Scenaply Privacy Policy

Scenaply is operated by Christiaan Pienaar, trading as Chrisp Creates. The operator is a sole proprietor based in South Africa and is responsible for determining how Scenaply processes personal information. Chrisp Creates is a trading name, not a separate incorporated entity.

We aim to use personal information fairly, transparently, for defined purposes and in proportion to those purposes. This policy is designed around POPIA’s conditions for lawful processing, including accountability, purpose limitation, information quality, openness, safeguards and participation. Publishing a policy does not itself establish operational compliance or certification.

Account information includes first and last name, email address, authentication records, age confirmation, document acceptance versions and timestamps, and your optional marketing preference. Learning activity is described below. Previous demo history may contain a locally saved name or nickname and practice activity. New demo access is no longer offered. We do not ask for identity documents or payment details to create an account.

Supabase processes your email and password for authentication, verification and recovery. The app sends passwords directly to Supabase over HTTPS and does not store readable passwords or confirmation fields in application tables. First and last name are stored in your account profile. We ask whether you are 18 or older rather than collecting a date of birth. Email verification alone does not activate cloud training; explicit current legal acceptance is also required.

Account progress includes preferences, session and question identifiers, question snapshots, answers and draft answers, hints, timestamps, grades, mistake categories and session summaries. These support resuming practice and calculating learning indicators. They are saved to your private cloud account. Demo progress stays in local storage until you choose to import it into an empty account. Switching between demo and account mode does not automatically upload demo history.

Hosting and delivery systems may process IP addresses, request URLs, browser information, timestamps and security events needed to deliver and protect the site. Google receives requests for fonts, including technical connection/request information. The operator has not yet confirmed provider log fields, access, locations or retention periods; these require review. The production host injects Cloudflare JavaScript detection for bot/security checks. No application analytics or advertising pixels were found in the current frontend.

We process account information to authenticate you, administer your account, deliver verification and recovery messages, save private learning progress and record legal acceptance. Technical processing supports delivery and security. Marketing is optional and separate; an unchecked choice does not subscribe you.

Account and learning information is used to provide the service you request. Security and acceptance records support protecting and administering that service and applicable legal obligations. Optional marketing relies on a separate choice and applicable direct-marketing requirements. A Terms checkbox is not blanket consent to every use. Where consent is relied on, withdrawal does not undo prior lawful processing. Contact us to raise an objection or ask about a particular use.

Supabase provides authentication and the account database, with this project configured in West EU (Ireland). The configured SMTP service receives authentication email recipients and message content; Gmail is the selected sender service for this launch. Website hosting, delivery and Google Fonts process the technical requests described in this policy. No external AI service receives practice answers through the application.

Use only the basic information requested. Previous demo use permitted a nickname. Do not put sensitive documents, passwords or unrelated personal information into profile names or practice answers.

Registration does not require an ID or passport number, home address, date of birth, gender, medical information, banking information or phone number. Do not enter these in other fields.

Accounts are intended for people aged 18 or older. Children’s accounts are not offered. If you believe children’s information has been submitted, contact us so it can be investigated and handled appropriately.

Profile, authentication and learning information is processed by the providers needed to run accounts and private cloud training. Demo practice history is not uploaded unless you explicitly import it. The app has no advertising data-sharing integration and does not sell your learning history. Information may be disclosed where lawfully required, limited to what is necessary.

The Supabase account database is configured in Ireland, outside South Africa. Hosting, font delivery, email and provider support may also involve other countries. This is not a promise that all provider processing stays in one region. Contact us for questions about providers and applicable transfer safeguards.

The site uses HTTPS. Account records have database row-level ownership restrictions; verified accounts and current legal acceptance are required for cloud writes. Privileged database keys are not shipped to the browser. Account tokens are kept in session storage for the current tab. Anyone with access to an unlocked signed-in tab may use that session. Local demo storage is not a private account or encrypted vault. No security measure is absolute.

Account profiles, progress and acceptance records remain while the account is active unless deletion or another justified retention need applies. There is currently no automatic inactivity deletion schedule. Request deletion through the contact email; any record retained for a lawful reason must be limited to that purpose. Provider logs and backup lifecycles may differ and are not promised to disappear immediately. Demo data remains until site storage is cleared or removed by the browser.

Subject to applicable law and justified limitations, you may ask whether information is held about you, request access, seek correction or deletion, object to qualifying processing, withdraw consent where relied on, and complain to the Information Regulator. Exercising a right does not waive another right. A request may require proportionate identity verification; unnecessary identity documents should not be collected.

In Account settings you can update your names and marketing preference and export learning progress. For access to other account records, email us from your account address. Requests may require proportionate identity verification. We cannot retrieve browser-only demo records remotely.

You may object to processing where POPIA provides that right, including direct marketing. The operator must assess the request against its lawful basis and stop processing where required. Necessary processing cannot be represented as optional consent; if a feature cannot operate without certain information, that consequence must be clearly explained.

Request account deletion through our contact email. This is currently a support-assisted process, not a self-service delete button. Deleting the authentication user cascades to the application profile, settings, progress, answers, diagnostics, mastery and acceptance records. Any legally justified retention must be assessed separately. Provider logs and backups follow their own lifecycle. To remove local demo data, clear site data in your browser. Signing out alone does not delete it.

The app uses localStorage under scenaply.v1 for demo names and progress, and sessionStorage under scenaply.auth.v1 for Supabase authentication tokens. Sign-out clears the account session; close all copies of an authenticated tab on shared devices. Account learning progress is held in memory and synced to Supabase, not copied into demo storage. Hosting uses Cloudflare bot-protection cookies and scripts; see Cloudflare cookie documentation. Google Fonts receives font requests. The app has no advertising pixels or application analytics integration. Legal pages do not read or write training storage.

Marketing choice is optional, separate and unchecked by default. You can change it in Account settings or contact us to opt out. No marketing campaign system is integrated in this release. Verification and recovery messages are service messages and do not subscribe you to marketing.

This is version 1.3, effective 1 October 2026. Material changes will be communicated before new processing begins, with consent sought when legally required. Historical versions are retained. A Privacy Policy acknowledgement is not blanket consent to every processing activity.

Scenaply is operated by Christiaan Pienaar, trading as Chrisp Creates.

Email christiaanpienaar20@gmail.com for support, privacy requests, security concerns and legal enquiries. Do not email passwords or unnecessary identity documents.

Requests are handled by the operator, with proportionate verification and applicable legal response periods. We will explain any lawful refusal. You may also contact the Information Regulator.

You can find current guidance and complaint procedures on the official Information Regulator South Africa website and its complaints page. You do not have to give up your right to complain when you have concerns about information processing. These external pages explain their current procedures and contact details.