1. Who we are and scope
LEARN WITH SARAH LTD operates My English Sarah Kids, an English-learning service designed for children approximately 4–12. This policy covers the Kids app, the Parent Area, the public website, and related support services.
Privacy questions and rights requests can be sent to support@myenglishsarah.com or through the Contact page.
2. Parent Account and Child Profiles
The account owner is a parent or legal guardian. A child does not have an independent sign-in account; the child uses a Child Profile under the Parent Account. The parent should provide accurate information, supervise use, and manage consent and data requests.
3. Data we collect
The data involved depends on the features the parent and child use. We do not ask a child to provide an email address, phone number, or payment details.
- Parent Account data: name, email, hashed password, optional phone number for web sign-up, optional Google or Apple sign-in identifiers, hashed parent PIN, notification preferences, and account status.
- Optional Parent profile image: a parent may upload a profile photo, and when signing in with Google we may store a copy of their Google account picture. The image is stored securely against the Parent Account and used only in signed-in account interfaces; it is not a public profile. It can be removed at any time to return to generated initials. Apple does not provide a profile picture.
- Child Profile data: name, date of birth or age derived from it, gender, learning-friend/avatar choices, hashed profile PIN when enabled, and profile creation date.
- Learning data: missions, activities, answers, attempts, progress, stars, XP, virtual currencies, rewards, achievements, streaks, learning sessions, world state, and learning-village state.
- Technical and security data: IP address, IP-derived country, platform, app version, a random installation identifier, hashed or encrypted session tokens, device model and operating system, crash reports, and limited operational and security logs.
- Support data: name, email, subject, message content, and selected language when the contact form is used.
4. Microphone and pronunciation data
Pronunciation exercises first require a parent’s authorization in the Parent Area, and our backend refuses any recording until that authorization is recorded. Device microphone permission is then required, and recording begins only after a clear action in a pronunciation exercise. The app records a short clip to a temporary device file, then sends it through the My English Sarah Kids backend to SpeechAce with the exercise text and question reference. We do not send the child’s name or email to SpeechAce.
The recording is processed temporarily on our servers to prepare it for pronunciation assessment, including temporary audio files used during normalization. These temporary files are deleted after processing, and we do not retain the raw recording as part of the Child Profile or learning record. The app also deletes its own temporary recording from the device after the attempt; we retain educational scoring results such as score, pass outcome, words or sounds needing practice, audio-quality indication, and attempt time. SpeechAce may retain submitted audio under its service configuration and agreement; a parent can ask us to coordinate provider-held deletion through Manage or Delete My Data or support.
5. Subscriptions and payments
Purchases made inside the iOS app are processed through the Apple App Store, and purchases made inside the Android app are processed through Google Play. Transactions completed independently through our web services may be processed by third-party payment providers such as Stripe or Flouci, or by other locally available payment methods. The relevant processor receives the payment information required to complete the transaction; My English Sarah Kids does not store full card numbers in its own systems.
We may retain transaction and invoice records, sealed or hashed provider identifiers, subscription status, amounts, and refunds where needed for service delivery, accounting, fraud prevention, and legal compliance. Where a bank transfer is used, a parent may upload proof of payment to private cloud storage used for verification.
6. Why we use data
We use data to operate the Parent Account and Child Profiles; deliver lessons, games, progress, and reports; score pronunciation; secure sessions; send parent-enabled notifications; process payments; answer support; diagnose failures; and improve content and service reliability.
7. Service providers and sharing
We do not sell parent or child data or share it for behavioural advertising. We disclose the minimum needed to providers performing a specific function for us, or when required by law or to protect the service.
- SpeechAce: pronunciation clip, exercise text, and question reference for scoring.
- Google and Apple: optional parent sign-in, and Apple App Store or Google Play for in-app purchases.
- Firebase Cloud Messaging: device token and limited routing data for parent-enabled notifications.
- Stripe, Flouci, and banks: transaction and payment data needed for the parent’s chosen method.
- MailerSend: email address and the content of the messages needed for delivery: account and security messages (such as email verification and password or PIN reset), support, billing and subscription messages, and parent-facing learning updates (such as weekly progress summaries, milestones, and reminders).
- Bunny Stream (bunny.net): hosting and delivery of video lessons; it receives the video identifier and the technical connection data needed to play the clip, such as IP address and browser type.
- Google Cloud Storage: private storage for bank-transfer receipts uploaded by the parent and for parent profile photos, and hosting of public lesson media (images and audio) that the app loads directly from it; those public files are course content and contain no child or account identifier.
- MaxMind: IP address to estimate country and route currency and payment options; we do not request precise-location permission.
8. Children’s Privacy & Parental Rights
The service is designed so that a parent handles account creation, consent, and management. The child experience has no open chat, user-to-user messaging, social profiles, or public posting. We do not use ad networks, advertising identifiers, or personalised advertising.
A parent can review data in the Parent Area, edit supported Child Profile details, delete a Child Profile, request correction, access, or deletion of other data, or delete the entire Parent Account. We may require sign-in or further verification to protect the family and prevent deletion of another person’s data.
10. Retention and deletion
We keep account and child data while the account exists or as needed to provide the service. Deleting a Child Profile removes that profile and its associated progress, attempts, and activity from our active systems. Deleting the Parent Account removes personal data, Child Profiles, sessions, tokens, notifications, analytics, and linked crash reports from our systems.
If transactions or invoices exist, their records are retained for accounting and regulatory obligations, but identifying account fields are replaced with unusable tombstone values and sign-in is disabled. Non-identifying monthly aggregate statistics may remain. Data held by payment providers or SpeechAce is also subject to their retention rules and legal duties; we coordinate deletion requests where applicable.
11. Security and international processing
We use encrypted transport, hashed passwords and PINs, secure session tokens, ownership checks, access controls, and data minimisation. No transmission or storage method can guarantee absolute security. Providers may process data in countries other than the family’s country under their contracts and applicable legal safeguards.
12. Your choices and rights
Depending on applicable law, you may have rights to access, correct, delete, object, restrict processing, obtain portability, or withdraw consent. Use the Parent Area for available self-service controls, the Delete Account and Manage or Delete My Data pages, or contact us. Withdrawing consent does not affect processing already lawfully completed.
13. Changes and contact
We will update the date on this page when we make a material change and may notify the parent in the service or by email where appropriate. For questions or privacy requests, use the Contact page or email support@myenglishsarah.com.
Contact us: support@myenglishsarah.com