Syllaboo Privacy Policy

1. Introduction

Syllaboo ("we," "us," or "our") is a reading companion app for children ages 5 to 10, published under the Apple App Store Kids Category. This Privacy Policy explains how we collect, use, and protect information when you and your child use Syllaboo.

By creating an account, you agree to this Privacy Policy. If you do not agree, please do not use Syllaboo.

Syllaboo is operated by Syllaboo Inc., based in California, United States. If you have any questions, contact us at privacy@syllaboo.app.

2. Children's Privacy (COPPA Compliance)

Syllaboo is designed from the ground up to comply with the Children's Online Privacy Protection Act (COPPA) and Apple's Kids Category requirements.

How our app works

• Only parents or legal guardians can create accounts. Children never have login credentials.
• Before any data is collected, the parent must provide verifiable parental consent through our in-app consent screen.
• Children access the app by tapping their profile avatar — no password or authentication is required.

What we never collect from children

• Email addresses
• Dates of birth or age
• Physical addresses or location data
• Photos, videos, or camera access
• Contact lists or phone numbers
• Device identifiers (IDFA, fingerprinting)
• Browsing or search history

3. Information We Collect

A. Parent account information

When you create an account, we collect:

• Email address — for account access, password resets, and weekly progress reports
• Authentication data — managed securely by our authentication provider (Clerk). If you use Sign in with Apple, Apple shares your name (if you allow) and your email address (which may be Apple's private relay address). We receive a unique identifier from Apple to link your account — we never receive your Apple ID password
• Consent timestamp — a record of when you accepted this policy

B. Child profile information

When you create a child profile, we collect:

• First name — displayed in the app and in your progress reports
• Avatar selection — which companion character and preset avatar the child chose
• Reading level — determined through an optional assessment

No other personal information is collected about your child.

C. Reading session data

During reading sessions, we collect:

• Accuracy data — which words were read correctly and which were mispronounced
• Session duration — how long the child read
• Words read — total count and per-word results
• Story selection — which stories your child has read
• Progress metrics — XP, level, mastery progress, and world unlock status

D. Voice audio and pronunciation analysis

To help your child improve, we use Azure's Pronunciation Assessment feature, which scores how clearly each word was spoken against the story text. Specifically, the service returns:

• Per-word accuracy — a 0-100 score for each word the child reads
• Phoneme-level pronunciation — which individual sounds were said correctly (used to suggest practice words)
• Fluency, prosody, and completeness — overall reading rhythm signals used in the parent dashboard

To support this scoring, we send Azure the story's reference text alongside the audio so the service knows what words to expect. Before sending, our server removes your child's first name from the reference text and from any keyword hints, so your child's name never appears in the text payload that leaves our infrastructure. The audio still passes through Azure (this is required for any speech recognition to work) and is processed under Microsoft's signed Data Processing Agreement, with audio logging disabled — meaning Microsoft does not retain the audio after processing and does not use it to train models.

E. Subscription information

If you subscribe to Syllaboo Premium, purchase transactions are handled entirely by Apple through In-App Purchases. We receive a subscription status (active/inactive) and expiration date from our payment processor (RevenueCat). We never see or store your payment card details.

F. Information we do not collect

4. How We Use Your Information

We do not use any collected data for advertising, marketing to children, or sale to third parties.

5. Third-Party Services

We use a limited number of trusted third-party services to operate Syllaboo. Each is chosen for its privacy practices and necessity to the app's functionality.

Data processing agreements

We require data processing agreements (DPAs) with our third-party service providers. These agreements include provisions that contractually require providers to:

• Process your data only for the purposes described above and only on our instructions
• Implement appropriate technical and organizational security measures
• Not sub-process data without our prior written consent
• Delete or return all personal data upon termination of the agreement
• Assist with data subject access requests and breach notifications

DPA status for each provider (reviewed quarterly):

We do not use any advertising networks, behavioral analytics platforms, or social media SDKs. Specifically, we do not use Firebase, Google Analytics, Mixpanel, Amplitude, Facebook SDK, or any similar service.

6. Data Storage and Security

Where data is stored

We have configured all services to process and store data in the United States. Below is how each service handles data residency:

• On your device: App settings, cached stories for offline reading
• Database (Supabase): Reading progress, session history, child profiles, and parent account data — our Supabase project is provisioned in the AWS US East (Virginia) region
• Authentication (Clerk): Parent login credentials and session tokens — Clerk's primary infrastructure uses Google Cloud Platform in the United States, though Clerk or its subprocessors may process data in other regions as described in their DPA
• Speech-to-text and Pronunciation Assessment (Microsoft Azure Speech Services): Streaming audio and the story's reference text (with the child's first name removed) are processed in real time on servers in our configured Azure region. Audio data is retained only for the duration necessary to process each request and is not stored for model improvement
• Subscription management (RevenueCat): Anonymous subscription status — hosted on AWS in the United States
• Never stored anywhere: Audio recordings — streamed in real time, then discarded

Security measures

• All data transmitted between the app and our servers is encrypted using TLS (HTTPS/WSS)
• Database access is protected by role-based access controls — parents can only see their own children's data
• Authentication tokens are securely managed and expire automatically
• We conduct regular security reviews of our infrastructure

Data retention

You control how long we keep your child's reading history. In the Parent Hub settings, you can choose a retention period of 30 days, 90 days, 1 year, or indefinite. Data older than your chosen retention period is automatically deleted.

