Last updated 15 September 2026
There is no Sagito server, and we never receive your child's data. No account, no sign-in, no analytics, no advertising, no crash reporting and no third-party SDK that phones home. Everything the app knows lives in storage on the device it is installed on.
One thing does talk to a network, and it is not us. When a grown-up opens the purchase area, the app asks Apple's In-App Purchase or Google Play Billing for prices and for what your store account has already bought, and asks again when the app returns to the foreground so a cancelled subscription stops being treated as active. That conversation is between your device and Apple or Google. It carries no information about your child, and its answers are kept on the device. There is no other network activity of any kind.
This was verified rather than assumed: there is no fetch, no HTTP client and no telemetry anywhere in the app's source, and the only dependency capable of reaching a network is the store-purchase library described above. The web addresses in the question bank are provenance records for public-domain texts — they say where a passage was transcribed from, and are never requested at runtime.
Information leaves a device only when a grown-up has allowed it to, and only ever to another family's device — through a camera or a code the parent shares. There are two routes, and a grown-up opens each of them behind the PIN.
Between households a parent has connected. A grown-up approves the other household first. After that approval, a child can send a card or a gift to an approved friend without a grown-up unlocking it each time; that is a deliberate decision, so that a swap between friends is not an errand for an adult.
Between two children in the same room. A child can give a card to a friend standing next to them without the two households being connected at all: the giving phone shows a QR code and the friend's phone scans it from the screen. What crosses is the name the giving child chose and which card it is — shown once on the receiving phone and not kept. The code works for two minutes, only from a camera: one typed or pasted in is refused, because typing is the shape a forwarded code arrives in. Nothing is remembered about the other child, and no connection is made.
This route is on unless a grown-up turns it off, under Swap cards in person in the grown-up area, behind the PIN. We should be plain that this is a weaker control than the one above: a grown-up approves each connected household individually, whereas here they can only withdraw the whole route, and until they do a child can accept a card from a phone belonging to someone no adult has met. We judge the exposure small — a display name and a picture of an animal, for two minutes, with nothing stored and no way for either child to reach the other afterwards — and set against it the fact that a swap between two children in the same room is the ordinary case, and one that needing two parents and two PINs was stopping altogether.
This is the version to show in the app. Written to be read by a nine-year-old, because the ICO's Children's Code asks for privacy information "in clear language suited to the age of the child" — not a shorter version of the grown-up one.
The name you picked. You typed it when you started. A nickname is absolutely fine — Sagito doesn't mind what you call yourself, and you can leave it blank.
How you're getting on. Which questions you answered, which ones were tricky, how long you took, your points, your coins, your cards and your campsite.
Your friends. Just the ones a grown-up said yes to.
On your device. That's it. Sagito doesn't send any of it anywhere. There is no Sagito computer somewhere keeping a copy, because there isn't a Sagito computer at all. If you turn the internet off completely, everything still works exactly the same.
When you swap or send a card, your friend's device sees the name you picked and which card you sent. Nothing else — not your score, not how you're doing, not what you find hard. The nicknames you give your own cards stay with you.
If you give a card to a friend who is standing right next to you, it's the same two things: the name you picked and which card. Your phone shows a square code, your friend holds their camera up to your screen, and that is all that crosses. It only works for two minutes, and only from a camera — so a photo of it sent to someone later is no use to them. A grown-up can turn this off if they would rather you only swapped with friends they have added.
The code a grown-up uses to add a friend in the first place is different: it doesn't have your name in it at all, just something your grown-up made up for your whole house, like "The Robertses". That's because a code like that can get passed around, and your name shouldn't go anywhere your grown-up hasn't said yes to.
Ask your grown-up. They can delete everything, and it really is gone — it was only ever on your device, so there's nothing left anywhere else. You don't have to say why.
Sagito is published by QNL LTD, 92 Cloonmore Avenue, Orpington, Kent, BR6 9LQ, company number 09869549. QNL LTD is the data controller. Questions about this policy, or about data held about you, go to Quang Luong at privacy@sagito.app. QNL LTD has not appointed a Data Protection Officer and is not required to: Article 37 applies to public authorities, large-scale systematic monitoring, and large-scale special-category processing, and none of those describe this app.
