StudyRUN privacy policy

Last updated: 18 October 2026

StudyRUN is an educational running game for players aged 5 and over, published by Suranga Sandaruwan ("we", "us"). Playing needs a daily subscription that a parent or guardian pays through their mobile phone balance. This policy explains what information the game and our server handle, why, how we protect it, how long we keep it, and the choices you have. If you are under 18, please read it together with a parent or guardian.

The short version

• On the first launch the game asks for an in-game name (a nickname), an age and a school grade. The age and grade never leave your phone.
• Our server gives every installation a player profile automatically. There are no email addresses or passwords: a parent or guardian starts the subscription on the child's phone with their mobile number and a PIN sent to it by SMS.
• The subscription costs Rs 9.00 plus tax a day, charged to that mobile number by the mobile network (SLT-Mobitel, Dialog, Airtel or Hutch). We never see or store card details.
• We do not store the mobile number. We pass it to the mobile network so it can send the PIN and charge the subscription, and we keep only the masked subscriber ID the network gives back.
• The nickname and your run results are sent to our server for the rankings.
• A parent or guardian can cancel the subscription at any time, in the game's Settings or through the mobile network, and can delete the player's data with Delete my data.
• There are no ads, no chat and no tracking tools from other companies. We never sell your information.

What we collect and why

• In-game name. You choose it on the first launch and it cannot be changed later. It is sent to our server once the welcome screens are done, and other players see it on the rankings, so please use a nickname, not your full real name or anything that identifies you. The game refuses names with offensive words, and we may reset or remove names that are offensive or that look like personal information.
• Run results. The game saves each run and, when it is online, sends the saved runs about once an hour: the distance, the number of question cards found and answered correctly, the books collected, the near misses, the run's length and when it ended. Our server works out the score from these. We use them to build the rankings, to check that results are genuine, and to understand how the game is used: totals such as how many players are active and how long they play, and, in our control panel, a list of the most active players.
• Your player profile. When the game first connects, our server creates a random player ID and an access token for this installation, and records when the phone last connected. They identify your results and your subscription. They are not linked to your Google account, email address or advertising ID, and our server keeps the token only in a scrambled (hashed) form.
• The subscription. When a parent or guardian subscribes, the game sends the mobile number they typed to our server, which passes it to the mobile network's subscription service (mSpace for SLT-Mobitel numbers, Ideamart for Dialog, Airtel and Hutch numbers) so the PIN can be sent and the subscription started. The PIN the parent types is passed to the mobile network in the same way to check it, and is not kept. Our server does not keep the number either. It keeps a scrambled form of it (a hash made with a secret key) for about an hour, only to limit how many PINs can be requested, and it keeps the masked subscriber ID the mobile network returns, the subscription's status and, when the mobile network reports it, the date and result of the last charge.
• Network address. Our server sees the network (IP) address of your connection while the game talks to it. We keep only a scrambled form of it (a hash made with a secret key), for about an hour, to limit abuse such as mass registrations. We do not use it to find your location, and our web server does not write it to its logs.

What stays on your phone only

• Your age, used once to confirm that you are 5 or older.
• Your school grade, used to choose the questions you see.
• Your settings, the explorer you chose, the phone's own copy of your best runs and this week's records, the subscription status the game last saw, and a cached copy of the question bank and of these policies.

If Android backup is switched on, Android may also keep a copy of the game's saved settings in the phone owner's Google account and put it back when the game is installed again. Uninstalling the game removes all of this from the phone, but it does not cancel the subscription: cancel it in Settings first, or ask your mobile network.

The subscription and payments

• Rs 9.00 plus tax is charged every day to the subscribed mobile number's prepaid balance or postpaid bill by the mobile network. The price is shown in the game before you subscribe.
• Only a parent or guardian may subscribe, with their own mobile number. By entering the mobile number and the PIN sent to it, you confirm that you are the player's parent or guardian and that you agree to the daily charge.
• You can cancel in Settings > Subscription on the phone that subscribed. Cancelling takes effect within an hour and stops further charges. You can also cancel at any time through your mobile network's own subscription controls.
• A subscription stays with the phone that started it. The mobile network does not send a PIN to a number that already has the subscription, so it cannot be signed in again on another phone, after Log out or after reinstalling the game, unless Android restores the game's saved settings from a backup. Before changing phone or logging out, cancel in Settings if you no longer need the subscription; otherwise cancel through your mobile network. Subscribing again with the same number after it ends starts a new subscription.
• Charges already made are not refunded, except where the mobile network's rules require it, for example a charge made without consent.
• When the balance is empty no charge is made that day, and the game may not be playable until the balance is topped up.
• The game does not read the mobile number or any SMS from the device. A parent or guardian types the number and the PIN.

What we do not do

• No advertising, no ad networks and no advertising identifiers.
• No card payments, prizes or rewards of money or goods.
• No email addresses, passwords, contacts, photos, location, microphone or camera.
• No chat or messages between players.
• No analytics, tracking or crash-reporting tools from other companies.
• We never sell or rent your information.

