Privacy Policy

1. Who we are

MyOda is operated by Daticks Technology Limited, a company registered in Nigeria (“we”, “us”). For any privacy or data protection enquiry, contact myodahq@gmail.com.

2. Information we collect

• Creator names, email addresses, authentication information and records of Terms acceptance. The Privacy Policy is linked at signup; acknowledging it is not a separate consent to every processing purpose.
• Educational content and branding assets (such as logos) that creators upload.
• Learner display names, optional class or group codes, exercise answers, attempts, scores and feedback.
• Live Play participant display names, responses and scores.
• Technical and security information needed to operate the platform, such as hashed network addresses used for rate limiting and abuse prevention.
• Support emails you send us (including your email address, message and any attachments), historical support tickets from our former contact form, and payment records described in section 8.

3. How we use information

We use information to create and administer accounts; deliver interactive exercises and assessments; provide learner results to the creator who shared the exercise; host real-time Live Play sessions; process and verify payments; respond to support and privacy requests; prevent fraud, misuse and unauthorised access; and maintain service reliability and security.

4. Learner privacy

Learners do not need a MyOda account to complete shared exercises. The name a learner enters and their exercise results are visible to the creator who shared the exercise, and this is shown to learners before they start. Access to a learner’s own private history relies on a random private token kept on their device, not their name. A name alone is not secure proof of identity; using a shared device may allow another person on that device to access the same history. Public sample demos do not save learner attempts to a creator’s results.

5. Live Play

Participants join with a room code and a display name; no email address or password is required. The host can see participant names, responses and scores; participant names and scores may also appear on the room’s leaderboard. Polls do not have correct answers or award leaderboard points.

Live Play records are temporary. Cleanup is scheduled hourly to delete rooms that ended at least 24 hours earlier, normally within about 25 hours of ending when cleanup runs successfully. Rooms left active for more than 24 hours are ended by cleanup and become eligible for deletion 24 hours after that. Delays or a cleanup backlog may extend these times. Hosts can delete ended rooms sooner. This cleanup does not delete ordinary exercise results.

6. Security and confidentiality

We use safeguards including authenticated creator access, owner-scoped access rules and server-side grading. Private answer keys are not included in active learner questions; feedback and review can show solutions when the exercise’s answer-visibility settings allow it. Exercise access codes have a one-way hash for entry checks and a separately encrypted copy that lets the authorised creator retrieve their saved code. Branding and exercise images may be displayed to people using the exercise through time-limited signed links.

No method of transmission or storage is completely secure. We may disclose information where required by law, subject to appropriate safeguards.

7. Service providers and international transfers

MyOda uses Lovable Cloud for its configured database, authentication and private file storage, hosting services to deliver the application, Paystack for payments, and Gmail for the public support mailbox. These services may process information needed to provide their services. Email sent to our support address is handled through your email provider and our Gmail mailbox; it is not automatically submitted to MyOda’s Admin Support inbox.

Information may be processed outside Nigeria. We do not represent that all data remains in Nigeria or specify a processing location that we have not verified. Applicable data protection requirements govern international transfers. Contact us for information about the providers and transfer arrangements relevant to your information.

8. Payments

Payments are processed by Paystack under its own terms and privacy policy. MyOda does not store full card numbers or card security codes. We keep payment references, amounts, currency, status, provider transaction identifiers and verification results so we can activate paid access, keep billing records and resolve disputes. Earlier payment records processed by Flutterwave are retained for the same purposes.

9. Cookies, browser storage and website analytics

We use essential browser storage to keep creators signed in, remember a learner’s progress and private history token on their own device, and keep a Live Play seat after a page refresh. These are needed for the service to work and do not require consent.

We measure aggregate use of public pages and selected public buttons solely to improve MyOda’s website. These are anonymous daily totals (page, button, broad traffic source and device type); we set no analytics cookies, store no visitor or session identifier on your device and build no browsing profiles. There is no automatically displayed analytics banner, and you can opt out free of charge at any time. For requests our hosting infrastructure places in the European Economic Area or Switzerland, these counts are recorded only if you voluntarily allow anonymous analytics through the footer’s “Analytics preferences”. Geography is approximate. No advertising or other consent-required tracking is enabled.

