PAIA manual
This is the manual of Tiny Twigs Studio, the publisher of Maatjie Arena, under section 51 of South Africa's Promotion of Access to Information Act 2 of 2000 (PAIA), as amended by the Protection of Personal Information Act 4 of 2013 (POPIA). It says who we are, which records we hold, how to ask for them, and how we handle personal information. Last updated: 13 October 2026.
1. Who we are and how to reach us
Maatjie Arena is a free pet-raising and battling game for children, made and published by Tiny Twigs Studio, a private body in South Africa. Requests under PAIA, and questions about this manual or about personal information, go to our Information Officer.
Tiny Twigs StudioHead of the private body and Information Officer: Tiny Twigs Studio
South Africa
Email: info@tinytwigsstudio.com
Website: maatjiearena.com
2. The Information Regulator's guide
The Information Regulator has published a guide on how to use PAIA, as section 10 of the Act asks. It explains the right to ask for records, how to make a request, the fees, and what you can do if a request is refused. It is available in every official language from the Information Regulator:
- on its website, inforegulator.org.za, which also has the forms mentioned in this manual and the Regulator's postal and street address;
- by email from enquiries@inforegulator.org.za.
3. Records anyone can read without a request
We have not published a notice under section 52(2) of PAIA. These records are open to everyone, free, on this website, with no request needed:
- our privacy policy, which says what the game keeps, why and for how long;
- our Terms of Use;
- how to delete an account, and what is kept afterwards;
- the crate drop tables, with the chance of every item;
- this manual, and every other page of this website.
4. Records we keep because other laws ask for them
We keep records as these laws require, as far as they apply to us: the Income Tax Act 58 of 1962, the Tax Administration Act 28 of 2011, the Value-Added Tax Act 89 of 1991, the Electronic Communications and Transactions Act 25 of 2002, the Consumer Protection Act 68 of 2008, the Protection of Personal Information Act 4 of 2013 and the Promotion of Access to Information Act 2 of 2000. Records that one of these laws makes public are available as that law provides.
5. The records we hold
By subject, these are the records we hold. The privacy policy says how long each is kept.
| Subject | Records |
|---|---|
| Players' accounts and game data | Each account's player number and a scrambled form of its device codes, its nickname, its pets and Pet Album, game progress (care, battles, ratings, badges, rooms, items, outfits and crates), friends, friend requests and blocks, friendly battles, the online, holiday mode and friends and leaderboards settings, the players it hid, the devices on the account and when a grown-up last signed the others out, the day the game was last played, a grown-up's agreement to the Terms of Use, the swap safety code secret, and, if a grown-up saved the pet to Google, Google's number for that Google account. |
| Purchase records | For each Google Play purchase: the product, Google's order number and purchase token, Google's answer when it checked the purchase (with the billing country and a one-way account code), what the purchase gave the account, and any refund. |
| Swap records | Swap offers between friends, and the record of finished swaps: which items changed hands, when, and the player numbers. |
| Nickname and pet name reports | Reports about players' nicknames and their pets' names (the name, when, and a scrambled tag for the reporter), the names that reports hid, and the list of blocked words. |
| Logs | Our game server's logs (a player number, what was asked for, and errors), and counts of tries on our Save to Google page, kept in a scrambled form for one hour. |
| Emails | Messages sent to us, our answers, the requests made (such as to delete an account or to see its information), and what we did about them. |
| Our own business | Accounting and tax records, our agreements with the companies that help us (hosting, email, Google Play), and our Google Play developer account records. |
6. How to ask for a record
- Fill in the request form, Form 2 (Request for Access to Record) of the PAIA Regulations, 2021, from the Information Regulator's website. If you cannot fill it in yourself, write to us and we will help.
- Send it to our Information Officer, by email to info@tinytwigsstudio.com.
- Describe the record well enough for us to find it, say how you would like to receive it (for example a copy by email), and give an email or postal address for our answer. For a record about someone else, also say which right you want to use or protect, and why you need the record for it, as section 53 of PAIA asks.
