Privacy Policy

2.1 Account Information (Provided by Parents / Guardians)

2.2 Authentication Data

We support multiple sign-in methods:

Sessions are managed via JSON Web Tokens (JWT). Access tokens expire after 7 days and refresh tokens after 30 days, both stored securely on-device.

2.3 Children's Learning & Game Activity Data

As a child uses Speechora, we collect data about their interactions with educational content. This data is linked to the parent's account and is used exclusively for educational progress tracking:

• Time Spent: Seconds spent in each game and each learning category.
• Game Results & Scores: Correct answers, incorrect answers, total scores from True/False quizzes, Animal matching, Alphabet drag-drop, Number matching, and Fill-in-the-blank games.
• Category Progress: Which learning categories (Animals, Fruits, Alphabets, Numbers, etc.) have been explored.
• Customised Content: Any custom names, images, or audio a parent has added.
• Favourites: Items marked as favourite by the user.

2.4 Subscription & Payment Information

When a subscription is purchased we collect subscription type, start/end dates, price paid, status, and promo code used.

2.5 Text-to-Speech (TTS) Preferences

Speechora uses the device's native Text-to-Speech engine to read out learning content aloud. TTS language and voice ID preferences are stored locally on the device only using AsyncStorage and are never sent to our servers.

2.6 Push Notification Data

With your permission, we send push notifications for account events, new content alerts, and subscription reminders. You can manage this permission at any time through your device Settings.

2.7 Device & Technical Data

We and our third-party providers (Firebase) automatically collect device type and model, OS version, unique device identifiers, IP address (for security only), and app crash reports. This data is used solely for security, bug fixing, and performance improvement — not for profiling or advertising.

2.8 Security Measures

All data transmitted to our servers is encrypted using HTTPS (TLS 1.2+). Your password is never stored in plain text—it's hashed using bcryptjs before being saved.

4.1 Parental Consent

All accounts on Speechora are created by adults (parents or guardians) only. During registration, the adult must: (1) Accept the parental consent declaration confirming they are at least 18 years old, and (2) Confirm they are the parent or legal guardian of the child using the app. We do not knowingly permit children to register independently. By creating an account and checking the consent box, the registering adult is confirming their age and relationship to the child.

4.2 Minimum Data Collection from Children

We collect only the minimum data necessary to deliver the educational experience and allow parental monitoring. We collect the child's first name and last name for account personalization and profile identification. We collect an optional phone number for account recovery purposes. A child's activity is tracked solely under the parent's linked account. Game results and time-tracking data are aggregate and educational in nature. Note: The account creator (parent/guardian) must verify they are at least 18 years old during registration.

4.3 No Social or Communication Features

Speechora does not include chat, messaging, or social networking features; public profiles visible to other users; user-generated content sharing between accounts; or forums or community spaces. Children cannot communicate with anyone else within the app.

4.4 No Behavioural Advertising to Children

We do not display third-party advertisements to children, and we do not use children's data for any advertising, analytics profiling, or data monetisation.

4.5 Parent Dashboard Access

The Parent Dashboard (Activity Log, progress charts, game scores, and weekly performance comparisons) is accessible via the student's profile screen. Access is locked behind a 5-second long-press gesture on the "Switch" button. This deliberate step ensures that detailed reporting is accessed by the parent, not the child.

4.6 Parental Rights Under COPPA & GDPR-K

Parents and guardians have the right to:

6.1 Security Practices

6.2 Data Retention

When you delete your account:

• All personal data is deleted within 30 days
• Payment records are retained for 90 days for accounting

6.1 Where Data is Stored

6.2 Security Measures

6.3 Data Retention

When you delete your account, all personal data is permanently removed within 30 days. Subscription records are retained for 90 days as required by financial regulations.