Limit Use of Sensitive Personal Information

California Privacy Rights Act (CPRA) — Effective May 9, 2026 Under the California Privacy Rights Act, Cal. Civ. Code § 1798.121, you have the right to direct Koydo to use and disclose your Sensitive Personal Information (SPI) only for the purposes that are reasonably necessary to provide the Service and for the additional purposes permitted by Cal. Civ. Code § 1798.121(b).

Koydo's default processing of SPI is already aligned with the Limit framework:

• Koydo does not run advertising of any kind.
• Koydo does not sell or share personal information for cross-context behavioral advertising.
• Koydo does not use SPI to infer characteristics about you for non-educational purposes.
• For under-13 pronunciation exercises, voice clips are processed by our AI provider in real time and immediately discarded — no biometric template is stored.

• Account credentials (email, hashed password, session tokens) — used solely for authentication.
• The fact that a user is a minor (when applicable) — used solely for age-appropriate protections required by COPPA, AB 2273, the UK Children's Code, and similar laws.
• Pronunciation voice clips (under 13 only, with parental consent) — processed-and-discarded by our AI provider; never stored.

Send an email to privacy@koydo.app with the subject line "CPRA Limit SPI Request" and the email address associated with your Koydo account. Koydo will:

1. Confirm receipt within 10 business days.
2. Verify your identity using the existing account email and (where appropriate) a second factor.
3. Process the request and respond within 45 calendar days, with one 45-day extension where reasonably necessary (Cal. Civ. Code § 1798.130).
4. Document the request and the action taken in our Article-30-equivalent record.

Because Koydo's default SPI processing already matches the Limit defaults, submitting a request will not materially change what Koydo does with your data — but it will create a documented request record. Koydo will continue to process SPI only for: providing the Service, security and fraud prevention, complying with legal obligations, and the other purposes specifically permitted by Cal. Civ. Code § 1798.121(b).

A self-serve toggle in Account Settings → Privacy is in development. Until that ships, email is the canonical channel — and as noted above, Koydo's defaults already reflect the Limit framework.