Privacy Policy — Their First Words

Last updated: September 22, 2026

---

Plain-language summary

• Their First Words is a flashcard app parents use with their children to learn first words and phrases. The parent is the user; the child is the end-user.
• No ads. No advertising ID. No third-party analytics. No tracking across apps or websites. We never sell data or share it with advertisers or data brokers.
• We never ask for your camera, microphone, photos, contacts, or location. We do not collect your child’s date of birth, photo, or voice.
• The app works fully without an account. Without one, your child’s profile and progress (word and phrase progress, favorites, milestones, and practice history) stay on your device and never reach our servers. The app still sends a small amount of technical data, such as crash reports and security and version checks, so it runs reliably (§3.5).
• An account is optional. You create one by signing in with Apple or Google to save progress to the cloud and across your devices. Only then do the child profile and progress described below reach our servers.
• We use Firebase (Google) for accounts, storage, crash reporting, security, and app settings. Firebase estimates a country from the connection to deliver the right settings; it never uses GPS. Apple or Google handles your purchase directly, and we send them no child data.
• On Android, a creator’s Google Play link can tell us which creator recommended the App. We keep only that creator’s ID, and whether it led to a new purchase, so we can credit and pay creators. It never changes price, access, or the purchase.
• You can delete your account and all its cloud data inside the App at any time (Account → Delete account). Technical records expire on the short schedule in §7. Older app versions with an analytics setting are covered in §4.3.

The full policy follows.

---

1. Who we are

This Privacy Policy describes how Their First Words LLC, a California limited liability company (“we,” “us,” “our”), collects, uses, and shares information through the Their First Words mobile application (the “App”), available on the Apple App Store and Google Play.

Contact:

• Email: privacy@theirfirstwords.org
• Postal address: Their First Words LLC, 2108 N St, Ste N, Sacramento, CA 95816, United States

We are the data controller for purposes of GDPR. For users in the United Kingdom, we act as data controller under UK GDPR.

2. Scope

This policy applies to information collected through the App itself. It does not apply to the App Store listing pages (governed by Apple’s and Google’s policies), or to any third-party website you may navigate to from the App.

Version coverage: the update described by this revision removes Firebase Analytics and its privacy setting on both platforms. Older installed versions that still include that setting may continue to collect optional analytics as described in §4.3. Updating the App stops new Firebase Analytics collection from that installation; it does not erase previously collected events.

3. What we collect

Using the App without an account: sections 3.1–3.3 describe what we store for a signed-in account. Without an account, the child profile (§3.2) and learning data (§3.3) exist only on your device — none of it reaches our servers. (§3.5’s technical data and §3.4’s purchase/referral state still apply as described there.)

3.1 Account information (created only when you sign in)

Accounts are created by signing in with Apple or Google (there is no App-specific password). When you do, we collect:

3.2 Child profile information

For each child profile, we store:

We do not collect: the child’s last name, the child’s email, the child’s date of birth (we use an age range only), the child’s photo, the child’s voice recordings, the child’s precise location, or any biometric data.

3.3 Learning data (generated as you use the App)

As the parent and child use the App together, we generate and store:

This data is tied to the parent’s account and the relevant child profile. It is used to display the Progress screen, populate the Words or Phrases selection on Today, and power each library’s in-app milestone celebrations.

Child profile deletion record. Created when you delete an individual child profile. It stores only childId, requestedAt, completedAt. Prevents an offline or stale device from recreating the deleted profile or its learning data. Retention: Kept until you delete the parent account.

3.4 Purchase state and Android referral attribution (from Google Play)

Pro is a one-time purchase handled directly by Apple or Google. The App asks the store on your device whether your store account owns tfw_lifetime and uses the answer only to unlock Pro. We keep no receipts and never link your purchase to your App account. The store keeps its own transaction record under its own terms.

On Android only, when you install from a direct Google Play referral link, the App reads the first-party Play Install Referrer once for a new installation. We keep only a validated lowercase creator affiliate ID, the source (google_play_install_referrer), and capture time; the full referrer is discarded. If that installation later receives an explicit new tfw_lifetime purchase callback, we may add the product ID, observation time, and a one-way SHA-256 fingerprint of the Play purchase token. We never store the raw token, price, payment details, or a revenue/commission amount, and restored or historical purchases are not converted into new referrals.

This referral record is saved locally first. If you later use optional Apple/Google sign-in, the first signed-in Firebase UID on that installation may claim one owner-only record at users/{UID}/referrals/googlePlayInstall; a different account cannot overwrite or inherit it. We use this metadata only to credit creators for referred installs and purchases and to determine their compensation. It has no effect on Pro access.

We never see your credit card number, expiration date, CVV, or any other payment information. Those are handled entirely by Apple or Google.

