⚠ DRAFT — pre-legal-review. Drafted 2026-05-26 by Claude as a structural starting point per
docs/decisions/account_deletion_build_2026-05-26.mdfollow-up. A US/EU privacy attorney should review before this is hosted publicly. Replace every⬜ BRACKETED_PLACEHOLDERwith the actual value before publishing.
Effective date: ⬜ EFFECTIVE_DATE
Last updated: ⬜ LAST_UPDATED_DATE
This summary is informational. The full policy follows.
This Privacy Policy describes how ⬜ OPERATOR_LEGAL_NAME (“we,” “us,” “our”) collects, uses, and shares information through the Their First Words mobile application (the “App”), available on the Apple App Store and Google Play under the bundle identifier com.ggaggoong.theirfirstwords.
Contact:
⬜ PRIVACY_EMAIL⬜ OPERATOR_POSTAL_ADDRESSWe are the data controller for purposes of GDPR. For users in the United Kingdom, we act as data controller under UK GDPR.
This policy applies to information collected through the App itself. It does not apply to the App Store listing pages (governed by Apple’s and Google’s policies), or to any third-party website you may navigate to from the App.
When the parent creates an account, we collect:
| Data | Source | Why we collect it |
|---|---|---|
| Email address | You type it during signup | Account identification; password reset; optional weekly digest email |
| Password | You type it during signup | Account authentication. Stored by Firebase Authentication as a hashed value; we never see the plaintext. |
| Firebase User ID (UID) | Generated by Firebase on signup | Internal identifier for your account |
When the parent adds a child profile, we collect:
| Data | Source | Why we collect it |
|---|---|---|
| Child’s first name | You type it | Personalized greeting; display in Progress; weekly digest copy |
| Child’s birthday | You select it | Calculates the child’s age bucket (0–12 months, 12–24 months, 2–3 years, 3–5 years) so content is age-appropriate |
| Child’s gender | You select it (Boy / Girl) | Defaults the character avatar gender and voice gender |
| Selected character (avatar) | You select it from a catalog | Display in the app’s top bar and flashcard screens |
| Accessory selection (optional) | You select it from a catalog | Display on the character avatar |
| Content language preference | You select it (English / Spanish / Korean) | Selects the language of flashcard text and audio |
We do not collect: the child’s last name, the child’s email, the child’s photo, the child’s voice recordings, the child’s precise location, or any biometric data.
As the parent and child use the App together, we generate and store:
| Data | What it is |
|---|---|
| Word progress | For each word, per language: whether it has been seen, learned, or in-progress |
| Favorites | Words the parent has marked as favorites |
| Session events | Timestamps of completed practice sessions; the source category (Today’s Words, Categories, etc.) |
| Milestone events | When the child crosses 10/25/50/100/etc. learned-words thresholds |
This data is tied to the parent’s account and the relevant child profile. It is used to display the Progress screen, populate Today’s Words selection, drive the optional weekly digest, and fire optional in-app milestone notifications.
When the parent purchases an in-app subscription, Apple or Google handles the payment. RevenueCat (our subscription-management service) tracks the subscription’s active/canceled/expired state keyed to your Firebase UID.
We never see your credit card number, expiration date, CVV, or any other payment information. Those are handled entirely by Apple or Google.
| Data | Source | Purpose |
|---|---|---|
| Firebase installation ID | Firebase SDK | Crash diagnostics; first-party analytics |
| Device language | Device | Future localization fallback (currently unused at launch) |
| Time zone | Device (Intl.DateTimeFormat) |
Scheduling weekly digest email at 8am local; milestone push at 9am local |
| App version | App | Diagnostics |
| First-party analytics events | Firebase Analytics in restricted mode | App usage analysis (see §4.3) |
If the parent grants push-notification permission, the OS issues an opaque token (Expo / APNs / FCM) that we store. We use it to send optional milestone notifications and streak reminders. It is not a tracking identifier and is not shared with any third party.
To create and maintain your account, store and display child profiles, track learning progress, present Today’s Words and Categories, manage favorites, and run flashcard sessions.
To verify whether your account has an active subscription (so paid content is available), via RevenueCat.
We use Firebase Analytics in “restricted” configuration:
google_analytics_adid_collection_enabled: false — advertising ID collection is disabledgoogle_analytics_default_allow_ad_storage: falsegoogle_analytics_default_allow_ad_user_data: falsegoogle_analytics_default_allow_ad_personalization_signals: falseWe track in-app events such as session_started, session_completed, paywall_viewed, purchase_started, and purchase_completed to understand how the App is used in aggregate. The Firebase User ID we set is the same UID that identifies your account — which means you can delete it via in-app account deletion (see §8).
We do not track: child_name, child_birthday, child_age, or any other child-identifying property as an Analytics user property or event parameter.
⬜ EMAIL_PROVIDER].To comply with legal obligations, respond to lawful requests from public authorities, and detect, prevent, or address fraud or abuse.
We do not sell your data. We do not share it with advertising networks. We do share information with the following service providers (“processors”), who act on our behalf under contractual privacy obligations:
| Processor | What they receive | Purpose | Contractual basis |
|---|---|---|---|
| Google (Firebase) | All account data, child profile data, learning data, first-party analytics events, push tokens | Authentication; database; analytics; push delivery infrastructure | Firebase Data Processing and Security Terms |
| RevenueCat | Parent’s Firebase UID; subscription state from Apple/Google IAP | In-app subscription management | RevenueCat DPA |
| Apple / Google (IAP) | Payment information you provide directly to them; transaction state shared back to RevenueCat | In-app purchase processing | Apple Privacy Policy / Google Play Terms |
⬜ EMAIL_PROVIDER (weekly digest only) |
Your email address; digest content (child’s first name + counts) | Sending the optional weekly digest email | ⬜ EMAIL_PROVIDER_DPA_URL |
Each processor is bound by contract to use the data only to provide the specific service we engage them for, not for their own purposes, and not to combine it with data from other sources for profiling.
