Effective Date: January 17, 2026, Last Updated: January 17, 2026

1. INTRODUCTION AND SCOPE

This Privacy Policy ("Policy") governs your use of the software applications created, deployed, and managed by Tz Studios ("Company," "we," "us," or "our"). This Policy applies to all mobile applications developed by Tz Studios, including but not limited to:

• Grade 10, 11, 12 Mathematics App

• Grade 10, 11, 12 Physics App

• Grade 10, 11, 12 English App

• Grade 10, 11, 12 Life Sciences App

• Grade 12 EGD Drawing App

• TubeStats - Live Sub Counter

We are committed to protecting your privacy and ensuring you have full control over your personal data. This Policy explains what information we collect, how we use it, who we share it with, and your specific rights under global privacy laws, including the General Data Protection Regulation (GDPR), the Protection of Personal Information Act (POPIA), the California Consumer Privacy Act (CCPA) as amended by the CPRA, the Virginia Consumer Data Protection Act (VCDPA), and the Brazilian General Data Protection Law (LGPD).

By downloading, accessing, or using our Applications, you agree to the collection and use of information in relation to this Policy.

2. DATA CONTROLLER AND DATA PROTECTION OFFICER

To ensure compliance with the GDPR, POPIA, and other relevant laws, we explicitly identify the entities responsible for the processing of your data.

2.1 The Data Controller The Data Controller responsible for your personal information for the purposes of the applicable European Union and South African data protection laws is: Tz Studios KwaZulu-Natal, South Africa Contact Email: tzstudios.dev@gmail.com

2.2 The Data Protection Officer (DPO) We have appointed a Data Protection Officer to ensure the safety of your data and to serve as a point of contact for any privacy-related concerns or data subject requests. Contact Person: Privacy Manager / DPO Organization: Tz Studios Contact Email: tzstudios.dev@gmail.com

3. INFORMATION WE COLLECT

We collect different types of information to provide our educational services, improve the stability of our apps, and support our business model through advertising and subscriptions.

3.1 Information You Explicitly Provide to Us

• Account Registration Data: If you choose to register an account within the Application (facilitated via Supabase or Firebase Auth), we may collect your Full Name and Email Address. This is used solely to authenticate your identity, save your progress, and sync your data across devices.

• Customer Support Communications: If you contact us for support via email, we collect the content of your message, your email address, and any attached screenshots or files.

3.2 Information Collected Automatically (via SDKs) When you access or use the Application, certain information is automatically collected by our third-party service providers (Software Development Kits or SDKs). This includes:

• Device Identifiers: We collect unique device identifiers, specifically the Google Advertising ID (ADID) and Android ID.

• Device Technical Data: We collect information about your specific device, including the manufacturer, model, operating system version, screen resolution, and IP address.

• Usage and Interaction Data: We collect data on how you interact with the Application, such as which screens you visit, how long you spend on specific educational topics, and buttons you click.

• Crash Logs and Diagnostics: Through Google Firebase Crashlytics, we collect detailed reports when the Application crashes. This includes stack traces, the state of the app at the time of the crash, and device logs.

• Purchase History: Through RevenueCat and Google Play Billing, we track the status of your subscriptions (e.g., "Pro Version") and your purchase history. We do not collect your credit card numbers; we only receive a cryptographic token verifying the purchase.

4. THIRD-PARTY DATA SHARING AND SERVICE PROVIDERS

We do not sell your personal data in the traditional sense (i.e., exchanging your name and email for money). However, we share data with trusted third-party service providers to facilitate app functionality, analytics, and advertising. Under certain laws (like the CCPA), sharing unique identifiers for advertising may be classified as a "sale."

4.1 Google Firebase (Analytics, Crashlytics, Auth) We use Google Firebase to authenticate users, analyze user behavior, and report crashes.

• Data Shared: Device ID, IP Address, Crash Logs, App Usage Data.

• Purpose: To improve app stability and user experience.

4.2 Google AdMob (Advertising) We use Google AdMob to display banner and interstitial advertisements. This allows us to provide the basic version of the Application for free.

• Data Shared: Advertising ID (ADID), Coarse Location (based on IP), Usage Data.

• Purpose: To serve personalized or non-personalized advertisements relevant to the user.

4.3 RevenueCat (Subscription Management) We use RevenueCat to manage in-app purchases and subscriptions.

• Data Shared: App User ID, Purchase Receipts, Product IDs.

• Purpose: To validate your subscription status and unlock premium content.

4.4 Supabase (Backend Database) We use Supabase as our backend database provider.

• Data Shared: Email Address, Name, User Generated Content.

• Purpose: To securely store user accounts and data.

5. PURPOSES OF PROCESSING

We process your data for the following specific purposes:

• Service Provision: To deliver the educational content, features, and functionality you have requested.

• Authentication: To verify your identity when you log in to your account.

• Technical Support: To respond to your inquiries and resolve technical issues.

• App Improvement: To analyze usage trends and crash reports to fix bugs and improve performance.

• Marketing and Advertising: To display advertisements that are relevant to your interests, which supports the ongoing development of the free version of the Application.

• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

6. UNITED STATES PRIVACY RIGHTS (CCPA, CPRA, VCDPA)

This section provides specific disclosures required by the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and the Virginia Consumer Data Protection Act (VCDPA).