3.5 Technical data (collected automatically)

Crash diagnostics: Firebase Crashlytics automatically reports crashes and selected nonfatal technical errors. Each report contains technical context and an app-scoped installation/session identifier, so we can group repeat crashes from the same installation. We never attach your account ID, your child’s name or age range, learning data, or any custom user identifier. Crash reporting works with or without an account and is always on, so we can fix problems quickly.

App configuration: the App fetches remote configuration from Firebase Remote Config (Google) to check whether your installed app version is still supported, to display a maintenance notice during planned downtime, and to turn specific features on or off. This request includes your Firebase installation ID, the app version, and basic device information (operating system, language, and time zone). Firebase automatically derives and collects a country code from request IP metadata. It does not send your account, child-profile, or learning data. Firebase Remote Config is a processor under our Firebase Data Processing Addendum.

Security: Firebase App Check processes attestation material and tokens to protect backend requests. Attestation uses Apple’s App Attest / DeviceCheck on iOS and Google’s Play Integrity on Android. Security and configuration checks run automatically from first launch, including before sign-in. The parental gate is separate: it protects purchases, account settings, and links that leave the App.

3.6 Feedback you send us (you give us this)

If you choose to send feedback through the App (Account → Send feedback), we store the message you write, together with your account’s user ID, the app version, your platform (iOS or Android), the active flashcard language, and the time you sent it. We use this to read and act on your feedback. The in-App channel does not promise a direct reply; contact support@theirfirstwords.org when you need one.

The legal basis is performance of a contract / handling the request you initiated (GDPR Article 6(1)(b)) — the same basis as your account data.

We ask you not to include your child’s name or other personal details in your message, and we never attach any child profile data to it. If personal details slip in, we remove them when we act on the feedback. Feedback is private — it is sent only to us and is never shown to other users. It is deleted when you delete your account (see §7 and §8).

3.7 What we explicitly do not collect

• Push-notification tokens — the App does not send phone (push) notifications, so it does not request push permission or store a device push token
• Advertising ID (IDFA on iOS, AAID on Android) — not collected; older Analytics-enabled versions disable advertising-ID collection
• GPS, precise location, and device Location Services — not requested. Firebase derives approximate country/region from request metadata as disclosed in §3.5; this requires no location permission.
• Contacts list — not requested
• Photos or camera roll — not requested
• Microphone — not requested
• Audio recordings of you or your child — the App plays audio TO the child; it never records
• Browsing history across other apps or websites — not collected
• Social media identifiers — not collected
• Full Google Play referrer strings and raw purchase tokens — parsed or hashed in memory, then discarded

4. How we use information

4.1 To provide the App

To create and maintain your account, store and display child profiles, track word and phrase progress, present the Today, Words, and Phrases libraries, manage favorites, and run flashcard sessions.

4.2 Purchase management and creator referrals

To ask Apple or Google on the device whether the current storefront account owns the one-time Pro unlock, so paid content is available. On Android, we also use the first-party Play Install Referrer to measure which creator referral link led to a new installation and may associate that minimized referral record with a later new-purchase callback. This helps us measure affiliate marketing and determine compensation for creators who promote the App. Referral processing is optional metadata and never affects billing or access. We do not display ads in the App or use referral records to target ads or send marketing messages to users.

4.3 Optional analytics in older app versions

The current version of the App contains no analytics. Earlier versions offered an optional analytics setting that was off unless a parent turned it on. This section applies only to those earlier versions and to events collected before the update.

When a parent turned it on, Firebase Analytics ran in a restricted, ad-free configuration: advertising-ID collection, ad storage, ad user data, and ad personalization were all disabled; Google Signals was off; and no audiences were exported to Google Ads or any advertising platform.

It recorded in-app events such as session_started and session_completed (with the content language and playback settings), word_learned, phrase_said_it, word_favorited (with the catalog content ID), category_opened, paywall_viewed, language_changed, audio_failed, and purchase events, to understand how the App is used in aggregate. Firebase assigned an app-instance identifier and estimated an approximate country from the connection; Google Analytics discards the IP address before logging.

Analytics never received your account ID, your child’s name, age range, avatar, or profile identifier, GPS location, or any child-added, switched, or deleted events. We do not collect a date of birth in any version. Turning the setting off stopped collection, and sign-out or account deletion reset the device’s analytics identifier. It was used only to improve the App, never for advertising, and never shared with anyone for their own purposes.

4.4 Communications

• We send no marketing, digest, or automated account email. Important notices appear in the App and in this hosted policy.

4.5 Legal compliance and safety

To comply with legal obligations, respond to lawful requests from public authorities, and detect, prevent, or address fraud or abuse.

