Privacy at Koydo — 1-Page Plain-Language Summary

• Account info — your display name, age, grade, and your parent's email if you're under 13.
• Learning progress — which lessons you finish, your scores, and your skill levels.
• Activity signals — how you interact with activities, like time spent and content choices.
• Adaptive signals (only with opt-in) — additional behavioral measurements used by Koydo Intelligence (Koydo Intelligence) to personalize learning. Off by default for kids under 13.
• Voice (pronunciation only) — when a voice feature is available, a short clip may be sent to an approved provider for real-time analysis. Koydo does not keep the source recording after processing.

• ❌ No advertising. Ever. We don't run ads and we don't use advertising cookies.
• ❌ No selling or sharing your data for cross-context behavioral advertising. (Even though we don't, you can still file a "Do Not Sell or Share" request — we honor it.)
• ❌ No training AI models on your child's work or conversations. Koydo does not opt in to provider training, and child personal data is blocked from an AI provider unless current contract, data-use, and account-setting evidence has passed Koydo's private review.
• ❌ No profiling for non-educational purposes.
• ❌ No keeping voice recordings.
• ❌ No sharing student data with anyone outside of what's needed to deliver the Service (and for school accounts, only with your school).

You can do all of these for free, anytime:

• See your data. Request a copy in machine-readable JSON.
• Fix it. Correct anything inaccurate.
• Delete it. Adults and teens have a cancellable 30-day grace period; parent-confirmed child requests use 14 days; verified GDPR erasure requests are queued without a grace period; schools are processed within 30 days. Restricted backups and security logs then expire on their provider schedules.
• Take it elsewhere. Export and import to another service.
• Turn off adaptive learning. Koydo Intelligence is opt-in and reversible.
• California specifically: limit use of sensitive personal information; opt out of profiling and automated decisions; learn the logic behind those decisions.
• EEA / UK / Switzerland: all the GDPR rights — access, rectification, erasure, portability, restriction, objection, withdraw consent, lodge a complaint with your local supervisory authority.

• We don't collect your child's information until a parent verifies consent through a one-cent ($0.01) authorization that's immediately voided. Alternative methods (signed form, gov ID, video call) are available on request.
• We follow COPPA, including the April 22, 2026 Amended Rule that treats voiceprints as biometric identifiers and requires separate consent for third-party AI disclosure.
• Parents can review, delete, export, disable Koydo Intelligence, or revoke consent — anytime, from the Parent Dashboard.
• Mixpanel is disabled in the current linked web configuration; its optional code path blocks minors, anonymous visitors, and unresolved profiles.

• Mixpanel remains unavailable to teens. Optional Vercel analytics are blocked for active profiles known to be under 18; anonymous visitors must select adult mode and consent.
• Teens can access, export, and delete their data themselves.
• AI conversations retained 90 days, then auto-deleted (vs 30 days for kids under 13, 12 months for adults).
• Optional parental dashboard with the teen's approval.

• Adults & teens: Account Settings → Delete Account. A cancellable 30-day grace period protects against accidental deletion.
• Parents: Parent Dashboard → Manage Child's Data → Delete All Data. The live child account purge is scheduled within 14 days.
• Schools: email privacy@koydo.app — we delete within 30 days.
• After live purge: restricted rotating database backups and security logs age out on provider schedules; Storage objects are deleted separately.

The Privacy Team at privacy@koydo.app. EEA and UK users can also lodge a complaint with their local supervisory authority — links in the full policy under §10.4.

Privacy summary v2026-07-11 — Effective July 11, 2026. The full Privacy Policy at /legal/privacy-policy is the authoritative document.