Talkio Kids Privacy Policy

1. Who we are

A parent or legal guardian should contact us with any question or request about a child's information.

2. Our privacy approach

Talkio Kids is designed to work without a child account or cloud learning profile. The lessons are bundled with the app. Learning information stays on the device. We do not include third-party advertising, behavioral advertising, social features, third-party analytics, or location tracking.

The app uses RevenueCat only for parent-controlled purchases. RevenueCat is not started when the app launches or when a child uses free lessons. It starts only after an adult enters the parental area and affirmatively chooses to check purchases or request a purchase support ID after seeing an in-app disclosure. Opening the store's subscription-management page does not start RevenueCat.

3. Information handled on the device

Talkio Kids stores the following information locally on the device:

• A generic localized profile label, such as "Pilot"; Talkio Kids does not ask for the child's real name.
• The selected home language and co-pilot.
• Completed lessons, vocabulary mastery, scores, accuracy, attempts, response similarity, time spent practising, XP, and recent practice statistics.
• App preferences such as sound and reminder time.

This information is used to provide lessons, remember progress, choose review activities, and show a parent the child's progress. We do not receive this learning information on a server and do not provide it to RevenueCat, Apple, or Google.

4. Microphone and speech recognition

Some optional exercises invite the child to say a word aloud. If the parent enables microphone and speech-recognition permission:

• Talkio Kids instructs the operating system to perform recognition on the device.
• The app temporarily receives possible text transcriptions to compare with the lesson word.
• The app does not save microphone audio or transcriptions.
• We do not upload microphone audio or transcriptions to our servers or send them to RevenueCat.

If on-device recognition is unavailable, the app uses a self-assessment flow and does not open the microphone. A parent can decline or revoke permission in device settings without losing access to the course.

The device operating-system provider may independently process diagnostic or permission information under its own terms and settings.

5. Notifications

If a parent enables a daily reminder, Talkio Kids schedules it locally on the device. We do not use a push-notification server, collect a push token, or send remote marketing notifications. The parent can disable the reminder in Parent corner or in device settings.

6. Parent-controlled purchases

Talkio Kids offers an optional subscription through Apple's App Store or Google Play. When an adult affirmatively opens purchase options, Talkio Kids starts RevenueCat, our subscription-management service. RevenueCat may process:

• A randomly generated anonymous App User ID.
• Device type, operating system and related technical information.
• IP address and approximate location inferred from the IP address.
• App, store, locale and currency information.
• First-seen and last-seen times.
• Product, subscription, purchase and renewal status.
• Apple receipt information or Google purchase tokens and related transaction identifiers.

We use this information only to display an offering, validate a purchase, prevent purchase fraud, restore purchases, provide paid access, support a parent, and understand subscription performance. We do not give RevenueCat the child's local profile, learning progress, practice history, microphone audio, or speech transcriptions. We do not set RevenueCat customer attributes, connect RevenueCat to advertising or attribution services, or use its data for behavioral advertising.

Apple or Google processes payment and store-account information under its own privacy policy. We do not receive the parent's full payment-card details.

7. Information a parent sends us

If a parent contacts privacy or customer support, we receive the information the parent chooses to provide, such as an email address, message, and anonymous purchase support ID. We use it to answer the request, provide support, protect the service, and meet legal obligations. Parents should not send a child's real name, voice recording, photograph, or other unnecessary personal information.

8. Purposes and legal bases

Where the GDPR, UK GDPR, or similar law applies, our legal bases are:

• Providing the app and subscription: performing our agreement with the parent or taking steps requested by the parent.
• Local progress and service security: our legitimate interests in providing a private, functional and secure learning app, balanced against children's rights and interests.
• Optional microphone access and starting purchase services: the parent's affirmative choice and device permission where consent is required. Consent may be withdrawn through the app or device settings.
• Transaction and compliance records: compliance with legal obligations.
• Support and legal claims: our legitimate interests in answering requests, preventing misuse, and establishing or defending legal claims.

9. When information is disclosed

We disclose information only as described here:

• RevenueCat, Inc. processes the purchase-related information listed above as our service provider/processor.
• Apple and Google operate their app stores, process payments, and manage subscriptions under their own terms.
• Our website hosting provider may process ordinary web-server logs — such as IP address, timestamp, requested page and browser user agent — when someone visits this page. These pages are static, set no cookies, and run no analytics or tracking scripts.
• Professional advisers and authorities may receive information when reasonably necessary to comply with law, protect rights or safety, complete a corporate transaction, or establish or defend legal claims.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or targeted advertising.

10. Retention

• Local profile and learning data remain on the device until a parent uses Delete local child data, removes the app, or clears the app's storage.
• Temporary speech transcriptions remain in memory only for the exercise and are not written to the app database.
• A local reminder remains scheduled until a parent disables it, deletes local child data, or removes the app.
• Purchase records held by our subscription service are kept for as long as needed to provide and support paid access and to meet accounting, tax, fraud-prevention and legal requirements — ordinarily up to 24 months after the subscription ends, and longer where a legal obligation requires it.
• Support communications are kept for as long as needed to handle the request and any follow-up, ordinarily up to 24 months.

We do not retain personal information indefinitely merely because it may be useful in the future.

11. Deletion and parental choices

In the gated Parent corner, a parent can:

• Disable reminders and sound.
• Open the Privacy Policy and Terms of Use.
• Manage the subscription in the applicable app store.
• Display the anonymous RevenueCat purchase support ID after a disclosure.
• Delete the local profile, progress, attempts, practice history, settings and reminder.

Deleting local child data does not cancel a store subscription and does not automatically erase transaction records held by Apple, Google, or RevenueCat. A parent can contact us with the anonymous purchase support ID to request access, correction, or deletion of purchase-related information. Deleting a RevenueCat customer does not itself cancel an Apple or Google subscription.

Subject to applicable law, a parent may ask us to access, correct, delete, restrict, or provide a copy of personal information; object to processing; withdraw consent; or complain to a data protection authority. We will verify that the requester is authorized to make the request. Contact hello@talkio.ai.

12. Children's privacy and COPPA

Talkio Kids is child-directed, but it is designed so that the child can use the learning experience without sending personal information to us. Purchase services and external legal links are reserved for adults. We do not knowingly collect a child's real name, contact information, precise location, photographs, stored voice recordings, or online learning profile.

If a feature would require online collection of a child's personal information, we will provide the required direct notice to the parent and obtain verifiable parental consent before collecting it, unless a legal exception applies. We will not condition a child's participation on providing more information than is reasonably necessary.

A parent who believes a child sent personal information to us should contact us. We will investigate and delete it where required.

13. Security

We use data minimization, local storage, platform permission controls, transactional database writes, TLS for purchase-service communications, access controls, and service-provider review to protect information. No security measure can guarantee absolute security.

To report a suspected security problem or data incident, contact hello@talkio.ai with "Security" in the subject line. Where a breach is likely to result in a risk to individuals, we will notify the competent supervisory authority and affected parents as required by applicable law.

14. International transfers

RevenueCat and its subprocessors may process purchase-related information in the United States or other countries. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK addendum.

15. Changes to this policy

We will update the effective date when this policy changes. If a change materially affects children's information or requires new parental consent, we will give parents appropriate notice and obtain consent before the new practice begins where required.

16. Contact and complaints

Parents in the EEA or UK may also complain to their local supervisory authority. Our lead supervisory authority is the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark — datatilsynet.dk.