4.6 App configuration and version support

We use Firebase Remote Config to check whether your installed app version is still supported (and prompt you to update if it is not), show a maintenance message during planned downtime, and enable or disable specific features. This relies only on your app version, installation identifier, basic device information, and approximate country derived from request metadata; it does not read or transmit any account, child-profile, or learning data.

5. Who we share information with

We do not sell your data. We do not share it with advertising networks. Firebase acts as our contracted processor; Apple or Google acts as the storefront for a purchase you choose to make:

Firebase processes data only on our instructions under the terms linked above; see also Firebase’s privacy documentation. Store purchases and app attestation follow the Apple or Google terms linked above.

We do not engage advertising networks, third-party attribution SDKs (Branch, Adjust, AppsFlyer, etc.), third-party analytics services (Mixpanel, Amplitude, PostHog, etc.), session replay tools (FullStory, LogRocket), or any other data-broker-adjacent service. Android referral measurement uses only Google Play’s first-party Install Referrer through Expo Application.

6. Children’s privacy

Their First Words is parent-led: the App is intended for parents to use with their child. The child does not create an account, sign in, type, or make any choices that send data to us — every piece of information about the child is entered by the parent.

We design and operate as if the Children’s Online Privacy Protection Act (COPPA), the GDPR’s protections for children (Article 8 / GDPR-K), and the UK Children’s Code (Age Appropriate Design Code) all apply, because the data we hold is about an identifiable child.

6.1 United States (COPPA)

Verifiable Parental Consent (VPC). No child data reaches our servers before consent — without an account, the child’s profile and learning data live only on the parent’s device. When the parent chooses to save that data to the cloud, they create an account by signing in with their own Apple or Google account. At that sign-in the parent agrees to our Terms of Service — which include confirming that they are the child’s parent or legal guardian (see Terms §2) — and to this Privacy Policy, and consents to our collection and use of their child’s profile and learning data as described in this policy. This authenticated, parent-agreed account creation is the consent transaction; child data is stored server-side only under that account, and the parent’s email address is already verified by Apple or Google.

No third-party disclosures of child data. As noted in §5, every processor that handles child-related data is bound by a data processing agreement to act only on our behalf. We disclose no child data to third parties for their own use. Because our collection supports only the App’s internal operations and involves no such disclosure, COPPA permits us to obtain parental consent through an email-based method (16 CFR §312.5(b)(2)(viii)); we are not required to obtain a separate, more rigorous form of consent such as a credit-card transaction, government-ID check, or video call.

Retention. See §7.

Parental rights. Parents may, at any time:

• Review the child’s information stored under their account (visible in-App on the Progress screen and Account → Personalize)
• Refuse further collection by deleting the child profile or the entire account in-App (see §8)
• Receive a copy of all child data on request (email privacy@theirfirstwords.org)

6.2 European Union and United Kingdom (GDPR / UK GDPR / Children’s Code)

Legal basis. Processing of parent account data is under contract (GDPR Article 6(1)(b)). Processing of child profile data is under the parent’s verified parental consent (Article 6(1)(a) and Article 8 for the child’s data) given via account creation. Optional analytics in older versions relied on the parent’s separate in-App opt-in.

Android creator-referral processing described in §§3.4 and 4.2 relies on our legitimate interests (Article 6(1)(f)) in attributing purchases to creator promotions and determining affiliate compensation. We limit this processing to the referral and purchase metadata described above, without advertising IDs, child-profile data, or cross-app tracking. This processing is independent of Firebase Analytics. You can object to this use of your information by contacting privacy@theirfirstwords.org (see §8.2).

Child’s age threshold. We treat every account as if the most restrictive EU member-state threshold (age 16) applied. Because the parent is always the account holder and always provides consent on the child’s behalf, the per-country variance does not change our flow.

UK Children’s Code. We have completed a Data Protection Impact Assessment (DPIA) covering all 15 standards; the DPIA is available on request to privacy@theirfirstwords.org. Notable defaults:

• Geolocation: no GPS, precise location, or device Location Services. Firebase estimates only an approximate country from the connection, to deliver app settings.
• Profiling: none. We do not infer behaviour or build advertising profiles of children.
• Nudge techniques: we explicitly avoid them. There are no streak guilt prompts, no manipulative reminders, no rewards for engagement.
• Default privacy settings: we send no marketing, digest, or automated operational account email. There is no email a parent must opt out of.
• Connected toys / devices: not applicable.

Data Protection Officer. We have not appointed a Data Protection Officer because we do not meet the GDPR Article 37 thresholds (no large-scale systematic monitoring; no large-scale special-category data). Privacy inquiries are handled by our privacy contact at privacy@theirfirstwords.org.

