Not ready to publish. This page still contains placeholder values. Fill in LEGAL in src/consts.ts: the operator's legal name and the governing US state. Then have the result reviewed before this goes live.
Legal
Privacy Policy
Nepali Buddy is built for children, so the short answer is that we collect as little as we possibly can, and nothing at all from your child.
The short version.
Nepali Buddy has no advertising, no analytics and no tracking of your child. Your child's lesson progress is saved on your own device and is never sent to us.
The app does need an account, and it is yours, not your child's. You sign in once with Apple or Google; your child never signs in, never gives an email and never types their name. We do not know who your child is, and we do not want to.
1. Who this policy covers
This policy applies to the nepalibuddy.com website and the Nepali Buddy app for iPhone, iPad and the web. Nepali Buddy is operated by FILL IN: your full legal name, an individual developer based in the United States.
It does not cover the separate, password-protected Content Studio used by our own editors to write and review lessons. That tool is not part of the app, is not available to the public, and holds no information about the families who use Nepali Buddy.
2. What the app keeps on your device
As your child works through lessons, the app records their progress so they can pick up where they left off. That includes:
- which lessons have been started and completed, and the stars earned
- saved checkpoints inside an unfinished lesson
- which words have been practised or collected
- settings such as whether romanised hints and celebration sounds are switched on
All of this stays on your device. It is stored in the app's own local storage on iPhone and iPad, or in your browser's local storage on the web. It is not transmitted to us and we have no way to read it. Deleting the app, or clearing your browser's data for this site, erases it permanently, and we cannot restore it for you, because we never had a copy.
3. What the app sends over the internet
The iPhone and iPad app bundles its lessons, audio and artwork, so no lesson content is streamed or fetched while your child is learning. Signing in does need a connection.
When you ask the app to check for new lessons, it downloads public lesson data and media from our server. It does not send your child's progress, settings or any identifier in that request. As with any request to any website, our server and the network providers in between receive the technical details needed to deliver a response: your IP address, the time, and basic device or client information. We use these only to run and secure the service.
The app contains no advertising SDK, no analytics SDK, no tracking pixels and no social media integrations. It does not access the microphone, camera, contacts, photos or location.
The one other thing that leaves the device is signing in, which is covered in the next section.
4. Signing in
Using the app requires an account. That account is the parent's or guardian's, not the child's, and this is deliberate. A seven-year-old should not have a login, and keeping the account in an adult's name is what lets everything else on this page stay true.
You sign in with Sign in with Apple or Google. We never see or handle a password. From the provider we receive, and store in our authentication database:
- an account identifier
- the email address the provider releases
- your name, where the provider supplies one
- which of the two providers you used
If you use Sign in with Apple you can choose Hide My Email, in which case we only ever receive an anonymous@privaterelay.appleid.com address and never your real one. We ask for no additional permissions from either provider: no contacts, no calendar, no profile beyond the above.
Authentication is handled by Supabase, which stores the account record and the session on our behalf. Your child's lesson activity is not attached to it.
Progress does not currently sync. The account exists so that progress can eventually follow your family to a new device, but today lesson records stay on the device as described above and are not uploaded. If that changes, this page will say so before it ships, and it will still only ever carry lesson identifiers and counts, never your child's name, writing, drawings or recordings.
You can sign out from Settings at any time. To have the account itself deleted, email [email protected].
5. This website
nepalibuddy.com is a static website hosted on Cloudflare Pages. It sets no cookies and runs no analytics. We do not use Google Analytics or any equivalent, and there are no third-party scripts on these pages.
Cloudflare, as our hosting provider, processes requests on our behalf and keeps standard server logs, including IP addresses, for delivery, security and abuse prevention. Their handling of that data is governed by their own privacy commitments as a processor.
6. The email list
If an adult enters an email address into the "notify me" form on this site, we store three things: the email address, the date and time, and the two-letter country code that Cloudflare derives from the request. The country code helps us understand roughly where interest is coming from; we do not store the IP address it came from.
This is held in Cloudflare KV storage and is used for exactly one purpose: to send a single message when the app is available on the App Store. We do not run a newsletter. We will not sell, rent, share or otherwise disclose your address, and we will not use it to advertise anything else.
You can have your address removed at any time, for any reason and without explanation, by emailing [email protected]. We will delete it and confirm.
7. Children's privacy
Nepali Buddy is designed for children of roughly six to ten, learning alongside an adult. We have built it so that no personal information is collected from a child, at any point. There is no chat, no profile, no social feature and no way for a child to communicate with anyone through the app.
The account is the deliberate exception, and it belongs to the adult. The sign-in screen is for a parent or guardian to complete; a child is not asked to create an account, and nothing in the app invites them to enter an email address, a name or any other detail about themselves. The information described in section 4 is an adult's, given knowingly by that adult.
If you would rather your child never reached a sign-in screen at all, sign in yourself before handing the device over. That is how the app is meant to be used.
We do not knowingly collect personal information from children under 13, as defined by the United States Children's Online Privacy Protection Act (COPPA), or from children under the applicable age of digital consent in other countries.
The email form on this website is intended for parents and guardians only. If we become aware that an address on our list belongs to a child, we will delete it. If you believe a child has given us information, email [email protected] and we will remove it promptly.
8. Who else is involved
We keep the list of third parties as short as we can. At present it is:
- Cloudflare hosts this website, delivers the app's lesson updates, and stores the email list.
- Supabase stores the account record and session created when you sign in. It does not hold your child's lesson activity.
- Apple distributes the iPhone and iPad app, and provides Sign in with Apple. Anything you do in the App Store itself, including downloads and any App Analytics Apple reports to us in aggregate, is governed by Apple's own privacy policy, not this one.
- Google provides Google sign-in, if that is the option you choose. Your use of your Google account is governed by Google's own privacy policy.
We do not sell personal information, and we do not share it for advertising or any form of cross-context behavioural advertising.
9. How long we keep things
Account records are kept for as long as you use Nepali Buddy, and are deleted when you ask us to delete the account. Email addresses on the launch list are kept until that one message has been sent, or until you ask us to remove yours, whichever comes first. Server logs are retained only for the short period needed for security and reliability. Your child's progress is not kept by us at all; it lives on your device for as long as you keep the app installed.
10. Your rights
Depending on where you live, you may have rights to access, correct, export or delete the personal information an organisation holds about you, and to object to its processing. What we hold about you is short: an account record, and an email address if you joined the launch list. So we can satisfy any of these by telling you exactly what we have and deleting it on request.
Write to [email protected] and we will respond. You do not need to explain why.
11. Changes to this policy
If we change how we handle information, we will update this page and move the "last updated" date at the top. If a change is significant, for example if we ever began collecting something new, we will say so clearly here rather than quietly amending the text.
12. Contact
Privacy questions: [email protected]
Anything else: [email protected]