If you delete your account, all associated data (parent account, child profiles, reading history) is permanently deleted within 30 days.

7. Microphone Usage

Syllaboo requires microphone access to listen to your child read aloud. Here is exactly how we handle it:

• The microphone is only active during a reading session — never in the background or on any other screen
• Audio is streamed in real time to our speech-to-text service and immediately discarded after processing
• No audio files are created, saved, or uploaded at any point
• When a reading session ends, the microphone is immediately deactivated and the audio session is released
• If microphone permission is denied, the app will explain what it's needed for and direct you to device Settings — it will never record without your explicit permission

8. Push Notifications

Syllaboo may send push notifications to the parent's device only to share milestones and progress updates. Examples:

• "Emma just finished her 10th story!"
• "Tyler improved his reading accuracy by 14% this week."

We never send push notifications to encourage or pressure children to return to the app. We never send guilt-inducing messages such as "You haven't read in 3 days!" Notifications can be disabled at any time in the app settings or your device settings.

9. Advertising and Tracking

Syllaboo does not display advertisements of any kind — no banner ads, interstitial ads, rewarded video ads, or native ads. This is a hard requirement of the Apple Kids Category and a core principle of our app.

We do not use any third-party analytics or tracking tools on child-facing screens. We do not collect, share, or sell advertising identifiers (IDFA), device fingerprints, or behavioral data for advertising purposes.

We do not sell, rent, or share your personal information or your child's data with any third party for marketing or advertising purposes.

10. Parental Controls and Rights

As a parent or legal guardian, you have full control over your family's data:

Review data

View all of your child's reading history, session data, and profile information in the Parent Hub.

Export data

Download all data associated with your account and your children's profiles from the Parent Hub settings.

Delete data

Delete individual children's reading session data, or delete your entire account and all associated data, from the Parent Hub settings. Deletion is permanent and cannot be undone.

Revoke consent

You may revoke your consent at any time by deleting your account or contacting us at privacy@syllaboo.app. Upon revocation, we will delete all data associated with your account within 30 days.

Control notifications

Manage or disable push notifications at any time through the app settings.

Manage data retention

Choose how long reading history is kept (30 days, 90 days, 1 year, or indefinitely) in the Parent Hub settings.

11. Subscriptions and Purchases

Syllaboo offers a free tier and an optional Premium subscription. All purchases are handled through Apple In-App Purchases.

• We never display pricing or purchase prompts to children
• All purchase screens require passing a parental gate (a math problem a young child cannot solve)
• We never use manipulative or urgent language to encourage purchases
• Payment details are handled entirely by Apple — we never see or store your credit card information
• Subscription status is managed through RevenueCat, which receives only an anonymous transaction record from Apple

12. External Links

Syllaboo contains minimal links to external websites (such as this privacy policy, our terms of service, and support contact). All external links are located behind a parental gate — a child cannot tap a link that leaves the app without an adult solving a verification challenge first.

We are not responsible for the privacy practices of external websites. We encourage you to review the privacy policies of any third-party sites you visit.

13. When We May Share Information

We do not sell or rent personal information. We may share limited data only in these circumstances:

• Service providers: With the third-party services listed in Section 5, solely to operate the app as described
• Legal requirements: If required by law, subpoena, or court order
• Safety: If we believe disclosure is necessary to protect the safety of a child, parent, or the public
• Business transfer: In the event of a merger, acquisition, or sale of assets, your data would be transferred to the new entity, who would be bound by this privacy policy

We will never share data with advertisers, data brokers, or any party for marketing purposes.

14. Data Breach Notification

In the unlikely event of a data breach that affects your personal information or your child's data, we will:

• Notify affected users by email within 72 hours of discovering the breach
• Clearly describe what data was affected and what steps we are taking to address it
• Report the breach to relevant authorities as required by applicable law, including the California Attorney General if more than 500 California residents are affected
• Provide guidance on any steps you should take to protect your account

We maintain security monitoring and incident response procedures to detect and respond to potential breaches as quickly as possible.

15. Your California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you additional rights regarding your personal information:

• Right to know: You may request a detailed list of the personal information we have collected about you and your children in the past 12 months, including the categories of data, the sources, and the purposes for collection
• Right to delete: You may request deletion of your personal information. You can do this directly in the Parent Hub settings or by contacting us
• Right to opt out of sale: We do not sell personal information to third parties. We never have, and we never will. No opt-out is necessary because no sale occurs
• Right to non-discrimination: We will not deny you services, charge different prices, or provide a different quality of service because you exercised your CCPA rights

To exercise any of these rights, contact us at privacy@syllaboo.app. We will verify your identity before processing your request and respond within 45 days as required by law.

16. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and/or through a prominent notice in the app before the changes take effect.

We will never reduce your rights or your child's protections without obtaining fresh consent. The "Effective" date at the top of this page indicates the most recent revision.

17. Contact Us

If you have questions about this Privacy Policy, your data, or your child's privacy, please contact us:

• Privacy inquiries: privacy@syllaboo.app
• General support: support@syllaboo.app
• Mail: Syllaboo Inc., 548 Market St #83765, San Francisco, CA 94104

We aim to respond to all privacy-related inquiries within 48 hours.