Privacy at Koydo — 1-Page Plain-Language Summary

Version: 2026-05-09 Effective Date: 2026-05-09 Authoritative document: /legal/privacy-policy This summary is required by the UK Children's Code Standard 4 (Transparency), California AB 2273 (Age-Appropriate Design Code), and the Irish DPC's Fundamentals for a Child-Oriented Approach to Data Processing. It is provided so children, teens, parents, teachers, and administrators can quickly understand Koydo's data practices. The full Privacy Policy is the authoritative document; both documents share the same version hash recorded in the manifest.

• Account info — your display name, age, grade, and your parent's email if you're under 13.
• Learning progress — which lessons you finish, your scores, and your skill levels.
• Activity signals — how you interact with activities, like time spent and content choices.
• Adaptive signals (only with opt-in) — additional behavioral measurements used by Koydo Intelligence (PRISM) to personalize learning. Off by default for kids under 13.
• Voice (pronunciation only) — short voice clips for pronunciation practice are sent to our AI provider for real-time analysis and immediately discarded — never stored.

• ❌ No advertising. Ever. We don't run ads and we don't use advertising cookies.
• ❌ No selling or sharing your data for cross-context behavioral advertising. (Even though we don't, you can still file a "Do Not Sell or Share" request — we honor it.)
• ❌ No training AI models on your child's work or conversations. Our AI providers operate under "zero data retention" agreements that forbid this.
• ❌ No profiling for non-educational purposes.
• ❌ No keeping voice recordings.
• ❌ No sharing student data with anyone outside of what's needed to deliver the Service (and for school accounts, only with your school).

You can do all of these for free, anytime:

• See your data. Request a copy in machine-readable JSON.
• Fix it. Correct anything inaccurate.
• Delete it. All of it. We delete within 14 days (consumer accounts) or 30 days (school accounts).
• Take it elsewhere. Export and import to another service.
• Turn off adaptive learning. PRISM is opt-in and reversible.
• California specifically: limit use of sensitive personal information; opt out of profiling and automated decisions; learn the logic behind those decisions.
• EEA / UK / Switzerland: all the GDPR rights — access, rectification, erasure, portability, restriction, objection, withdraw consent, lodge a complaint with your local supervisory authority.

• We don't collect your child's information until a parent verifies consent through a one-cent ($0.01) authorization that's immediately voided. Alternative methods (signed form, gov ID, video call) are available on request.
• We follow COPPA, including the April 22, 2026 Amended Rule that treats voiceprints as biometric identifiers and requires separate consent for third-party AI disclosure.
• Parents can review, delete, export, disable Koydo Intelligence, or revoke consent — anytime, from the Parent Dashboard.
• Kids under 13 are blocked by code from Mixpanel analytics, addictive feeds, advertising, and (if PRISM is off by default) profiling.

• Mixpanel and Vercel performance analytics blocked by code (under 18).
• Teens can access, export, and delete their data themselves.
• AI conversations retained 90 days, then auto-deleted (vs 30 days for kids under 13, 12 months for adults).
• Optional parental dashboard with the teen's approval.

• Adults & teens: Account Settings → Delete Account. Takes 14 days to fully cascade.
• Parents: Parent Dashboard → Manage Child's Data → Delete All Data. Takes 14 days.
• Schools: email privacy@koydo.app — we delete within 30 days.

The Privacy Team at privacy@koydo.app. EEA and UK users can also lodge a complaint with their local supervisory authority — links in the full policy under §10.4.

Privacy summary v2026-05-09 — Effective May 9, 2026. The full Privacy Policy at /legal/privacy-policy is the authoritative document.