Because the app sends nothing to us, we hold no personal data about you or your child and have nothing to look up, export or delete on your behalf. Everything is on your device, under your control.
| What | Why it exists | Where it lives |
|---|---|---|
| Child's first name or nickname | Labels the profile; shown to a friend on a swap | Device storage |
| Answers, timings, accuracy, level | Shows progress and adapts difficulty | Device storage |
| Points, coins, cards, campsite items | The game | Device storage |
| Card nicknames the child gives | The child's own | Device storage — never sent |
| Parent PIN and recovery word | Locks the grown-up area | Device storage |
| Approved friends | So cards can be swapped | Device storage |
"Device storage" means the app's own private area on the phone or tablet, which other apps cannot read. It is included in an iCloud or Google device backup if you have one switched on — that backup is between you and Apple or Google, and we have no access to it.
Not stored, at all: the child's age or date of birth, location, photographs, contacts, device advertising identifiers, IP addresses, email addresses, adult names, or anything from a third-party tracker.
On the age, specifically. The app used to ask for it, to decide where the questions should start. It no longer does. The adaptive ladder measured the child properly within a sitting or two regardless, so the field amounted to collecting a piece of personal data about a child in order to seed a number the app was about to overwrite. Every child now begins in the same place and the first few sets work out where they actually are. Ages held in saves made before 31 August 2026 are deleted when the app next opens.
Friend invites, gifts and card swaps are carried by a QR code or a link that goes directly from one device to another. There is no server in the middle.
There are four kinds of code, and they carry different things on purpose.
A connection code, which a grown-up uses to connect two families, contains a family name you choose yourself — "The Robertses", "Flat 3" — the first names or nicknames of the members you choose to connect, exactly as you see them on screen before the code is made, a random pairing id, and the time it was made. You choose who is included, and you can change a name before it is sent; setup suggests a nickname for exactly this reason. The other family's reply carries the same things about them. This changed on 11 September 2026, so that a child swaps with the particular friends they were connected to rather than with a whole family.
A card swap code, which moves a card between two families who are already connected, contains which card and a random swap id. It names no one: each member is referred to by their place in the list their family shared when connecting.
A gift code, which moves an item between connected families, contains the sending child's display name and which item was sent, so the other child knows who sent it.
An in-person card code, which gives a card to a friend in the same room, contains the giving child's display name, which card, a random id, and the time it was made. It names no household and belongs to no connection — it is the one code that works between two families who have never been introduced, which is why the code itself is the most tightly bound: it lasts two minutes, and it is only accepted from a camera. The same code typed or pasted in is refused, because typing is the shape a forwarded code arrives in. The name it carries is shown on the receiving phone when the card lands and is not kept. A grown-up can switch this route off altogether under Swap cards in person.
Be aware of what a forwarded code shows, though. A phone without the matching pairing will refuse the code — it cannot connect or take anything — but the code is ordinary text, so anyone it is forwarded to could decode the names in a connection code or a gift code. Refusing it is not the same as keeping it private. It is only the family name and the names or nicknames you chose: no adult's name, no contact details, no progress. Treat a code like a note passed in the playground rather than a sealed envelope.
None contains any adult's name, any email address, any location, any progress or score, or any id that follows a child between families.
Codes expire — 24 hours for a connection code, 3 days for the reply, a swap or a gift, two minutes for an in-person card — so a screenshot cannot be reused indefinitely. Connecting sits behind the parent PIN on both phones, so a child cannot connect to anyone without a grown-up. The one route that needs no connection is on by default and can be switched off behind that same PIN; what limits it is the two minutes and the camera, not an approval.
One thing worth knowing: if you send a code by email or through a messaging app rather than by holding two phones together, that service carries the contents in the message under its own privacy policy rather than ours. For a connection code that is your family name and the names you chose; for a gift it is a child's nickname. Holding the phones together avoids it entirely.