- Asking for a child. A parent or guardian can ask for a child's records on the child's behalf. Other players can see nicknames, so we first check that a request comes from the player or their parent or guardian, as the privacy policy explains under how we check a request.
- Your own information, more simply. To see, correct or delete your own or your child's information, you do not need this form: write to us, as the privacy policy explains, and we do it free of charge. Under POPIA you can also object to how we use it, or ask us to correct or delete it, with Form 1 or Form 2 of the POPIA Regulations, 2018.
- Fees. PAIA lets a private body charge the fees set in the PAIA Regulations: a request fee, which is not charged when you ask for your own personal information, and an access fee for finding, preparing and copying a record, of which we may ask for a deposit as the Act allows. We tell you any fee before we start, and you can complain to the Information Regulator about a fee.
- Our answer. We decide within 30 days. In the cases the Act allows we may take up to 30 days more, and we tell you why before the first 30 days are up.
- If we refuse. We may refuse only on the grounds in Chapter 4 of Part 3 of PAIA (for example, to protect another person's privacy, someone's commercial information, or someone's safety), and we always give the reasons.
- If you are unhappy with our decision or a fee, you can complain to the Information Regulator within 180 days, or apply to a court.
7. How we handle personal information (POPIA)
Why we use it
- To run the game: accounts, pets, battles, friends, friendly battles, swaps, and giving each account what it bought.
- To keep players safe and the game fair: checking and taking reports about nicknames and pets' names, stopping cheating, theft and fraud, and limiting guesses at friend codes and Save to Google codes.
- To answer messages and act on requests, such as deleting an account.
- To meet the law, including keeping records of sales for tax.
- To delete what we no longer need, on time: for example an account nobody has played for 24 months.
Whose information, and what
| People | Information |
|---|---|
| Players (mostly children) | A scrambled form of the device code, player number, nickname, pets' names, game progress, friends and swaps, the players they hid, nickname and pet name reports, the day the game was last played, purchase records, server logs, and Google's number for a Google account a grown-up saved the pet to. |
| Parents and guardians | A record that they agreed to the Terms of Use, their choice for friends and leaderboards, Google's number for the Google account they saved a pet to, and what they write to us. |
| People who write to us | Their email address, their name if they give it, and what they write. |
| Visitors to this website | The IP address and the short security logs our website's delivery service keeps. |
| Companies that help us | Business contact details and the records of our agreements with them. |
We never ask players for a real name, an email address, a phone number, a home address, a photo or a location.
Who receives it
- DigitalOcean, LLC, which runs our game server and its database for us.
- Cloudflare, which delivers this website and the web game.
- Google: Google Play takes payments in the Android app, and Google runs the sign-in on our Save to Google page.
- Our email provider, which runs the mailbox our contact address uses.
- The police or a court, only if the law requires it, or to protect a child.
We never sell personal information, and we do not share it for advertising.
Sending it outside South Africa
Our game server and its database are in the European Union. Cloudflare and Google work around the world. When information about players in South Africa is kept or handled outside the country, we use only providers bound to protect it as carefully as POPIA requires, as section 72 of POPIA asks, or where it is needed to provide the game the player and their parent or guardian chose.
How we keep it safe
- The game talks to our server only over encrypted connections (HTTPS).
- Our server works out every result, and only we can reach its database. Its keys are kept in files only the server's administrator can read.
- There is no chat, nicknames are filtered and can be reported, and friends are added only with a private code.
- Swaps need a safety code from an authenticator app, set up by a grown-up.
- Android backups of the game's data are switched off, so sign-in details are not copied to cloud backups.
- Backups of our database are encrypted, kept away from the server and deleted after 30 days. Server logs are overwritten as new ones are written.
- Once a month our server deletes what is past its time, as the privacy policy sets out.
- If something ever went wrong that put personal information at risk, we would tell the Information Regulator and the people affected, as section 22 of POPIA requires.
8. Where to find this manual
This manual is on our website at maatjiearena.com/paia/. We email a copy free to anyone who asks, and give one to the Information Regulator when it asks. We update it when the records we hold or the way we handle personal information change.