We do not engage advertising networks, attribution SDKs (Branch, Adjust, AppsFlyer, etc.), third-party analytics services (Mixpanel, Amplitude, PostHog, etc.), session replay tools (FullStory, LogRocket), or any other data-broker-adjacent service.
Their First Words is parent-led: the App is intended for parents to use with their child. The child does not create an account, sign in, type, or make any choices that send data to us — every piece of information about the child is entered by the parent.
We design and operate as if the Children’s Online Privacy Protection Act (COPPA), the GDPR’s protections for children (Article 8 / GDPR-K), and the UK Children’s Code (Age Appropriate Design Code) all apply, because the data we hold is about an identifiable child.
Verifiable Parental Consent (VPC). The parent creates an account using their own email address and receives a verification email. The parent’s authenticated account is the consent transaction; child profiles are created under that account. This corresponds to the FTC’s “email plus” VPC method.
No third-party disclosures of child data. As noted in §5, every processor that handles child-related data is bound by a data processing agreement to act only on our behalf. We disclose no child data to third parties for their own use. We therefore do not need to obtain a separate, more rigorous VPC tier (credit card / video / ID upload).
Retention. See §7.
Parental rights. Parents may, at any time:
⬜ PRIVACY_EMAIL)Legal basis. Processing of parent account data is under contract (GDPR Article 6(1)(b)). Processing of child profile data is under the parent’s verified parental consent (Article 6(1)(a) and Article 8 for the child’s data) given via account creation. Optional analytics and digest email are processed under the parent’s separate, granular consent settings managed in-App.
Child’s age threshold. We treat every account as if the most restrictive EU member-state threshold (age 16) applied. Because the parent is always the account holder and always provides consent on the child’s behalf, the per-country variance does not change our flow.
UK Children’s Code. We have completed a Data Protection Impact Assessment (DPIA) covering all 15 standards; the DPIA is available on request to ⬜ PRIVACY_EMAIL. Notable defaults:
Data Protection Officer. We have not appointed a Data Protection Officer because we do not meet the GDPR Article 37 thresholds (no large-scale systematic monitoring; no large-scale special-category data). Privacy inquiries are handled by ⬜ PRIVACY_CONTACT_PERSON at ⬜ PRIVACY_EMAIL.
| Category | Retention |
|---|---|
| Active accounts (signed in within the last 24 months OR active subscription) | For as long as the account is active. |
| Inactive accounts (no sign-in for 24 months and no active subscription) | 30-day warning email, then automated deletion of all child profile data (name, birthday, gender, progress, favorites). The parent’s Firebase Auth record remains so the parent can sign back in to a fresh slate. (Automated deletion process ships post-launch; will begin running from 2028 once the first 24-month windows begin to mature. Until then, no account meets the criterion.) |
| Parent-initiated deletion | Immediate, irreversible. See §8. |
| First-party analytics events | Up to 14 months at the Firebase Analytics retention limit (the most privacy-protective non-default setting), then automatically purged. |
| Server-side logs (Cloud Function execution logs) | 30 days, then automatically purged by Google Cloud Logging defaults. |
We do not maintain backups of deleted user data beyond the standard transient cloud-platform replication window (typically a few days), after which the deletion is fully propagated.
Inside the App: Account → Delete account. A confirmation modal will ask you to type “DELETE” to proceed. After re-authentication, the App will:
users/{your UID}) and all child profiles, progress, and milestone events from our databaseThis deletion is immediate, irreversible, and complete. There is no soft-delete, no grace period, and no undelete option.
You may also exercise the following rights by emailing ⬜ PRIVACY_EMAIL:
We will respond within 30 days. If we need to extend that window for complex requests, we will tell you why.
If you are in the EU/UK and believe we have mishandled your data, you may complain to your national data protection authority. The UK’s authority is the Information Commissioner’s Office (https://ico.org.uk). A list of EU authorities is at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
In-app subscriptions are processed by Apple (App Store) or Google (Play Store), not by us. We never receive your payment card information.
To cancel a subscription, you must do so via your device’s subscription settings — Settings → Apple ID → Subscriptions on iOS, or Play Store → Profile icon → Payments & subscriptions → Subscriptions on Android. The App cannot cancel an active subscription on your behalf.
Deleting your account does not automatically cancel an active subscription. You must cancel separately via Apple or Google.
Our data is processed on Google Cloud / Firebase infrastructure, which may operate in multiple regions. Where data is transferred outside your country (notably from the EU/UK to the United States, where Google’s primary infrastructure is located), the transfer is governed by:
You may request a copy of the relevant safeguards by emailing ⬜ PRIVACY_EMAIL.
We implement industry-standard security practices, including:
No system is perfectly secure. If we ever become aware of a security incident that compromises your data, we will notify you and any required regulator within the timeframes prescribed by applicable law (72 hours for GDPR; without unreasonable delay for COPPA / state laws).
We may update this policy from time to time. When we do, we will:
⬜ CHANGE_LOG_URL for transparency.Continued use of the App after a non-material change indicates acceptance of the updated policy. For material changes, we will obtain renewed parental consent where required.
If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your data:
⬜ PRIVACY_EMAIL⬜ OPERATOR_POSTAL_ADDRESSFor users in the EU/UK, you may also lodge a complaint with your national supervisory authority as described in §8.3.