Children

StudyRUN is made for children, so we ask only for what the game needs. The child picks a nickname rather than giving a real name. We collect no email address, home address or location, and no hardware or advertising identifiers (such as the IMEI or the advertising ID). The only identifier is the random player ID our server makes for the installation, and the only contact detail is the parent's mobile number, which a parent types at the subscription step and which we pass to the mobile network without keeping it. The nickname reaches our server once the welcome screens are done, before the subscription step, and run results follow as the child plays, so that the rankings work. Paying is different: only a parent or guardian may start the subscription. The game asks for a parent (a sum to solve), and the subscription cannot start without the PIN sent by SMS to the mobile number entered. A parent or guardian can cancel the subscription and remove a child's data at any time in the game's Settings, or by emailing us as described under Deleting your data.

How we protect your information

• Everything between the game, our server and the mobile networks travels over encrypted (HTTPS) connections.
• Our server and its database run on Amazon Web Services (AWS) in Singapore. The database is encrypted where it is stored and protected by passwords. A nightly backup copy of it is kept on the server for up to 14 days, in a folder only the administrator can open.
• Access tokens are kept only in a hashed form, the mobile number is never stored, and the PIN-request number and the network address are kept only as hashes made with a secret key, for about an hour, and are left out of the backups.
• Only we can sign in to the game's control panel, with a strong password.
• If we learn of a breach that affects your information, we will tell you and the authorities as the law requires.

Where the information is kept and for how long

Our server and database are in Singapore, outside Sri Lanka, on Amazon Web Services, which stores the data for us and does not use it for anything else. We keep:

• The in-game name, the player ID and the hashed access token, the run results and the last-connected time: until you delete them (see Deleting your data).
• The mobile number: never. Its scrambled form is deleted within about an hour of the PIN request.
• The masked subscriber ID, the subscription's status and its last charge: while the subscription runs, and for one year after it ends as a billing record. Then we delete them.
• The scrambled network address: about an hour.
• Backups of the database: up to 14 days. Deleted information can stay in a backup until that backup is deleted.
• A note in our activity log that a player was deleted, with the first 8 characters of the player ID and no name.

Sharing

• The mobile network that bills the subscription receives the mobile number through its subscription service (mSpace for SLT-Mobitel, Ideamart for Dialog, Airtel and Hutch). It sends the PIN, makes the daily charge, and tells us the subscription's status. It keeps its own records of the subscription and the charges under its own privacy policy. It does not receive your in-game name or results.
• Amazon Web Services stores our server and database for us, as our hosting provider.
• Other players see your in-game name and results on the rankings inside the game. The ranking lists the game receives also carry each listed player's player ID.
• Apart from these, we do not share your information with anyone, and we never sell or rent it. We disclose information only if the law requires it.

Your choices

• Once subscribed you can play offline for up to three days after the game last checked the subscription. Without a connection nothing is sent and your runs stay on the phone until the next upload.
• You can cancel the subscription and delete your data at any time, as described above and below.
• Log out, in Profile, signs this phone out without cancelling the subscription, so the daily charge goes on. The mobile network will not send a PIN to sign the same number in again, so if you no longer need the subscription, cancel it in Settings > Subscription before logging out; after that, cancel it through your mobile network.
• You can uninstall the game to remove everything stored on the phone.

Deleting your data

• Deleting your data deletes your StudyRUN account: the player profile on our server and this phone's sign-in to the subscription.
• In the game: open Settings and choose Delete my data. When you confirm, our server cancels the daily subscription (for every phone signed in with that mobile number) and straight away deletes your in-game name, your player ID and access token, all your results and any recent PIN request. The game then clears your name, age, grade and records from the phone.
• Without the game: email hello@surangasandaruwan.com with the subject "Delete my StudyRUN data". Include the in-game name, the player ID shown in Settings > Delete my data if you can, and roughly when the game was last played. We may ask a question to make sure the data is yours. We then delete the data within 30 days, cancel the subscription if it is still linked to that player (otherwise we tell you how to cancel it with your mobile network), and reply to confirm.
• To stop the daily charges straight away, cancel in Settings > Subscription or through your mobile network's own subscription controls.
• What stays after deleting: the subscription's masked record for up to one year after the subscription ends, as a billing record; deleted information in backups for up to 14 days; and a note in our activity log that a player was deleted (the first 8 characters of the player ID, no name).
• Uninstalling the game removes everything stored on the phone, but not your data on our server and not the subscription. Use one of the options above for those.

Changes to this policy

If we change this policy we will update the date at the top, and the game will show the new version in Settings. If the price of the subscription changes, we will update this policy and the terms before the new price applies, so you can cancel first.

Contact

Suranga Sandaruwan
Email: hello@surangasandaruwan.com