Privacy
What stays on your device
We store the selected age group, country, language, learning focus, text size, completion of initial setup with a grown-up, reading positions, bookmarks, completed stories, Play Island stickers and the latest check-up result per topic (number correct, date and stories worth another look) on this device. Individual check-up answers are not stored. We do not request names, exact birth dates, photos, location or contacts.
Connections and external services
Account sync is paused pending legal review, so no new learning records are sent to our server. If resumed, transfer requires a signed-in adult guardian to read the notice and activate it separately in an approved country. The app has no ads, chat or in-app purchases; neither the app nor children’s learning screens use analytics. Hosting providers may process IP addresses and request details to deliver the website. Outside resources have their own policies; device speech services may need a network depending on settings.
Website visit statistics (Google Analytics)
Google Analytics 4 measures visits, referrals and button use only on home, demo, grown-up, Plus, institution and information pages after a grown-up allows statistics. Children’s learning screens and the app are not measured; age, gender and learning records are not sent. Ad signals and personalisation are off. The retention target for event- and user-level data is two months; the actual GA setting awaits operator verification. Aggregated reports and separate exports do not necessarily share that limit and need separate checks. Google Ads conversions are off in all countries pending legal review, including previous opt-ins; we do not use remarketing. All features work if you decline; change preferences under Cookie settings.
Bodinoo Plus payments (Xsolla)
Plus payments are currently disabled. If resumed after acceptance, Xsolla receives email, country, language, currency, selected plan and order number; Bodinoo does not receive card numbers. A separate billing store keeps authenticated account ID, adult self-declaration country/time, order/transaction IDs, payer email, subscription/refund status, amount, currency, transaction times and access status/expiry. Self-declaration does not verify age or legal guardianship. Account deletion blocks authenticated access but does not automatically erase billing records; rights requests and retention exceptions are handled separately. Ongoing contracts are kept while needed; closed records are cleaned up five years after the last transaction or related processing. The app and children’s learning screens have no payments.
Inquiries and the waitlist
Institution inquiries collect the organisation, contact name, email and any optional phone, seats or message; the Plus waitlist collects email, number of children and features of interest. We also record first-touch attribution, consent purpose, notice version, and consent and withdrawal times. These are used only to reply and announce the launch, never sold or used for ads. We delete them with related consent and delivery records one year after the last sign-up or inquiry processing. Unsubscribe links stop announcement emails without extending retention. Contact support separately to request personal-data deletion. These forms are for adults.
Optional grown-up account
Accounts are for adult guardians; signing in alone does not enable sync. Sync is paused pending country-specific legal review. A Google or Apple identifier identifies the account; we do not request or store names, email addresses or photos. We keep sign-in/unlinking credentials, a support code, last-use time, up to 90 days of account activity and previously synced records. If resumed and separately enabled, we keep the selected country, notice version, confirmation time, learning settings, reading positions, bookmarks, completed stories, stickers and check-up results. Activation is a guardian self-declaration, not verified age or legal guardianship. Delete the account and existing server records in the grown-up space.
Keeping and deleting learning
Use “Delete all settings and learning” in the grown-up space to remove saved settings and records. Account sync is currently paused; previously transferred records may remain; deleting the account immediately removes the synced copy from our operational database. Earlier copies may remain in server backups until rotated out of the latest 14 completed backups. Restore procedures require an isolated environment and checks of retention and deletion requests. Device backup and restore depend on operating system or browser settings. People sharing a device see the same learning; this is not a private account for each person.
Service providers and international transfers
Cloudflare, Inc. (United States and worldwide locations) handles delivery/protection, Google LLC (United States) opted-in statistics and Google sign-in, and Apple Inc. (United States) Apple sign-in. Payments are paused; Xsolla would process them if resumed. The previously named US Xsolla entity, actual contracting party and processing countries require confirmation. Replies and notices are configured to send through the Amazon SES Seoul (ap-northeast-2) endpoint; the contracting party and the inbox's processing country are unverified. Origin/DB backup/NAS locations, retention/deletion settings and optional external alert recipients are also unverified. If alerts are configured, service names, times, failure status and connection details may reach the recipient. Provider deletion depends on actual policies, settings and contracts and is not guaranteed automatically. Declining statistics and optional sign-in/payment reduces those transfers; delivery-related connection processing cannot be declined.
Your rights
You and a parent or legal guardian may ask to access, correct, delete or restrict personal data, or withdraw consent. Records on the device can be deleted in the grown-up space. For account, inquiry, waitlist or payment data, email the contact address below; after confirming identity we reply within 10 days, explaining any data we must keep by law. The lawful basis and required guardian verification for child-learning sync are under legal review, and sync is paused meanwhile. UK users may complain to the Information Commissioner's Office (ico.org.uk); users in Japan may contact the Personal Information Protection Commission; users in Korea may contact the Personal Information Dispute Mediation Committee (1833-6972) or KISA (118).
Children's privacy
Bodinoo is designed for children to use with a grown-up. Children’s learning screens do not ask for names or contacts, keep records on the device and use no analytics or advertising tools. Account sync is an optional adult-guardian feature and is currently paused pending country-specific legal review. If resumed, the signed-in adult guardian must declare their role and enable it separately. Google/Apple sign-in, the grown-up arithmetic lock and this self-declaration do not verify age or legal guardianship and are not verified parental consent. Legally required verification methods remain under review. If you believe a child sent information without a guardian’s permission, contact support; we will check and delete it.
How we protect data
All connections use HTTPS (TLS), and HTTP requests are redirected to HTTPS. Operational databases and backups are readable only by the operator account; the admin console requires sign-in, role-based permissions and origin checks. Passwords are either not stored or kept only as one-way hashes, and we never receive card numbers. Some operational database records are cleaned up periodically. Provider data, backups and exported copies need separate retention/deletion procedures and verification.
Privacy contact and changes
Our privacy officer is the representative listed in the business details below; send privacy questions, access requests and complaints to the contact email. This policy takes effect on 29 October 2026. We announce changes on this page and in the service 7 days before they take effect (30 days for changes important to your rights) and show the effective date at the bottom. History: 2026-10-29 disabled Ads conversions, paused guardian sync and clarified verification limits / 2026-10-28 added providers and transfers, rights, children, safeguards and privacy officer / 2026-10-27 expanded payment, inquiry and account retention / 2026-10-09 first published.