6.1 Right to Know About Personal Data Sales You have the Right to Know whether your personal data is sold.

• Disclosure: Tz Studios does not sell your personal contact information (such as your name, email address, or phone number) to third-party data brokers for monetary consideration. However, we allow third-party advertising partners (specifically Google AdMob) to collect unique identifiers (such as your Advertising ID) and usage data through our Application. Under the broad definition of "sale" in the CCPA/CPRA, this activity may be considered a "sale" of data.

6.2 Right to Know About Personal Data Sharing You have the Right to Know whether your personal data is shared with third parties.

• Disclosure: We share your personal information (specifically Device IDs, Advertising IDs, and IP addresses) with third-party service providers (Google Firebase, RevenueCat, Supabase) for business purposes and with advertising networks (Google AdMob) for cross-context behavioral advertising purposes.

6.3 Right to Opt-Out of Data Sale and Sharing You have the Right to Opt-Out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising.

6.4 How to Opt-Out of Data Sale and Targeted Ads Since we do not maintain a direct database of user profiles for sale, "opting out" in the context of our Application means preventing your Advertising ID from being used for targeted ads. You can exercise your Right to Opt-Out by following these specific steps on your mobile device:

• For Android Devices:

  1. Open your device Settings.

  2. Navigate to Google > Ads (or Privacy > Ads depending on your OS version).

  3. Select "Delete advertising ID" or toggle "Opt out of interest-based ads."

  4. Result: This action prevents Google AdMob from using your specific Advertising ID to build a profile about you or show you personalized ads within our Application.

If you wish to make a formal request regarding other data (such as your email address), please contact our Data Protection Officer at tzstudios.dev@gmail.com with the subject line "Do Not Sell My Personal Information."

6.5 Right to Non-Discrimination We will not discriminate against you for exercising any of your privacy rights. We will not deny you goods or services, charge you different prices, or provide a different level of quality.

7. GLOBAL PRIVACY RIGHTS (GDPR, POPIA, LGPD)

7.1 Rights for Users in the European Union (GDPR) and UK

• Right of Access: You have the right to request copies of your personal data.

• Right to Rectification: You have the right to request that we correct any information you believe is inaccurate.

• Right to Erasure: You have the right to request that we erase your personal data ("Right to be Forgotten").

• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data.

• Right to Object: You have the right to object to our processing of your personal data for direct marketing purposes.

• Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you.

7.2 Rights for Users in South Africa (POPIA)

• Right to Notification: You have the right to be notified that your personal information is being collected.

• Right to Access: You have the right to request access to the personal information we hold about you.

• Right to Correction/Deletion: You have the right to request the correction, destruction, or deletion of your personal information.

• Right to Object: You have the right to object to the processing of your personal information on reasonable grounds.

• Right to Complaint: You have the right to submit a complaint to the Information Regulator (South Africa) regarding any alleged interference with the protection of your personal information.

7.3 Rights for Users in Brazil (LGPD)

• Confirmation and Access: You have the right to confirm the existence of processing and access your data.

• Anonymization/Blocking/Deletion: You have the right to request the anonymization, blocking, or deletion of unnecessary or excessive data.

• Information on Sharing: You have the right to know which public and private entities we have shared your data with.

• Revocation of Consent: You have the right to revoke your consent at any time.

To exercise any of these rights, please contact our Data Protection Officer at: tzstudios.dev@gmail.com

8. DATA RETENTION POLICY

We retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy.

• User Account Data: We retain your account data (email, name) for as long as your account is active. If you request account deletion, we will delete this data within 30 days.

• Crash Logs and Diagnostics: Data collected via Firebase Crashlytics is retained for 90 days to allow us to investigate and resolve stability issues, after which it is automatically deleted.

• Usage and Analytics Data: Aggregated and anonymized usage data may be stored for up to 14 months for long-term trend analysis.

• Purchase Records: We retain records of your purchases indefinitely to ensure that you can restore your purchases if you switch devices or reinstall the Application.

9. CHILDREN'S PRIVACY

Our Applications are educational tools intended for high school students (Grade 10 and above). We do not knowingly collect, solicit, or maintain personal information from children under the age of 13 (or the applicable age of digital consent in your jurisdiction, such as 16 in certain EU countries).

If we learn that we have collected personal information from a child under the age of 13 without verification of parental consent, we will take immediate steps to delete that information from our servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us immediately at tzstudios.dev@gmail.com.

10. DATA SECURITY

We value your trust in providing us with your Personal Information. We utilize industry-standard security measures, including encryption via SSL/TLS (Secure Socket Layer) for data in transit and secure cloud storage via Supabase and Google Cloud for data at rest. However, remember that no method of transmission over the internet, or method of electronic storage, is 100% secure and reliable, and we cannot guarantee its absolute security.

11. INTERNATIONAL DATA TRANSFERS

The Application is operated from South Africa. However, our service providers (Google, Supabase, RevenueCat) utilize servers located in the United States and other jurisdictions. By using the Application, you acknowledge that your information may be transferred to and processed in countries other than your own. We rely on appropriate legal mechanisms, such as Standard Contractual Clauses, to ensure your data remains protected during these transfers.

12. CHANGES TO THIS PRIVACY POLICY

We may update our Privacy Policy from time to time. Thus, you are advised to review this page periodically for any changes. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date at the top of this document. These changes are effective immediately after they are posted on this page.

13. CONTACT US

If you have any questions or suggestions about our Privacy Policy, or if you wish to exercise your rights regarding your personal data, do not hesitate to contact us.

Developer: Tz Studios Email: tzstudios.dev@gmail.com Data Protection Officer Email: tzstudios.dev@gmail.com