1. Introduction

"LuachHaotiot" (Letter Board) is an educational app for teaching Hebrew letters to children. This privacy policy describes what information the app collects, why, how long it is kept, and what rights parents have.

2. Information We Collect

2.1 Random ID (Anonymous Authentication)

The app uses anonymous authentication via Firebase Authentication. A random user ID is generated automatically, without entering any personal information. Firebase services also create a random installation ID. These IDs are not linked to the identity of the child or the parent.

2.2 Usage Data and Analytics

We collect usage data through Firebase Analytics to improve the app:

• Screens viewed within the app and onboarding steps
• Exercises started and completed, and difficulty levels selected
• Exercise performance: whether an answer was correct, the number of attempts, the word or letter in the exercise, accuracy, and completion time
• Letters and vowel marks selected on the letter board
• Settings changes (font, language, pronunciation)
• Subscription events (subscription screen views, purchases, unlocking the website with a QR code)
• Technical errors (sync failures, audio playback errors)
• General technical information that Firebase collects automatically: device model, operating system version, app version, device language, and approximate country (from the IP address, not precise location)

2.3 Usage Properties

General properties are attached to the analytics data:

• Subscription status (active / not active)
• Settings (font, language, pronunciation)

2.4 Crash Reports

When the app crashes or hits an error, a report is sent through Firebase Crashlytics. The report includes the error details, device model, operating system version, and app version, and is used only to find and fix problems.

2.5 Remote Settings

The app downloads settings through Firebase Remote Config (for example, which exercises are free). This uses the random installation ID. Different users may receive different versions of these settings, so we can test what works better.

2.6 Linking a Subscription to the Website and Other Devices

When a parent chooses to unlock the website or another device with their subscription (for example, by scanning a QR code or entering a link code), the app sends the purchase receipt it received from the app store, together with the random ID, to our server (Firebase Cloud Functions) so the subscription can be verified with Google Play or Apple. This receipt does not include payment details.

2.7 Information Stored Only on the Device

The following data is stored on the device only and is not sent to us:

• User preferences (app settings)
• Learning progress: exercise history, letters the child confuses, words learned, stickers, and trophies. The app uses this on the device to choose letters to practice and to show progress
• Cached media files (images and audio for exercises)

3. Information We Do Not Collect

The app does not collect the following:

• Name, email address, or phone number
• Precise location
• Voice recordings, contacts, photos, or files from the device
• Biometric data
• The advertising ID (Advertising ID / IDFA) or hardware identifiers (IMEI, MAC address)
• Financial information (payments are processed by the app stores)

4. App Permissions

The app uses the internet permission to download exercise content, and the billing permission for the subscription.

Camera: the camera is used only when a parent chooses to scan a QR code to unlock the website with their subscription. On iPhone the app asks for camera permission; on Android the scan is handled by Google Play services and the app itself has no camera permission. The image is processed on the device only, only the scanned code is read, and no image is stored or sent.

The app does not use the microphone, location, or contacts.

5. Third-Party Services

5.1 Firebase (Google)

The app uses Google's Firebase services, which act as our service providers:

• Firebase Analytics - usage data (section 2.2)
• Firebase Crashlytics - crash reports (section 2.4)
• Firebase Remote Config - remote settings (section 2.5)
• Firebase Authentication - anonymous authentication (no personal data)
• Cloud Firestore and Firebase Storage - exercise content storage (words, images, and audio)
• Cloud Functions for Firebase - subscription verification for linking the website and other devices (section 2.6)

Google's privacy policy is available at: https://policies.google.com/privacy

5.2 App Stores

Subscription purchases are processed by Google Play or the Apple App Store. Payment information is handled directly by the app stores and never reaches us.

6. Subscriptions and Purchases

The app offers a premium subscription to unlock additional exercises and content. Purchases are made through the app stores (Google Play / App Store).

7. Advertising

The app does not display advertisements and does not use any advertising networks.

8. Data Sharing

We do not sell, trade, or share user data with third parties. Data is processed only by the service providers listed in section 5, to run the app, and is used solely to improve the app.

9. Data Security

We take reasonable measures to protect information:

• All server communication is encrypted via HTTPS
• Anonymous authentication without storing personal credentials
• Server data access is restricted by security rules, and only the developer can access analytics data
• Local data is stored in app-specific directories

10. Data Retention

• Analytics data: up to 14 months, then deleted automatically. Aggregated data that does not identify a device (general statistics) may be kept longer
• Crash reports: up to 90 days
• Subscription links to the website and devices: kept while the subscription is active and deactivated when it ends. Temporary scan requests are deleted a day after they expire
• Data on the device: until the app is uninstalled

We do not keep information longer than needed for the purposes described in this policy.

11. Data Deletion

All local data can be deleted by uninstalling the app from the device.

Parents who wish to request deletion of data from our servers may contact us at: developbyshwartz@gmail.com. We will process the request within 30 days.

12. Children's Privacy and Legal Compliance (COPPA, GDPR, and Israeli Privacy Law)

This app is designed for children and is built with special attention to privacy, in compliance with the US Children's Online Privacy Protection Act (COPPA), the EU General Data Protection Regulation (GDPR), and the Israeli Privacy Protection Law.

12.1 General Principles

• No personally identifiable information is collected (no names, emails, phone numbers, precise location, photos, etc.)
• No advertisements are displayed and no ad networks are used
• No profiling, ad targeting, or ad personalization is performed
• The app does not collect the device's advertising ID, and ad personalization signals are disabled in Firebase services
• A parental gate (math question) protects against unintended purchases and actions

12.2 Why Random IDs Are Collected (Internal Operations)

The random IDs and usage data (section 2) are collected solely to support the internal operations of the app, as permitted under COPPA:

• Maintaining and improving the app and its exercises
• Analyzing and fixing technical errors
• Delivering app settings and verifying the subscription
• Aggregate statistical analysis of usage patterns (not at the individual level)

To make sure this data is not used for anything else: we do not use it to contact any user, for advertising, for building profiles, or for marketing; we do not combine it with data from other sources; and we do not pass it to anyone other than the service providers in section 5.

12.3 Parental Rights

Parents and guardians have the following rights:

• Request a description of the types of data collected
• Request deletion of data associated with their child's device
• Contact us with any questions regarding their child's privacy

For any request, please contact us at: developbyshwartz@gmail.com. We will respond within 30 days.

13. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "last updated" date.

14. Contact Us

For questions regarding this privacy policy, please contact us at:

Email: developbyshwartz@gmail.com