How we look after your family

You hold the account. Your children have profiles on it - no logins, no email addresses, no passwords of their own, nothing for them to lose.

For each child we store a first name, an age, and whether they are a boy or a girl. That is the whole of it. The gender is not demographics: Arabic changes the words for "I am ..." depending on who is speaking, so there is no grammatically neutral sentence to fall back on.

We never store a photograph, a surname, an address, a school, or a date of birth. We never ask for them, so there is nothing to leak.

If you tap one of the dialects we have not built yet, we store that: your account, which dialect, and when. It is how we decide what to build next, it is counted once per family however many times you tap, and it goes when your account does.

If you take a paid plan, the payment is handled by Stripe, our payment processor - behind your password, so it is your choice and not your child's. Your card details go straight to Stripe and never touch our servers; we could not see them if we tried. What we keep is small: an id that points to your account at Stripe, and whether your plan is active - which is only how the right lessons open. It goes when your account does. That, and the dialect tap above, are the only things here that are about you rather than about teaching your child.

Three things leave our server for OpenAI, who provide the AI in this product.

The phrases we read aloud. We send the Arabic text of a phrase and get audio back. Your child never has to see that text - it is only what makes the speech sound right.

What your child says into the microphone. Speaking is part of the product from the first lesson, so this is on for every child unless you turn it off. The recording is sent to be turned into text, so we can tell them how close they were; the recording itself is never stored, by us or in any library here. Nothing is sent unless your child is holding the button down, and you can switch speaking off for your whole family with one tap on the Family page - it stops working immediately, on every device.

What your child typed or said in a conversation with the AI partner, and what it replied. The AI conversation was retired in August 2026 and no new ones are created; what was already recorded is kept and deleted exactly as described below. Both directions were screened for anything unsuitable before they went any further.

What we send is deliberately narrow: your child's first name, age and gender, the family names and interests you chose to add, and the phrases from the lesson. Your email address, your password and your payment details are never part of it.

Conversations with the AI partner are stored for 30 days and then deleted automatically.

This is the one place we hold your child's words, and we thought hard about it. The rest of this product is built to hold almost nothing about a child. But a product that puts an AI in front of a nine-year-old and then cannot show you what it said is asking for a trust it has not earned. You should be able to look.

So: you can read every conversation on the Family page, and delete all of it there with one button, immediately. Deleting it does not touch what your child has learned - their progress and their profile stay exactly as they were.

It is used for nothing else. Not to train any model, not for analytics, not for quality scoring. It exists so you can read it.

If you delete a child's profile, everything they ever said goes with it in the same moment.

If you tell us a reply was wrong, we keep a copy of that one exchange along with anything you wrote about it - even after the 30 days, and even if you have cleared the conversation.

That is a deliberate exception and we would rather say so than bury it. A report whose evidence deletes itself is a complaint about nothing, and we cannot look into something we cannot see. It is one exchange, never a history, and it goes when your account does.

The first six lessons are free for as long as you like, and always will be. A paid plan opens the rest of the road for every child on the account.

Payments run through Stripe, a payment company used by a large part of the internet. When you subscribe you enter your card on Stripe's own page, not ours - your card number and its expiry never reach our servers, and we could not charge you anything Stripe did not tell us to.

From Stripe we keep two small things: an id that points to your record at their end, and whether your plan is active, past due, or canceled - which is only how we know which lessons to open. To cancel, change your card, or read an invoice, you open Stripe's own billing page from the Family page; we do not build those screens.

If you cancel, you drop back to the free six lessons and nothing you have learned is lost - every star, every phrase in review, all their progress stays exactly as it was. Taking away what a child has already learned because a plan ended is the opposite of the promise on the front of this product.

No advertising, and no advertising identifiers. Nobody is buying your child's attention here.

No analytics, no tracking pixels, no session recording, no third-party tags. Pages a child opens make no request to anybody but us. Nothing here watches what you do: the only things we record about you are the dialect you tapped to ask for and, if you subscribe, that your plan is active - both above, and each one your own deliberate choice.

No email to a child, ever. We hold no child email address to send one to. The only messages we send are to you: confirm your address, and reset your password.

We do not sell, rent or share your family's information with anyone. Two companies receive anything at all: OpenAI, for the three purposes above, and - only if you choose to pay - Stripe, to take the payment. Nobody else.

Delete a conversation: Family page, one button, gone immediately.

Delete a child's profile: Family page. Their progress, their conversations and everything else attached to them goes at the same moment.

Delete your whole account: also on the Family page, behind your password. Nothing is removed for seven days, and the account is signed out everywhere in the meantime - signing back in during that week cancels it. After the seven days, everything goes: your account, every profile, all progress, all conversations, your consent records and your email address. Emailing us works too, and either way it is complete within 30 days of your request.

Two things survive a deleted account, and we would rather say so than have you find out: our billing records of what the AI cost us, with your account stripped off them so they no longer belong to anyone; and one anonymous line saying a deletion happened, when, and how many rows went - so we can prove to you, or to a regulator, that it did. Neither can be traced back to you or your children.

Take a copy of everything: Family page, one button, one readable file - your account, each child's profile, their family and interests, their progress, and their conversations. No password prompt in front of it; reading your own data is not a privilege.

Passwords are stored as scrypt hashes - we cannot read yours, and neither can anyone who obtained a copy of our database. Password reset and confirmation links are stored the same way, so a stolen backup does not hand somebody a working set of them.

Every query for your family's data is scoped to your account in the database itself rather than checked once and trusted afterwards, and there is a test suite whose entire job is to try to read one family's data as another and fail.

This is a small product run by one person. It is built carefully, and it is not backed by a security team. We would rather you knew that than assumed otherwise.