Legal

Privacy Policy

Last updated: 24 October 2026

Cerita Store by Mummy Store is run by Mummy Store (202503006759 (RA0120359-T)), a business registered in Malaysia under the Registration of Businesses Act 1956. This policy explains what personal data we collect when you use our free books and games or buy from our shop, why we collect it, and the choices you have. We follow the Personal Data Protection Act 2010 (PDPA) of Malaysia.

1. What we collect

When you read or play without an account

• Which books and games are opened, the pages reached, scores reported by games, and time spent.
• A random code stored in your browser so a reading session can continue. It does not identify you by name.

When you create an account

• Name and email address, and a password (stored securely; we can never see it).
• Reading progress, game scores and stars, linked to the account.

When you order from the shop

• Name, email, phone number and delivery address.
• What you ordered, the amount, and the payment method you chose.
• Payment receipts you send us (for bank transfer). We do not collect or store card numbers. Online payments, when offered, are processed by our payment provider CHIP.

When you contact us

• Messages you send us by WhatsApp, email or phone.

2. How we use it

• To show books and games, save reading progress, and award stars.
• To process, deliver and support your orders, including returns and refunds.
• To understand which books and games are used, so we can improve the library.
• To recognise and reward active young readers. We will ask a parent before using a child's name publicly.
• To keep the site safe and to meet our legal and tax obligations.

We do not sell personal data, and we do not show advertising inside the books and games.

3. Children and parents

Our library is made for children. Because of this:

• Children can read and play without an account. An account is only needed to save progress and stars.
• An account for a child under 13 should be created by a parent or guardian, using the parent's email address. By creating it, the parent agrees to this policy for the child.
• We only ask for what is needed: a name (a first name or nickname is fine) and an email.
• Parents can ask us at any time to see, correct or delete their child's account and reading history.
• If we learn that we hold a child's data without a parent's permission, we will delete it.

4. Who we share it with

We only share personal data with service providers who help us run the site, and only what they need:

• Supabase: stores our database, accounts and uploaded files.
• Vercel: hosts the website.
• CHIP: processes online payments, when you choose that option.
• Courier and delivery partners: receive your name, phone number and address to deliver your order.

Some of these providers store data on servers outside Malaysia. We choose providers that protect data with strong security. We may also disclose data if the law requires it.

5. How long we keep it

• Order records: 7 years, as required for business and tax records in Malaysia.
• Accounts, reading progress and scores: until you or a parent ask us to delete the account.
• Reading sessions without an account: kept as anonymous usage statistics.

6. Your rights

Under the PDPA you may:

• Ask for a copy of the personal data we hold about you or your child.
• Ask us to correct data that is wrong or out of date.
• Withdraw your consent and ask us to delete your account.
• Tell us if you do not want to receive messages about new books, games or offers.

Contact us using the details below. We will reply within 21 days. We may ask you to confirm who you are first.

7. Cookies and browser storage

• Sign-in cookie: keeps you signed in. Needed for accounts to work.
• Cart: your shopping cart is saved in your browser.
• Reading code: a random code saved in your browser to continue reading sessions.

We do not use advertising or tracking cookies. Clearing your browser's data removes all of these.

8. Security

We use secure connections (HTTPS), store passwords in encrypted form, and limit who can see personal data. Books and games run in a sealed area of the page so they cannot read your account details. No website is completely secure, so please keep your password private.

9. Links to other websites

Our site links to WhatsApp, social media and payment pages. Their own privacy policies apply when you use them.

10. Changes to this policy

If we change this policy, we will update it on this page and change the date at the top.

11. Contact us

See also our Return & Refund Policy.