Application Privacy Policy

Welcome to DolaCode (“we”, “our”, “us”), operated by Devnaija Academy. DolaCode is an interactive coding and STEM learning platform designed for kids, young learners, parents, teachers, and schools.

This Privacy Policy outlines how we collect, use, store, share, and protect your personal information when you visit our website, register an account, or interact with our interactive learning stages (DolaCode Numeracy, Block Coding, App Studio, Python Pro, Parent & Teacher Dashboards).

By using DolaCode or signing in via Google OAuth, you agree to the practices described in this policy.

DolaCode provides single sign-on (SSO) integration using Google Sign-In (Google OAuth 2.0) for easy, passwordless authentication.

Data Accessed via Google OAuth:

• Basic Profile Information: Your full name and profile picture URL (used exclusively to display your account name and avatar within the DolaCode header and user dashboard).
• Email Address: Used to uniquely identify your account, send registration verification, passwordless magic login links, and platform notifications.
• Google User ID (`sub` claim): A secure, unique identifier used to link your Google authentication token with your DolaCode student or educator profile.

Google Limited Use Restrictions:

In strict compliance with the Google API Services User Data Policy:

1. We only request access to basic profile scopes necessary for user authentication (openid, profile, email).
2. We do not transfer or share your Google user data with any third party, except as strictly required to provide server hosting or database services essential for app operation.
3. We do not use Google user data for advertising, remarketing, credit assessment, or market research.
4. Human personnel do not read your Google user data unless required for security investigations, user support requests, or compliance with applicable law.

In addition to Google OAuth profile data, we collect information directly provided by users or generated during platform usage:

We process collected data exclusively for valid operational and educational purposes:

• Account Management: Authenticate user sessions, process passwordless logins, and display personalized user profiles.
• Educational Service Delivery: Save coding project progress across Stage 1 (Numeracy), Stage 2 (Block Coding), Stage 3 (Python Pro), and Stage 4 (App Studio).
• Parent & Teacher Dashboards: Provide parents and teachers with learning activity summaries, completed module milestones, and student roster management.
• AI Coding Assistance (Lizzy AI): Provide real-time debugging tips and guidance for Python code exercises without storing sensitive user credentials in AI prompts.
• Platform Security: Monitor and prevent unauthorized access, abuse, spam, or cyber threats.

As a platform built for kids and educational institutions, DolaCode takes children's online safety with utmost seriousness in full compliance with the Children's Online Privacy Protection Act (COPPA) and GDPR for Children (GDPR-K).

We do not sell, rent, or trade your personal data or Google account information to any third party.

We only share data under the following limited circumstances:

• Operational Service Providers: Trusted cloud infrastructure and database providers (e.g., cloud hosting, database management) who operate under strict non-disclosure and data privacy agreements.
• Legal Requirements: If required by valid law enforcement requests, subpoenas, or legal proceedings to protect rights, safety, and property.

Security Protection:

We employ industry-standard security practices, including TLS/HTTPS encryption in transit, hashed passwords, access-controlled cloud infrastructure, and regular security audits to safeguard your account.

Every DolaCode user, parent, and educator has the following rights regarding their data:

• Access & Export: Request a copy of all personal profile information and coding projects stored on DolaCode.
• Correction: Update or correct your profile name, role, or linked contact email at any time in settings.
• Account & Data Deletion: You have the absolute right to request the permanent deletion of your account, Google OAuth token association, and all associated student progress data.