Prepared with Malaysia's Personal Data Protection Act 2010 (PDPA) in mind. Pending review by our legal advisers.
Last updated: 25 October 2026 · Operated by: Cyberwolves Sdn Bhd (1505073-D), Malaysia ("we", "us"). Contact: WhatsApp +60 12-799 8080 or hello@moneyheroquest.com.
Money Hero Quest is an educational record-keeping app for families. Parents ("Coin Keepers") record virtual "coins" for their children ("Money Heroes") to practise money habits. We do not hold, transfer, or process real money. We are not a bank, e-money issuer, wallet, or payment service. All real money stays with the parent.
From parents: name, email address, password (stored as a secure hash), family name, timezone, and an optional dashboard PIN.
About children (entered and controlled by the parent): a display name, a login username, a password (hashed), an avatar choice, and coin-activity records (jar amounts, wishes, goals, badges, streaks). We do not collect a child's email, phone number, precise location, photos, or contacts.
If you buy Premium: your payment record (plan, amount, date). Card and bank details are handled by Stripe — we never see or store them.
If you turn on alerts: a push-notification token for your device, used only to send Money Hero Quest alerts.
Automatically: basic technical logs (IP address, device/browser type, timestamps) needed to run and secure the service.
Child accounts can only be created by a parent or legal guardian, who consents to the processing of their child's data at signup and controls it throughout. Parents can at any time, from their dashboard: reset a child's password, export all family data, or delete a child's account and all associated records. We do not knowingly allow a child to create an account without a parent.
Only to: (a) provide the service (accounts, coin records, family features); (b) keep it secure (authentication, abuse prevention); (c) communicate service matters (e.g. password reset emails, alerts you turned on, monthly family reports); (d) process Premium payments; and (e) improve reliability. We do not sell personal data. We do not show advertising. We do not use children's data for marketing or profiling.
We use these service providers, who process data on our behalf under their own security and data-processing terms:
Data is encrypted in transit (HTTPS) and protected by per-family access controls at the database level. Some providers are outside Malaysia; we use them only with appropriate safeguards as permitted under the PDPA.
We keep personal data for as long as the account exists. Deleting a child (or the family account) permanently removes the associated records from our production systems; residual copies in encrypted backups are purged on the backup rotation cycle of up to 30 days. Payment records may be kept longer where tax or accounting law requires.
You may access, correct, export, or delete your family's personal data, and withdraw consent (which ends the service for that account). Export and deletion are self-service in the Keeper dashboard; for anything else contact us on WhatsApp +60 12-799 8080 or at hello@moneyheroquest.com. We respond within the timeframes required by the PDPA.
Passwords are hashed, transport is encrypted, and each family's records are isolated by database-level row security. No system is perfectly secure; if a breach affecting your data occurs we will notify affected users and regulators as required by law.
Inside the app (the parent dashboard and the kids' screens) we use only essential cookies: your login session and your language choice. There is no advertising or tracking inside the app, and children are never targeted by ads.
On our public website pages (the home page and the parent sign-up page) we may use the Meta Pixel and TikTok Pixel to measure whether our ads work. These may set cookies and share page-visit and sign-up events with Meta or TikTok. We also remember which ad or link brought a family (for example, the campaign name) for 30 days and save it with the family account so we can tell which ads are worth running. You can block these cookies in your browser or ad settings without affecting the app.
We will post updates here and, for material changes affecting children's data, notify parents by email before they take effect.