Privacy policy

What we collect and why

• A parent’s phone number or email, depending on registration method, for account verification, sign-in and PIN recovery. Verification uses MauriSignal SMS or email.
• The parent’s and children’s first names for the family account and individual child profiles. We retain the account identifier and provider identifiers when Google, Facebook or Apple is linked. PINs are stored as salted hashes, rather than plain text.
• The app installation identifier, device platform and session credential to register devices, control lesson access and enforce the free lesson limit. A guest free lesson needs no phone number or name.
• Lesson progress, stars and exercise attempts are stored on the device for each child. Progress is not currently synchronized between devices.
• Bankily, Apple or Google payment records, including receipts, amounts, currency, school year, status and transaction references, to verify purchases, provide access, handle refunds and keep accounts. A Bankily payment sends the Bankily phone number and payment passcode to Bankily. We never collect or store card data; the store or Bankily handles the payment method.
• Operational and security records, including IP addresses, request times, devices and lesson grants, to diagnose failures and prevent abuse. Some usage limits retain derived identifier keys.

Children’s privacy and analytics

The parent creates the family account and child profiles. There is no advertising SDK in children’s screens. This website has no tracking tools, analytics or tracking cookies. Anonymous lesson analytics are planned only and are not currently enabled; they would require parental consent and an updated policy before activation. We do not promise server synchronization of children’s progress.

Storage and service providers

The planned production infrastructure stores account and payment data, the database and lesson files with DigitalOcean in Frankfurt, Germany. Child progress stays on the device. MauriSignal and the email service deliver verification codes; the chosen sign-in provider verifies sign-in, and Bankily, Apple or Google processes payments under its own service.

Retention and deletion

Account data remains while the account exists; there is currently no general automatic deletion period. Deleting an account erases its phone, email, names, account identifier, PIN hash, linked sign-in provider identifiers and child profiles. All devices are signed out and their installation identifiers in the device records are replaced. The app clears local family progress when deletion is performed on the current device. Other devices learn of deletion when they contact the service; an offline device cannot be immediately erased remotely.

Payment records remain linked to an account row stripped of identifying profile data for accounting, including receipts and transaction references. An encrypted Google purchase token and its references may remain while verification is pending or a paid purchase still needs acknowledgment; the token is cleared when the required work finishes. Installation identifiers in free-lesson and guest records remain to enforce the one-free-lesson limit. Technical records and some derived keys also remain to prevent repeated free lessons and abuse. No fixed retention period has been set for these records, and we do not promise immediate removal from backups. See account deletion for steps and details.

Security

The production configuration uses HTTPS. The server hashes PINs with salted scrypt, verifies sign-in and payment providers, rate-limits sign-in attempts and temporarily locks accounts after failed attempts. Device credentials protect account access. Absolute security cannot be guaranteed. Do not share PINs, verification codes or Bankily payment passcodes.

Contact

For privacy questions, refunds for Bankily purchases, or account deletion requests, contact [support contact].