Ponderoo · Legal and safetyPrivacy Policy
Who we are
Ponderoo is made by Nielsen, Los Angeles, California, USA. Contact: hello@ponderoo.app. We are the "operator" (US COPPA) and "controller" (EU/UK GDPR) of the data described here.
What stays on the device
Everything a learner creates in the app is stored only on the device, in the app's own storage:
- a nickname (the app suggests one and asks children not to use their real name), an age, an avatar and optional interests (for example a favourite sport) used to make examples relatable
- lesson progress, stars, badges, outfits and settings (language, voice, sounds)
- the daily goal in minutes, the preferred learning time, minutes learned per day, streaks, awards and the reminder time
We don't receive this data. Deleting a profile in the Grown-up dashboard, or deleting the app, removes it.
Reminders: if a grown-up switches on the daily reminder (iPhone, iPad and Android apps), it is scheduled by the device's own notification system. We use no push service and receive nothing.
What reaches our server, and only when a grown-up turns it on
| Feature | What is sent | Why | How long it's kept |
|---|---|---|---|
| Ask Byte (AI tutor, paid) | The question typed, the last few messages of that chat, the app language and an age band (for example "8 to 10"). Never the name or anything else from the profile. (Ready-made prompts start with the learner's age, such as "I'm 9", because that helps Byte explain at the right level.) | To get an answer from the AI service | Not stored. Daily and monthly question counts (numbers only) are kept for up to 40 days to enforce fair-use limits. |
| Natural voice (paid) | The sentence to be read aloud and the chosen voice | To turn text into speech | The generated audio of lesson sentences is cached so it can be replayed; it contains no personal data. A daily character count is kept 2 days. |
| Quiz Race (live games with friends and family) | A made-up player name (two numbers that pick a word and an animal, such as "Zippy Owl"), the answers tapped and the scores. Never a real name: there is no chat and nothing can be typed. | To run the game and show the scoreboard to the players in that room | Only while the game is on, at most one hour. Results are saved only on each player's device. |
| Family linking (only after a parent creates a family and agrees to the parents' notice) | On the parent's phone: a family key (a random code, no password). If the parent chooses to add a recovery email: a scrambled form of the address (a one-way hash) and a short hint such as n…@gmail.com, never the full address. From each linked child's device: the nickname and age the parent entered, the avatar, and progress numbers (minutes per day for the last 7 days, daily goal, streak, level, worlds passed, share of right answers, number of awards, the names of the latest badges). Never real names, answers, questions or anything typed. | So a parent can follow their child's learning from their own phone and set the daily goal and Ask Byte | Until the parent removes the child or deletes the family in the app, which erases it from our server at once. A link code that isn't used expires after 24 hours. The parent can remove the recovery email at any time; an emailed recovery code expires after 30 minutes. |
| Pilot program (only after a parent joins with a pilot code) | Once a day, one summary per learner: a random pilot number (not linked to a name or device), age path, app language, minutes learned per day, whether the goal was reached, and totals such as worlds passed, quizzes taken and current streak. Never names, answers or anything typed. | To learn whether the app helps children keep learning, so we can improve it | 200 days, then deleted automatically. Leaving the pilot stops it at once. |
| Report a problem with a lesson or question | Which lesson card, game or question it was, the reason picked from a list ("wrong", "confusing", "not OK for kids", "something else"), the app language and the age path (Rookie, Explorer or Grown-up). Nothing typed, no name. | So we can fix mistakes in the lessons | 180 days |
| Report an answer | The question and the AI's answer being reported, the reason chosen and the app language | So we can review and fix unsafe or wrong answers | 90 days, then deleted automatically |
| Subscription check | A random, anonymous purchase ID created by the app (not linked to a name or email) | To confirm the subscription is active | A yes/no result is cached for 5 minutes |
Each request also carries the device's IP address, as all internet traffic does. Our server uses it only to block abuse (for example too many failed attempts in a day) and keeps such counters for at most 2 days.
Service providers we use
We share data only with providers that process it for us, under contract, and only for the purposes above:
- Cloudflare, Inc. runs our server and generates the natural voice (Workers AI).
- Resend, Inc. delivers recovery emails, only when a parent who added a recovery email asks for one. It receives that email address and the message with the one-time code.
- Anthropic, PBC provides the Claude AI model that writes Byte's answers. Anthropic does not use API data to train its models by default and keeps API inputs and outputs only for a limited time for safety and abuse monitoring.
- Apple, Google and RevenueCat, Inc. process subscriptions. We never see card details. RevenueCat receives the anonymous purchase ID and the store receipt.
We do not sell or "share" personal information for advertising, and we don't allow any third party to collect data from children in the app.
Children
Ponderoo is designed for children and their families. Please read the Children's Privacy Notice for Parents, which explains parental consent and parents' rights in detail.
Your rights
Wherever you live, you can ask us to access, correct or delete personal data, or to stop processing it, by writing to hello@ponderoo.app. Most data is only on your device, and you can delete it yourself (see Delete your data). If you are in the EU, the UK or another region with data-protection law, you also have the right to complain to your data-protection authority (for example Datatilsynet in Denmark or the AEPD in Spain). Our legal bases are your consent (for the AI tutor and voice) and the performance of our contract with you (for subscriptions).
International transfers
Our providers may process data in the United States and other countries. Where EU/UK law applies, transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses.
Security
All traffic is encrypted (HTTPS). Secrets such as the AI service key live only on the server. Access to stored reports is limited to us. We keep a written security program and review it at least once a year.
Changes
If we change this policy in a way that affects children's data, we will ask a parent for new consent before the change applies. The date at the top shows the latest version.