Privacy Policy

Foxy Junior is an adventure game that teaches English speaking to children aged 6–8. It is designed for kids, so children's privacy is a hard design constraint, not an option.

What we never do

• We never retain children's voice recordings. When a child practices speaking, audio is sent to a pronunciation-scoring service (Microsoft Azure Speech) for real-time assessment and is not retained anywhere. On our servers it is never written to disk. On the device it exists only momentarily, as a single temporary file — deleted as soon as the score comes back, and deleted just the same if the attempt is interrupted.
• We never store what a child said. The text recognized from a child's speech exists only on the device to show feedback and is never sent to our servers. Servers receive numeric scores and a status per word the child practised (practising / said, with the day) only.
• We collect no personal information from children: no real names (the first name typed at the start stays on the device), no photos, no email, no location, no contacts. An email address exists only when a parent signs in themselves (see Parent account).
• No ads, no ad tracking, no sale of data.
• No outbound links in the child area; external links and settings sit behind a parental gate.

Data we process

Data	Purpose	Where
Game progress: finished missions, coins earned and spent, XP, stars, owned items, quest counters; the avatar the child picked (a number 1–4, with when it was picked); the highest level reached; and the words the child has practised or said — per word only the word id, its status (practising / said), the day, and a flag for whether Azure scored that attempt. No audio, no recognised text, no score	Save learning progress and show it on another device	On device; synced to our server under a random device id (or to the account if a parent signs in)
Parent account (only when an adult signs in with Apple or Google): account identifier (user id), email if you choose to share it, and the sign-in provider (Apple or Google)	Sign-in and syncing progress between devices	Supabase (Auth) and our server; nothing about the child
Pronunciation scores: the score numbers, how long the attempt took, a pass flag, and the lesson step id with its target sentence (our own content) — never audio or what the child said	Monitor scoring quality	Server; kept until a deletion request (there is currently no separate automatic expiry for score rows)
Anonymous learning events (e.g. "mission completed")	Improve the app	Server, keyed to a random device id; kept until a deletion request (email with the device id, or deleting the account for account-linked progress)
Random device identifier	Distinguish devices; on its own it does not say who the child is, but it is linked to the account when a parent signs in	Device + server
App version and interface language	Pick the right in-app message (e.g. "a new island is here") to show	Sent with the request to our server, not stored
Anonymous usage events (the same kind as the learning events above)	Aggregate statistics to improve the app	PostHog (EU servers), keyed to the random device id; each event also carries the app version, the operating system (iOS or Android) and a random session code that changes after 30 minutes of inactivity and is linked to nothing else; no IP stored, no geolocation, no user profiles
Technical error reports from the app's own code (what went wrong, the mission and step being played, app version, device model, OS version) and sampled performance data	Find and fix bugs, watch smoothness	Sentry; no IP, no screenshots, no screen recording, no user identifier, no usage sessions, no name or anything the child said

The device id is randomly generated by the app and holds no information about the child or family. When a parent signs in, that device's progress, scores and usage events are linked to the parent's account (see Parent account).

Permissions

• Microphone: used only while the child holds the talk button to practice pronunciation. Audio is scored in real time and not kept once scoring is done.
• Notifications: requested only if a parent turns on the daily study reminder in the parent area (off by default). The reminder is scheduled on the device; there is no server push service, and the reminder's time and text never leave the device. The app records only that the reminder was switched on or opened, as an anonymous learning event listed above.

Processors acting on our behalf

• Microsoft Azure Speech — receives the audio of an attempt for real-time pronunciation assessment (audio not retained).
• Supabase (database) and Railway (our server) — hosting only the data listed above. The server sees the connection's IP address to rate-limit requests (in memory only, not stored with progress, scores or events); the hosting platform's connection logs may record IPs.
• Supabase Auth — only when a parent signs in: stores the email and the account identifier.
• Sentry — technical error reporting for the app and the server. Reports carry no IP address, no screenshots and no user identifier; server reports are stripped of all request content before sending.
• PostHog (EU servers) — aggregate usage statistics. It receives only the anonymous events listed in the table above, keyed to the random device id; never a name, the child's voice or what the child said. No IP is stored, no geolocation is done, no user profiles are created, and nothing is used for advertising.
• Cloudflare Turnstile — website ONLY, for the "I'm not a robot" check on the early-signup field. It is not present in the app and processes no children's data.

Parent account (optional)

Children play without an account and are never asked to sign in. Inside the parent area (behind the PIN) an adult may create an account with Sign in with Apple or Google to keep progress across devices.

• We receive an account identifier (user id) and an email address from Apple/Google (if you choose to share it; Apple lets you hide it). Supabase Auth stores these on our behalf, along with the provider you signed in with. Nothing about the child is collected.
• When you sign in, the device's game progress (including the avatar, level and said words listed in the table above), plus the scores and usage events the device already has, are linked to the account so progress can sync between devices.
• Account details are used only for sign-in and sync — never for advertising, never sold, never shared.
• Delete the account inside the app: parent area → Parent account → Delete account. This permanently deletes the account, its email (the Supabase user) and the progress attached to the account on our server. The device record, the score rows and the usage events are kept, no longer linked to the account. The app keeps playing as a guest, and the device's own progress keeps syncing under the device id. You may also request deletion by email at the address above.
• To remove everything: in the parent area copy the Device id and email it to us so we delete that device's data on the server; after you have sent the request, tap "Delete data & start over" on the device to erase the on-device data and sign out.

Website early signup (not part of the app)

Our marketing website has a field where an adult — a parent or guardian, or someone running an English centre — can leave contact details to hear when the app launches. This field is not in the app; the app never asks for, reads, or sends an email address or a phone number.

• We store an email address and/or a phone number — whichever you choose to leave — along with whether you selected "parent" or "centre", the page language you used, and when you signed up. There is no name field, and no field that asks anything about a child.
• As a parent you need leave only ONE of the two, an email or a phone number; neither is required on its own. As a centre we need an email to hold a partnership conversation; a phone number is still optional.
• The field is for adults. We do not knowingly collect email addresses or phone numbers from children; if you believe your child submitted any, write to the contact address at the top of this page and we will delete it.
• We use these details only to contact you about the app — launch news for parents, and a partnership conversation for centres. We do not sell them, do not share them with third parties, and do not use them for targeted advertising.
• Details are stored on our own servers (Supabase / Railway) and kept until you ask us to remove them.
• The field carries an "I'm not a robot" check run by Cloudflare Turnstile to block automated signups. That check processes your IP address and technical signals from the browser you are using; we chose Turnstile because it uses no tracking cookies and belongs to no advertising network.
• Opt out at any time: one line to the contact address above and we delete your details from the list.

Parents' rights

Parents may request access to, or deletion of, all data associated with their child's device by emailing the contact address above with the Device id (Settings → parent area → Device id, with a copy button), or by emailing from the parent account itself. "Delete data & start over" issues a new device id, so send the request BEFORE you tap it. Deleting the app also deletes all on-device data.

The mailing-list address above is not linked to a child's game data: we deliberately store no connection between the two.