7. How long we keep information

We do not create a separate application backup of deleted user data. Google may retain residual copies in backups or replication systems during its deletion cycle for up to 180 days, unless law requires longer retention. Those residual copies are not available to the active App and are deleted under Google’s processor terms.

8. Your rights and how to exercise them

8.1 In-App account deletion (recommended)

Inside the App: Account → Delete account. A confirmation modal will ask you to type “DELETE” to proceed. After re-authentication, the App will:

1. Delete your account record (users/{your UID}), all child profiles, progress, milestone events, any linked Android referral record, and any feedback you sent us from our database
2. Delete any per-user content in Storage
3. Delete your Firebase Authentication record

Your one-time Pro purchase is not part of the App account or deletion cascade. It stays with your Apple/Google store account; deleting your App account neither refunds nor removes it, and there is no ongoing billing (see §9).

When the deletion cascade succeeds, the account and active application data are removed immediately and cannot be restored through the App. There is no application soft-delete, grace period, or undelete option. Residual processor backup/replication copies follow the limited retention described in §7.

8.2 Other rights

You may also exercise the following rights by emailing privacy@theirfirstwords.org:

• Access. Request a copy of the personal data we hold about you and your child.
• Rectification. Ask us to correct inaccurate data. (Most child profile data can be edited in-App via Account → Personalize.)
• Erasure (“right to be forgotten”). Same effect as in-App deletion; we provide this manual route in case in-App deletion is for some reason unavailable.
• Restriction. Ask us to temporarily stop processing your data while a dispute is resolved.
• Portability. Request a copy of your data in a machine-readable format (JSON).
• Objection. Object to processing based on legitimate interests, including Android creator-referral attribution and affiliate compensation, by emailing privacy@theirfirstwords.org.
• Withdraw consent. To withdraw consent for the underlying account and all associated processing, use account deletion (Account → Delete account).

We will respond within 30 days. If we need to extend that window for complex requests, we will tell you why.

8.3 Right to lodge a complaint

If you are in the EU/UK and believe we have mishandled your data, you may complain to your national data protection authority. The UK’s authority is the Information Commissioner’s Office (https://ico.org.uk). A list of EU authorities is at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

9. Purchases and billing

The Pro unlock is a one-time in-app purchase processed by Apple (App Store) or Google (Play Store), not by us. We never receive your payment card information.

There is no subscription and no recurring billing — you are charged once, when you confirm the purchase, and never again. There is nothing to cancel.

Refunds are handled by Apple and Google under their own policies. Deleting your App account does not refund or remove the purchase; it stays with your Apple/Google account and can be restored on a compatible device using that same storefront account via Restore purchases.

10. International data transfers

Our data is processed on Google Cloud / Firebase infrastructure, which may operate in multiple regions. Where data is transferred outside your country (notably from the EU/UK to the United States, where Google’s primary infrastructure is located), the transfer is governed by:

• For EU/UK transfers: the European Commission’s Standard Contractual Clauses as incorporated into Firebase’s Data Processing Terms.
• Google’s certifications under the EU–US Data Privacy Framework (DPF) and UK Extension.

You may request a copy of the relevant safeguards by emailing privacy@theirfirstwords.org.

11. Security

We implement industry-standard security practices, including:

• All network traffic between the App and our servers is encrypted via TLS 1.2+
• Database access is restricted via Firebase Security Rules so that each parent can only read and write their own account data and that of their own children
• App file storage is closed to every client, signed in or not
• There is no App-specific password to store or breach — sign-in is delegated to Apple and Google
• Cloud Functions secrets (Apple sign-in token revocation credentials) are stored via Google Secret Manager and accessed only by authorized server-side code
• We maintain a documented data-protection compliance baseline (available on request)

No system is perfectly secure. If we ever become aware of a security incident that compromises your data, we will notify you and any required regulator within the timeframes prescribed by applicable law (72 hours for GDPR; without unreasonable delay for COPPA / state laws).

12. Changes to this policy

We may update this policy from time to time. When we do, we will:

1. Update the “Last updated” date at the top.
2. If the change is material (for example: a new category of data, a new processor, or a new purpose of processing), notify you in-App at least 30 days before the change takes effect and use another legally permitted channel when one is available.
3. Keep prior versions of this policy available on request at privacy@theirfirstwords.org.

Continued use of the App after a non-material change indicates acceptance of the updated policy. For material changes, we will obtain renewed parental consent where required.

13. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your data:

• Email: privacy@theirfirstwords.org
• Postal: Their First Words LLC, 2108 N St, Ste N, Sacramento, CA 95816, United States

For users in the EU/UK, you may also lodge a complaint with your national supervisory authority as described in §8.3.