Privacy notice

Version 2026-10-11. How Uandishi handles your family's data, and your choices.

What we keep

  • Your name, email address and, if you pay by M-Pesa, your phone number.
  • For each child, a first name and grade only: no surname, birthday or photo of them.
  • Photos of essays, what the child wrote, the feedback and their progress.
  • Payments and the credit in your wallet.

Who handles it

  • Essays are read and marked by Google's Gemini, on a paid plan that doesn't use them to improve Google's products.
  • Google Cloud Vision finds where each word is on the photo, so feedback can point at it. It receives only the photo.
  • Data is stored with Fly.io and Tigris, outside Kenya. Email goes through Resend and SMS through Africa's Talking; M-Pesa payments through Safaricom, and card payments through Paystack. Error reports, with names and contact details removed, go to Sentry.

Schools and teachers

For school and holiday work, your child's school decides what is collected and why (it is the controller), and Uandishi processes it for the school. The school sees school work, and home practice only if you share it.

A teacher may send you SMS about your child's work, such as a link to their results. Reply STOP to any of them, or change it in Settings, and they stop.

How long

  • Essay photos are deleted 12 months after marking, unless you keep them as your child's Writing journey.
  • Results a teacher marked that no parent has claimed are deleted after 12 months.
  • Transcripts, grades and progress are kept while your account exists.
  • Usage records, which hold no names or contact details, are kept 13 months; totals with nothing about any one person are kept.

Your choices

  • Download your family's data at any time from Settings.
  • Delete a child, or your whole account, from Settings. It's removed within 30 days, backups included.
  • Other families see only a child's generated challenge name and league position, never their name, school or essays.

Teachers and school contacts

  • For teachers: name, email, the school and classes they teach, and what they mark and review.
  • When a teacher or parent tells us about a school, the names and numbers they give are encrypted, used only to call about that school, and deleted when it registers or declines, or after 12 months.
  • A teacher without a school sends evidence of who they are; it's encrypted and deleted once we've checked it. A head teacher's number for a registration code is kept only in scrambled form.

Cookies

Cookies are used only to keep you signed in and secure. Your light or dark theme is remembered in your browser. There are no advertising or tracking cookies, and we measure use of the app ourselves, without third-party trackers.

Your rights

Under Kenya's Data Protection Act you can ask to see, correct or delete your data, and object to how it's used. Most of this you can do yourself in Settings; for anything else, write to us.

If you're not happy with our answer, you can complain to the Office of the Data Protection Commissioner (ODPC).

Who we are

Uandishi is operated by Fedhaly Ltd, P. O. Box 22294-00505, Nairobi, Kenya. Write to us at [email protected].

Changes to this notice

  • 2026-10-11: Adds who runs Uandishi and how to reach us, your rights and how to complain, cookies, and what we keep about teachers and the school contacts we call.
  • 2026-10-05: Adds Google Cloud Vision (finding words on the photo), schools as controllers of school work, teachers' SMS to parents and how to stop them, keeping photos as a Writing journey, and results nobody claims, deleted after 12 months.
  • 2026-09-30: The first notice.