Privacy Policy

Effective date: 1 November 2026.

This policy explains what information the BANA-X SmartCents app (Android) and this website collect, why, who helps us process it, how long we keep it and how you can delete it.

The app is for parents and legal guardians (adults aged 18 or older) who use it with their own children, who are usually of primary-school age (about 6 to 12). Children use the app only inside their grown-up's account.

1. Who we are

BANA-X SmartCents is provided by BANA-X (Pty) Ltd, registration number 2026/391483/07, a private company registered in South Africa. Directors: Benjamin Narainsamy, Natalie Narainsamy and Allegra Narainsamy. Our Information Officer is Benjamin Narainsamy. You can reach us at support@bana-x.com. Telephone: +27 73 086 3077. Registered address: 47 Proot Street, Roodepoort, 1724, Gauteng, South Africa. Website: smartcents.bana-x.com.

Words we use: "You" means the parent or legal guardian who signs up. "Your account" is the grown-up account you sign up with. A "child profile" is a profile you add inside your account for a child. "Kid device" means a tablet or phone a child uses with the app, signed in to a child profile, or Kids Mode on a grown-up's phone. "Your child" means a child who uses a child profile in your account. "SmartCents" are the points used in the app; they are not money (see our Terms of Service).

2. What we collect

From you (the grown-up)

• Your email address and password, to sign in. The password is handled by Google Firebase Authentication and is never stored in our database. We do not ask for your name.
• Your country (South Africa, Namibia, Australia, New Zealand, the United States, Canada or Singapore) and your time zone, which the app reads from your phone. Your country decides the currency the app shows you; it cannot be changed later.
• A record that you accepted the Terms of Service and this Privacy Policy (the version and when).
• A record that you passed the age check at sign-up, and when. We do not keep your year of birth (see Children's privacy).
• Your settings: which notifications you want and quiet hours.
• Your SmartCents settings, if you choose to set them: what one SmartCent is worth to your family (in your family's currency and in minutes of screen time) and the weekly growth on saved SmartCents. These are your own family arrangements; no money passes through the app.
• A 4-digit grown-up PIN for the kid devices. We store it only as a salted hash, never as the PIN itself.
• Your subscription status in the app (see Purchases).

About children

You create each child profile. A child never signs up, and there is no field for a child's real name: in the app a child is shown by a username, a colour you choose and an avatar (one of the app's five built-in characters).

• A username that the app generates (an adjective, an animal and four digits). It is used to sign a kid device in.
• The colour you chose and the avatar the child or you chose.
• A 4-digit Kids Mode PIN. We store it only as a salted hash, never as the PIN itself.
• Tasks you set up: the kind (chore, homework or study time), the task from our built-in list, how many SmartCents it is worth, how often it repeats and, for study time, the planned minutes.
• What happens with each task and request: when the child marks a task done; for study time, when the child pressed Start and Done (times from our server) and the minutes; the child's requests to spend (on a reward you set up, or to cash out for a reason from our built-in list), to give to a cause from our built-in list, or to take SmartCents out of savings; and your answers (Yes or Not now, which grown-up answered and when, and your SmartCents settings at that moment).
• SmartCents: the child's history of SmartCents earned, spent, given, saved, taken out of savings and grown, and their balances (available, waiting for an answer and saved).
• A saving goal, if one is set: an item from our built-in list and a target in SmartCents.
• The rewards you set up (from our built-in catalogue, with a price in SmartCents) and which children can see them, and the thank-you notes a child sends with a tap (these notes carry no text).

From devices

• One record per kid device: the child it belongs to, whether it is a child's own device or Kids Mode on a grown-up's phone, when it was added or removed, when it was last used, a number, and an optional name you choose from a fixed list (for example "Kitchen"). No hardware ID and no device model.
• A push notification token, only on your (the grown-up's) phone and only if you allow notifications. Kid devices receive no push notifications.
• To limit repeated wrong sign-in attempts on kid devices, short-lived counters held under a one-way hash of the device's internet (IP) address and a one-way hash of the sign-in details; never the address, email or username itself (see How long we keep information).

Purchases

Using the app needs the "BANA-X SmartCents – Family plan", a monthly subscription bought through Google Play. Google Play takes the payment; we never see your card details. When you subscribe, we keep: the status of your plan, the base plan and offer, its renewal or end date, whether it renews, and a one-way hash of the purchase token Google Play gives us. We also keep a record that links that hashed purchase token to your family (the family, the product and when it was made). We do not store the purchase token itself or the order number.

What we do not collect

No names of children, no photos, no voice recordings, no location, no contacts, no files and no calendar. No advertising ID. The app has no camera or microphone permission. Children answer with buttons and lists; the only things a child types are numbers (amounts) and, on their own device, their sign-in details.

3. Why we use it

• To create and protect your account and the child profiles.
• To run the app: show each child's tasks, handle their requests and your answers, keep each child's SmartCents and saving goal up to date, add the weekly growth you set, and show you your child's progress.
• To send you the notifications you choose: requests waiting for your answer, a daily reminder at 18:00 (your family's time zone) when requests are still waiting, and thank-you notes.
• To keep the service safe: limits on repeated sign-in and PIN attempts.
• To check your subscription with Google Play.
• To meet our legal duties, including keeping the consent records above.

