age group, progress (stars) and sound setting stay on the device, and disappear when the app is uninstalled.

If advertising is shown in your country (see “Advertising”), Google’s advertising kit contacts Google’s servers to display and count ads.

3. Parent account data

• email address and password (the password is stored as an irreversible hash, never in plain text);
• country of residence and preferred language;
• parental verification status and the method used. If you receive a code by phone, the number is not kept: only a hash and its last two digits are, to prevent reuse and to show it back to you. During an assisted identity check, we note only the type of document shown, never a copy of it;
• consents given and parental settings, with their date;
• sign-in sessions (technical tokens, IP address and device at sign-in).

4. Child profile data

The profile is created by the parent, never by the child alone. It contains:

• a nickname chosen with the parent, the month and year of birth (not the exact date), the country and languages;
• parental settings: quiet hours, daily time limit, friend approval rules;
• a friend code, the list of approved friends, pending requests and blocked people;
• messages exchanged with approved friends, with the result of automatic filtering, and reports;
• sessions of the linked device (technical tokens that expire after 90 days without use).

We never ask a child for a photo, surname, address, school, phone number or location. Message filtering also blocks this kind of information.

5. Why we use this data, and on what basis

• to run the requested service (account, profiles, friends, messaging) — performance of the contract with the parent;
• to obtain and verify parental consent, as required by child protection laws (including COPPA in the United States, the GDPR in Europe and the Data Protection Act in Mauritius) — legal obligation and parental consent;
• to protect children: message filtering, reports, blocking, abuse prevention — legitimate interest and the vital interests of children;
• to keep the service secure and prevent fraud (technical logs without message content) — legitimate interest;
• to answer your requests and tell you about important changes — legitimate interest.

We do no advertising profiling, no sale or rental of data and no automated decision-making with legal effects. Message filtering is automatic, but a held message may be reviewed by our safety team, and any sanction on an account is decided by a person.

6. Children and parental consent

Social features are only available after a parent has been verified: a one-time code (email or WhatsApp), then an identity check. The parent can at any time review their child’s data, export it, have it corrected, delete it and withdraw consent; withdrawing consent ends the profile’s social features.

We never make a child’s participation in a game or activity conditional on providing more data than necessary.

For ages 13 to 15, the parent can choose to be informed of new friends rather than approving each one. The messaging safety rules stay the same.

7. Advertising

To stay free, the app may show Google AdMob banners on three screens: home, the games list and the results screen. Every request is flagged as “directed to children”, limited to content suitable for all ages (G rating) and non-personalised. No advertising ID is read, and video ads and sensitive categories are excluded. Google receives technical data (IP address, device model and system, app version) to display the ad, measure it and fight fraud.

No advertising appears during a game, in messaging or in the parent screens. Advertising is not shown in the European Union, the European Economic Area, the United Kingdom, Switzerland, China, Russia or Belarus, nor when the device’s country is unknown. If the parent has given their country, that country is used.

8. This website and the parent space

This website uses no advertising cookies, no audience measurement tool and no tracking pixel. The parent space only uses strictly necessary technical cookies: the sign-in session and protection against forged requests (CSRF). These cookies serve no other purpose and do not require consent.

Our emails (verification codes) contain no tracking pixel and no tracking links.

9. Our service providers

• Railway (hosting of the app, parent space and database, United States);
• Cloudflare (DNS, website protection, routing of incoming email);
• Resend (sending verification emails, servers in Ireland);
• Meta / WhatsApp, only if the parent chooses WhatsApp to receive or send their code;
• Google AdMob (advertising, where it is shown), Google Play and the Apple App Store (app distribution);
• Anthropic (assisted writing of this website’s blog articles; no family or child data is sent to it).

These providers act only on our instructions, or under their own terms for the stores and advertising. We give them only what they need for their task.

10. Transfers outside your country

Data is hosted in the United States and may be processed in other countries by our providers. Where the law requires it, these transfers are covered by appropriate safeguards, such as the European Commission’s standard contractual clauses or equivalent mechanisms.

11. How long we keep data

• parent account and profiles: as long as the account exists;
• deleting a child profile: the profile, its messages, friends, settings and sessions are erased immediately;
• deleting the parent account: the account and every attached profile are erased immediately;
• verification and pairing codes: a few minutes;
• sessions: 30 days without use for a parent, 90 days for a child;
• security logs (which contain no message content): as long as needed to keep the service secure and meet our legal obligations.

12. Your rights

From the parent space, you can at any time review, export, correct or delete your child’s data, withdraw consent and delete your own account (“My account”). For any other request — access, correction, objection, restriction, portability — write to privacy@shekiverse.com. We may ask you to confirm that the request comes from the account holder. We reply within one month.

You can also contact the data protection authority of your country: in Mauritius, the Data Protection Office; in the European Union, your national authority; in the United States, the Federal Trade Commission.

13. Security

Connections are encrypted (HTTPS). Passwords, codes and phone numbers are stored as hashes. Our team’s access is limited to what is strictly necessary, protected by two-factor authentication and logged. If a data breach creates a risk, we notify the authorities and the parents concerned within the time limits set by law.

14. Changes

If this policy changes significantly, we will inform parents by email before it takes effect and, where the law requires it, ask for their consent again. The date of the last update is shown at the top of the page.