Privacy Policy
Last updated: 3 August 2026 · Version 1.0
The short version. LingoBuddy is used by children, so we collect as little as the product can work with. We show no advertising, we run no ad networks, we build no advertising or behavioural profiles, and we never sell or rent data to anyone. No analytics event is ever recorded from a screen a child is using. A parent can export or permanently delete everything from inside the app.
1. Who we are
LingoBuddy is published by Dode Yazılım, Türkiye, which is the data controller for the information described here. Questions, access requests and deletion requests: destek@dodeyazilim.com.
2. Accounts are held by parents, not children
Only an adult can create a LingoBuddy account. During setup the parent gives explicit, separate consent for (a) collecting their child’s learning data and (b) recording their child’s voice. Voice recording consent can be refused, and the app still works. Both consent choices, and the version of this policy they were given against, are stored with the account and can be changed at any time in the parent area.
A four-digit parent PIN protects everything on the parent side: settings, transcripts, data export, subscription and account deletion. A child using the app cannot reach any of it, and cannot reach a purchase screen.
3. What we collect
| Category | Examples | Why |
|---|---|---|
| Parent account | Email address, sign-in method (email, Apple or Google), display name, language, time zone, subscription status | To create the account, sign in, and provide the service |
| Child profile | First name or nickname, age, chosen avatar and mascot, English level, learning goals, daily time limit, bedtime window | To pick content at the right level and enforce the limits the parent set |
| Learning data | Conversation transcripts, words learned, lesson and quiz results, pronunciation scores, story progress, streaks and badges | To teach adaptively and to show the parent what their child is actually learning |
| Voice recordings | Short audio clips of the child speaking | Only with separate parental consent. Used to transcribe speech and score pronunciation. Deleted automatically after 30 days |
| Technical | App version, operating system version, crash diagnostics, push notification token (only if notifications are enabled) | To fix crashes and deliver the reminders the parent turned on |
What we never collect
- No photos, camera access, or uploaded images
- No location data
- No contacts, calendar or device address book
- No advertising identifiers
- No payment card details — Apple and Google process payments and never pass card data to us
4. Analytics and crash reporting
Product analytics run only on parent screens and are limited to a fixed list of events such as “parent opened the dashboard” or “subscription screen viewed”. This is enforced in the code, not by convention: the analytics client refuses to send anything while a child-facing screen is on display, and automatic event capture is switched off entirely. Session recording and screen recording are not used anywhere in the app.
Crash reporting is enabled so that a crash we cannot see does not become a crash we cannot fix. It runs with personal information disabled and a scrubber that strips anything carrying a child’s words — transcripts, mascot replies, story text and recording links never leave in a crash report.
5. Service providers
We use a small number of processors. Each one receives only what it needs, and none of them may use the data for their own purposes or to train models.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, accounts, file storage, server functions | Australia (Sydney) |
| OpenAI | Speech-to-text, mascot conversation, text-to-speech, pronunciation scoring, safety moderation | United States |
| Resend | Account emails and the optional weekly parent report | United States / European Union |
| Sentry | Crash diagnostics (personal information disabled) | European Union |
| PostHog | Parent-screen product analytics only | European Union |
| RevenueCat | Subscription status | United States |
| Apple, Google | Sign-in and payment processing | Global |
International transfers
Our database is hosted in Australia and some processors operate in the United States. If you are in the European Economic Area or the United Kingdom, this means your and your child’s data is transferred outside that area. We rely on the European Commission’s Standard Contractual Clauses with these providers as the transfer safeguard. You may request a copy of the relevant clauses at destek@dodeyazilim.com.
6. How long we keep things
- Voice recordings: deleted automatically 30 days after they are made, by a scheduled job — not on request, and not manually.
- Transcripts and learning progress: kept while the account exists, because they are what the parent dashboard and the child’s progress are built from.
- Everything else: deleted when the account is deleted.
7. Your rights
A parent may, at any time and without contacting us, from the parent area of the app:
- see every stored conversation and every word their child learned
- export the account’s data
- correct a child’s profile details
- withdraw voice recording consent
- delete the account permanently — this removes the parent account, all child profiles, all transcripts and all stored audio, and cannot be undone
Under the GDPR and comparable laws you also have the right to object to processing, to restrict it, and to complain to your local data protection authority. Write to destek@dodeyazilim.com and we will respond within 30 days.
8. Children’s privacy
LingoBuddy is designed for children aged 5–12 and follows the Children’s Online Privacy Protection Act (COPPA) and the GDPR’s rules for children. The details — how parental consent is obtained, what a child can and cannot do in the app, and how to revoke consent — are on the Children’s Privacy page.
9. Security
Data is encrypted in transit and at rest. Access to each family’s records is enforced at the database level, so one account cannot read another’s. Sign-in sessions are held in the device’s secure storage. No security is perfect, and we will notify affected parents and the relevant authority without undue delay if a breach affects personal data.
10. Changes
If we change this policy in a way that affects what we collect or who receives it, we will notify parents in the app and by email before the change takes effect, and ask for consent again where the law requires it. The version number and date at the top of this page always identify the current text.