New analytics requests contain only an allowlisted public page path (no queries or fragments), fixed button or demo category, broad source category and screen-width device category. Requests omit sign-in cookies and full referrer URLs. We immediately increment daily counters; we do not store individual analytics events, exact event times, country, IP addresses, user agents, visitor identifiers, sessions or browsing journeys in those counters. No analytics cookies, advertising trackers, device fingerprinting or personal browsing profiles are used. Counts are not unique visitors or 30-minute visits. Private learner links, answers, Live Play rooms, account dashboards, payment details and form contents are excluded.

Hosting infrastructure necessarily processes network addresses to deliver requests and provide approximate country information. A separately stored, salted, hourly network hash is used only to limit abusive requests, never joined to analytics, and removed when the collector next runs after it is over an hour old. Operational hosting/security processing is separate from anonymous statistics; we do not claim all infrastructure requests are anonymous or that every provider log’s retention has been verified. Our providers may process data on our behalf to operate and improve this service, not to create advertising profiles for us. Applicable data protection obligations, including lawful bases, safeguards and international-transfer requirements, continue to apply to transient personal-data and security processing; the statistical exception does not override them.

Choose “Analytics preferences” in the footer, then “Opt out of analytics”, at any time, free of charge. This immediately stops future analytics requests and discards unsent counts. We also honour Do Not Track and Global Privacy Control signals; the preferences panel shows when those signals block collection. A device-local preference remembers your choice; it is not a visitor identifier and applies to that browser until cleared or changed. You can voluntarily allow anonymous analytics there, without enabling session tracking or advertising. Old consented, pseudonymous session and consent records remain separate; their browser visit identifier is no longer created and is cleared by the new collector. Withdrawal does not erase already recorded historical data or anonymous totals. New daily counters are removed after 13 months when collection next runs; historical event cleanup remains subject to its existing scheduled-on-ingestion process. Button counts include demo selections, starts and completions, but exclude form submissions. Verified registrations and payments remain separate service records, never inferred from clicks.

10. Children and educational use

Creators must have the legal capacity and authority to accept the Terms. MyOda does not currently verify ages or collect parental or school permission through its signup or learner entry screens. Creators, teachers and organisations sharing exercises with children must obtain any permissions required for their educational use and comply with applicable child privacy and safeguarding rules; a room or access code does not establish consent. Please minimise learner information and avoid sensitive details in names and answers. MyOda retains its own obligations under applicable data protection law. Contact us about participation or information concerning a child.

11. Your rights and lawful processing

Depending on applicable law, including the Nigeria Data Protection Act 2023, you may have rights to access, correct, delete or obtain a copy of personal information, object to or restrict processing, and withdraw consent where processing relies on consent. You may complain to the Nigeria Data Protection Commission. Send requests to myodahq@gmail.com; we may ask for proportionate information to verify your identity, without relying on a learner name alone.

We process information for the purposes in section 3, subject to an applicable lawful basis. Depending on the activity, this may involve providing a requested service, complying with legal obligations, legitimate interests subject to applicable rights and safeguards, or consent where required. Accepting the Terms is not blanket consent to every use of personal data. Daticks Technology Limited determines the purposes of MyOda account administration, billing, support and platform security. Educators also make decisions about the learner information and educational activities they submit; responsibility for a particular use depends on the activity and applicable law, not a blanket assumption that educators alone are responsible.

12. Retention and deletion

Ordinary learner results and exercise-version records have no automatic expiry currently configured. They are kept for review and historical integrity; disabling, unpublishing or soft-deleting an exercise, or expiry of Pro, does not automatically erase past results. Creators can delete individual learner attempts. Live Play has the separate temporary retention described in section 5.

Creators can request account deletion from Account Settings or by emailing myodahq@gmail.com. The process includes identity checks, administrator review and a record of the request and relevant account information before account removal is attempted. Related records or technical constraints can require further handling, so this is not an immediate or guaranteed complete-erasure process. Historical support tickets remain restricted to authorised administrators; support emails are handled in our mailbox.

No automatic deletion schedule is currently configured for uploaded files, historical support records, payment records, non-Live security hashes or account-deletion archives. Removing a file from an exercise or branding display does not necessarily remove the stored file, and an expired signed link does not delete it. Records may remain stored until separately removed; we do not promise an unverified fixed retention period. Contact us to request review or deletion of particular information. Any refusal or retention needed for applicable legal, accounting, fraud-prevention or security obligations remains subject to your statutory rights.

13. Changes

We may update this policy. The effective date above will change, and we will give notice of material changes where appropriate.