We do not sell personal information and we do not use it for advertising. We use your information to provide the service you signed up for, with your consent for your children's profiles, to meet our legal duties, and for our legitimate interest in keeping the service safe.

The app does not decide anything about your child on its own: every SmartCent a child earns, spends, gives or takes out of savings needs your Yes. Only the weekly growth is added automatically, at the rate you set. This has no legal or similarly important effect on you or your child.

4. Pictures and sounds

The characters, pictures and sounds are built into the app; the sounds are made on the device itself. The app does not use any AI service while you or your child use it, and no information about you or your child is sent to make them.

5. Companies that help us

• Google Firebase / Google Cloud: the database (Cloud Firestore) and our server code (Cloud Functions, with Cloud Scheduler for the hourly jobs) in the region europe-west1 (Belgium); sign-in (Firebase Authentication); and push notifications to your phone (Firebase Cloud Messaging, which receives your phone's notification token and the notification text; the text names your child only by their username, never by a real name). See Where information is processed.
• Google Play: distributes the app and handles subscription payments. Our server asks Google Play about your purchase to check it.

These companies process information only on our instructions to provide the service, under the Firebase and Google Cloud data processing terms, which include standard contractual clauses for international transfers.

6. No ads, no tracking, no marketing

The app has no advertising, no advertising ID, no analytics kit and no crash-reporting kit. Kid screens show no ads, no outside links, no purchase prompts and no money amounts. We do not send marketing messages. If we ever want to, we will ask first, and you can opt out at any time.

7. Notifications

Notifications and reminders depend on the devices being switched on, online and allowed to show notifications, and on Google's services. They can arrive late or not at all. Notifications on your phone pause during quiet hours (21:00 to 07:00 in your family's time zone) unless you switch quiet hours off.

8. What stays on the device

The app keeps a few things on the phone or tablet itself: your sign-in session, a copy of recent family data so the app works when the connection drops (cleared when you sign out), the kid device's own ID, the phone's notification token, a setting for how much celebration animation to show, and a few "already shown" flags. After the age check, the phone keeps only the date the check was passed, never the year of birth; after a failed age check, it keeps the time until which no account can be made on that phone (24 hours).

9. This website

This website (smartcents.bana-x.com) has plain pages: the home page, this Privacy Policy, the Terms of Service, the open-source licences and the "page not found" page. They load no scripts and nothing from other companies (the fonts and the logo come from this website), and they set no cookies and use no analytics.

The Delete your account page is the one page with a script. It is our own code, served from this website, and it uses Firebase Authentication and Cloud Functions to sign you in and delete your account. It reads its settings from this website and keeps your sign-in in the browser tab only (session storage): the page starts signed out, it signs you out after the deletion, and the sign-in is gone when you close the tab.

10. Security

Passwords are handled by Firebase Authentication; the grown-up PIN and the children's Kids Mode PINs are stored only as salted hashes that cannot be read back. Repeated wrong sign-in attempts are limited, and a PIN locks after too many wrong tries. Deleting an account needs a sign-in within the last 5 minutes. Only our server can change SmartCents, requests and balances; the apps can only ask. Our server logs hold IDs, statuses and counts only: never email addresses, PINs, passwords, order numbers or purchase tokens (at most the last 4 characters of a purchase token). All connections to our servers are encrypted (HTTPS). Our database rules let each family read only its own data.

No system is perfectly secure. If a security breach affects personal information, we will tell the Information Regulator and the affected parents as section 22 of POPIA requires. In other countries we will tell the regulators and people that local law requires.

11. How long we keep information

This table is the one place for every period. Other parts of this policy, the Terms of Service and the Delete your account page point to it.

12. Deleting your account

• In the app: Settings, Delete account. You enter your password again. Deletion is immediate.
• On the web: Delete your account: sign in and confirm. Deletion is immediate.
• By email: write to support@bana-x.com from your account's email address. We handle the request within 7 days.

Deleting your account deletes your grown-up account; every child profile (with its username, colour, avatar, PIN hash, tasks, requests, study sessions, SmartCents history and balances, and saving goal); your rewards and thank-you notes; every kid device (they are signed out); your notification tokens; your settings and SmartCents settings; your plan status and the records linking your purchases to your family; and the sign-in accounts of any other grown-ups who belong only to your family.

You can also delete one child profile in the app (the child's page, Delete child), which deletes that child's information listed above.

We cancel your Google Play subscription when you delete your account. If we cannot, the app tells you, and you can cancel it yourself in Google Play. Google keeps its own record of your payments under Google's privacy policy. What we keep after deletion, and for how long, is in the table in How long we keep information.

13. Children's privacy

Children cannot create accounts. A parent or legal guardian creates the account and then each child profile. We ask for as little information about a child as the app needs: no real name, no email address, no photo, no voice, no location.