There is no chat, no comments and no free text of any kind travelling between users. The only text one child's device shows another is the display name they chose. This is deliberate and it is why the app needs no moderation system.
Used for exactly one thing: reading a friend's QR code. No image is captured, saved or transmitted — the camera is a barcode reader here and nothing more. Connecting to another family is done from behind the parent PIN; a child's own screen can scan a card code sent to them, and an in-person card only if a grown-up has allowed that. iOS and Android will ask your permission the first time, and declining it only means codes must be shared as links instead — except for an in-person card, which has no non-camera route by design.
A speaker switch beside the question number reads each question and its answer choices aloud, and a reading passage has a "Hear the passage" button. The switch starts off for every child, and the phone remembers each child's own choice. It uses the voice built into the phone, only once the switch is on or the passage button is tapped, and only for what is shown on screen. The app does not record anything, never uses the microphone, and asks for no permission. What is spoken is not sent to us or to anyone by this app. (Some Android phones use a voice that downloads from the phone maker; that is the phone's own setting and not something this app controls.) Nothing depends on it: the question is always on screen.
A parent can switch on one reminder a day from behind the parent PIN. It starts switched off, and the phone asks for permission only when a parent turns it on. The reminder is created and shown on the phone itself: it does not use push notifications, no token is registered with Apple, Google or us, and nothing is sent to any server. It is the same on-device kind of notification as an alarm clock, and it is separate from anything described under "What will change" below.
The words never mention a child's name, a score, a streak or anything they have or haven't done. If nobody opens the app for a few days, the reminders stop by themselves. Switching it off, turning notifications off in the phone's Settings, or choosing "Delete everything on this device" removes every pending reminder.
Optional extra camps, and a subscription that widens the question bank, are sold through Apple's In-App Purchase or Google Play Billing and through nothing else. Both live behind the parent PIN; nothing is ever sold to a child.
The transaction happens entirely between you and Apple or Google. They are the merchant. We receive confirmation that a purchase was made — and no payment details, no card number, no billing address, no email address and no name. There is no payment processor in the middle and no purchase service such as RevenueCat: adding one would mean purchase data leaving the device, which is the thing this whole document rests on not happening. If that ever changes, the provider is named here before it is introduced, not after.
What stays on your device. The confirmation is turned into a local record that the camps are owned, or that the subscription is active. That record is written to the same on-device storage as everything else and is never transmitted to us. If you reinstall the app, Restore Purchases asks Apple or Google what your account has bought — which is why the entitlement survives without us holding anything. See the terms of use for what a purchase gets you.
On the free questions. The app ships with 2,000 of its 5,000 questions available without paying, and practice never stops: when those have all been seen the app keeps going and serves the ones met least often first. There is no countdown, no interstitial and nothing that halts a child mid-session. That is a design decision as much as a commercial one — a nine-year-old's practice should not stop in order to prompt a purchase.
Under UK GDPR you and your child have rights to see, correct, delete, export and object to the use of personal data. Because everything is on your device, these are things you do yourself rather than ask us for. All of them are in the grown-up area, behind the PIN:
Because we hold nothing, there is no request you can make to us that would produce data — but if any of the above does not work as described, tell us at privacy@sagito.app and we will fix it.
If you are unhappy, please tell us at privacy@sagito.app first. You can also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
For as long as you keep the app installed. There is no retention period for us to set, because we hold nothing.
A connection server is designed and not built. Today two families connect by holding phones together or sharing a code, which works only while both are to hand. The server would carry an invite to a family who is not in the room, and hold a gift or a swap while the other phone is off.
When it ships, the claim at the top of this document — that the only network conversation is with Apple or Google about purchases — stops being true, and this policy will be rewritten before that happens rather than after. What it is designed to hold is already decided and deliberately small: an opaque household id generated on the device, the household label you chose, a notification token, invite codes and their expiry, which households are connected, and items in transit — deleted the moment they arrive. It holds nothing about a child. No nickname, no answers, no scores.
The other change on the horizon is payment, covered above.
If this changes we will say so in the app before the change takes effect, and the date at the top will be updated.