LearnLox Privacy Policy

What we collect

• Adult account email, a securely hashed password, consent date, and basic sign-in security records.
• An adult email and optional language interest when an adult joins the invitation waitlist.
• Bug reports and improvement suggestions submitted through the feedback form, including the selected LearnLox area, device category, connection status, and an adult email only when a reply is requested.
• Child profiles created by a parent: first name, age, in-app avatar choices and unlocks, and a private profile identifier. LearnLox does not ask children to upload a photo.
• Learning records: completed lessons, phrase mastery level, attempts, points, rewards, game unlocks, play settings, family challenges, and optional feedback.
• Limited technical information needed for security and reliability, such as approximate sign-in time, request identifiers, error events, and IP-based rate-limit records.
• Aggregate homepage view totals. LearnLox does not retain an IP address, device identifier, browsing history, or advertising profile with these view counts.

Voice and microphone privacy

A short voice attempt may be sent to OpenAI for momentary speech processing and pronunciation feedback. LearnLox does not save raw microphone audio or full speech transcripts in its application database. It saves only the approved phrase identifier, result category, attempt count, duration, and limited reliability information. Parents can use lessons without a voice score when microphone access is unavailable.

Public hello demo for adults

The homepage offers an optional adult-only greeting demo without an account. After you confirm you are an adult and choose Say hello, the microphone records up to five seconds and sends that recording to OpenAI to recognize a fixed greeting. LearnLox does not store the demo recording, transcript, or result in its database, and does not add them to family learning records. Only the fixed, AI-generated example greetings are cached for replay. Temporary abuse-prevention counters use a daily rotating, keyed hash of the network address and expire within two days. Hosting and AI providers may retain security or processing records under their own policies. This demo is for adults to try, not a way for children to bypass parent-managed access.

How information is used

Information is used only to operate private family accounts, personalize age-appropriate lessons, preserve progress, run family-only challenges, fulfill parent-managed rewards, respond to requested feedback follow-up, prevent abuse, and improve reliability. LearnLox does not sell personal information, run behavioral advertising, use tracking pixels, or create public child profiles.

Service providers

Vercel hosts the application, Upstash stores private account and progress records, and OpenAI provides approved phrase audio and momentary voice processing. These providers receive only the information needed for their service. LearnLox does not provide them child data for advertising.

Optional adult contributions

If an adult chooses to support LearnLox, Stripe collects payment and billing information on its hosted checkout. LearnLox does not store card details or send child profiles, voice recordings, learning records, or reward balances to Stripe. We store a contribution identifier, a pseudonymous account reference, amount, currency, payment status, creation time, and Stripe checkout reference for up to one year to verify payments and investigate support requests. These records remain personal information because they can be linked to an adult account. Stripe retains its payment records under its own policies and applicable requirements. See Stripe’s Privacy Policy.

Children and parent control

A parent or legal guardian must create and manage profiles for children under 18. Children do not need an email address. A parent may issue or revoke a private child access link, review saved progress, correct a first name or age, stop further use, withdraw consent, or request deletion.

Retention and deletion

Account and learning records are retained while the private beta account remains active so progress works across devices. Access codes are stored only as one-way hashes. Adult waitlist details are retained until an invitation is issued, the request is withdrawn, or the list is retired. Product feedback is retained for up to one year during the beta so reported problems can be investigated and recurring issues can be identified. The feedback form never attaches a password, child name, recording, or transcript. When a verified parent requests deletion, LearnLox will remove the family’s active account data unless limited retention is required for security, fraud prevention, or law. Temporary provider logs and backups expire under the applicable provider’s retention schedule.

Security and policy changes

LearnLox uses private sessions, parent PIN controls, server-side permissions, encrypted connections, and data minimization. No internet service can promise perfect security. Parents will be notified before a material change that requires new consent; the effective date above will also be updated.

Contact

Questions, parent requests, consent withdrawal, or deletion requests: fshafiullah@gmail.com.