When you sign up we ask for your year of birth to check that you are an adult. The check happens on your phone: we keep only a record that it was passed, not the year.

When you set up your family you tick one box: "I am the parent or legal guardian of the children I add to BANA-X SmartCents. I agree to the Terms and the Privacy Policy, and I consent to BANA-X SmartCents processing my children's information as described in the Privacy Policy." We keep a record of when you ticked it.

Parent accounts are for adults aged 18 or older. If we learn that an account belongs to someone under 18, we will close it and delete its information. We never disclose children's information for advertising, and no child's information is sent to any AI service.

Under South Africa's Protection of Personal Information Act, we process children's information only with the consent of a competent person: the parent or legal guardian who creates the child's profile (section 35).

For parents in the United States (COPPA)

This part applies to children under 13 in the United States (Children's Online Privacy Protection Act).

• Operator: BANA-X (Pty) Ltd, 47 Proot Street, Roodepoort, 1724, Gauteng, South Africa. Telephone: +27 73 086 3077. Email: support@bana-x.com. We answer all questions from parents about children's information.
• What we collect from children: when a child uses the app we collect which tasks they marked done and when, when they started and finished a study session, their requests to spend, give or take SmartCents out of savings, the SmartCents they move into savings, the saving goal and avatar they choose, the thank-you notes they send with a tap, and the identifiers that keep their profile working (the generated username and the device's ID in the app). You, the parent, create the child profile (generated username, colour, tasks and a 4-digit PIN that we store only as a salted hash). We do not collect a child's real name, email address, photo, voice or location.
• How we use it: only to run the app for your family: the child's tasks, requests and SmartCents, their saving goal, showing you your child's progress, notifications to your phone, and keeping the service secure. These identifiers are used only for these internal purposes, never for advertising or profiling. We do not sell children's information.
• Who receives it: we do not disclose children's information to third parties. Google (Firebase and Google Cloud) stores and processes it for us as our service provider.
• How long we keep it: while the child profile exists; every period is in the table in How long we keep information.
• Your rights: you can review your child's information in the app, delete it by deleting the child profile (the child's page, Delete child), and refuse further collection by deleting the profile or stopping use of the app (the app cannot work for a child without this information). You can also contact us to do any of this.
• Persistent identifiers and consent: the generated username and the kid device's ID in the app are persistent identifiers. We collect them, and what a child does in the app, only to support the internal operations of the app: to sign a kid device in, run the child's tasks and requests, keep their SmartCents, show you their progress, send you the notifications you choose, and keep the service secure and working. We use them for nothing else: never to contact a child, for advertising, to build a profile of a child, or to share with anyone. You give your consent as the parent when you set up your family (see above), and you can withdraw it at any time by deleting the child profile or your account.

14. Your rights and your regulator

Depending on where you live, you can ask us for access to your information, to correct it, to delete it, to object to or restrict how we use it, or to withdraw your consent. You can do most of this in the app; for anything else write to support@bana-x.com. You can also complain to your regulator. We reply within 30 days, or sooner if the law of your country requires.

• South Africa: Protection of Personal Information Act (POPIA): the Information Regulator (inforegulator.org.za).
• Namibia: the right to privacy in the Namibian Constitution (Article 13) and any data protection law in force.
• Australia: Privacy Act 1988: the Office of the Australian Information Commissioner (OAIC) (oaic.gov.au).
• New Zealand: Privacy Act 2020: the Privacy Commissioner (privacy.org.nz).
• United States: Children's Online Privacy Protection Act (COPPA): the Federal Trade Commission (FTC) (ftc.gov).
• Canada: Personal Information Protection and Electronic Documents Act (PIPEDA): the Office of the Privacy Commissioner of Canada (OPC) (priv.gc.ca).
• Singapore: Personal Data Protection Act 2012 (PDPA): the Personal Data Protection Commission (PDPC) (pdpc.gov.sg). Our Information Officer, Benjamin Narainsamy, is also our data protection officer for Singapore (support@bana-x.com).

15. Where information is processed

Whichever country you are in, the app's database (Cloud Firestore) and server code (Cloud Functions) are in Google's europe-west1 region (Belgium, European Union). Your sign-in details (email address, password hash and sign-in records) are handled by Firebase Authentication, which processes them in the United States. Push notifications pass through Firebase Cloud Messaging, and purchases through Google Play. Our server logs (IDs, statuses and counts only, kept for 30 days) are handled by Google Cloud Logging. Where personal information is transferred outside South Africa, we rely on our providers' safeguards and data processing terms and on the conditions for transborder information flows under POPIA.

16. Changes to this policy

If we change this policy we will update this page and its effective date. If a change is important, we will tell you in the app and by email at least 30 days before it takes effect.

17. Contact us

BANA-X (Pty) Ltd, registration number 2026/391483/07. Directors: Benjamin Narainsamy, Natalie Narainsamy and Allegra Narainsamy. Information Officer: Benjamin Narainsamy. Email: support@bana-x.com. Telephone: +27 73 086 3077. Registered address: 47 Proot Street, Roodepoort, 1724, Gauteng, South Africa.