How we handle personal information in Learning With Momo, on the web and in our Android app.
The short version
This summary is here to help. The full policy below is what counts.
Learning With Momo is a language-learning app for children and adults. It runs in a web browser, and in our Android app once it is published on Google Play, which opens the same service (section 9). This policy covers both, and our website at learningwithmomo.com. It explains what personal information we collect, why, where it is kept, how long we keep it, and the choices you have. It is written to follow the fair information principles in Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
We built the service to hold as little personal information as we can. Section 4 lists the things we do not collect.
We have designated a Privacy Officer accountable for our privacy practices. Questions, access requests, corrections, consent withdrawals and complaints go to [email protected].
This is everything we keep on our servers, or receive, about you and the people who learn on your account.
| Information | What it is, and why we have it |
|---|---|
| Account | Your email address, which is your sign-in and how we email you. Your password, stored only in scrambled (hashed) form (section 12). When the account was created and when it was last used, your trial or membership and when it ends, whether it is a family account, and which version of the Terms and this policy you agreed to and when. We do not keep your IP address with that agreement. We need all of this to sign you in and run your trial or membership. |
| Family list (family accounts only) | For each learner, up to 5: a first name or nickname (up to 16 characters), an age from 1 to 99, and an animal picture. We keep the list so every device signed in to your account shows the same learners, and because the age picks each learner's starting age mode. Each learner's own stars, stickers and streaks stay on the device they play on (section 6), and our servers do not keep progress for each learner. The usage records below count activity for the whole account. |
| Reading tutor | Only if you use the Reading area. For each reader a grown-up adds, up to 6: a nickname (up to 16 characters), an animal picture and a reading level. Also each reader's results from the tap games: which letter sounds and words were read correctly, common mix-ups (for example, "reads sh as s"), coins, stars, the treehouse, and weekly summaries for the last 8 weeks (sessions, minutes, words read and how many answers were right). This lets the grown-ups' report work on any device, and lets the tutor choose what to practise next. |
| Usage records | While the app is in use, it sends us small activity notes, which we add up per day under the account's email address: how often the app was opened, minutes of use (counted in 2-minute steps), which screens, decks and games were used, the best game score for each deck, stars earned, which words were missed and in which language, the language and age mode in use (Little Explorer, Big Kid, or Teens & Grown-ups), whether the app was installed or played offline (and when offline play was last sent to us), and the time of the last activity. They never include a learner's name, age or voice. Each day's site-wide totals also keep one line per account, linked to the account's email address, with the number of activity notes, minutes, whether the installed app or offline play was used, and the time of the last activity. We use these records to see whether the app is used, find what is not working, and decide what to improve. |
| Feedback you send | If you use the "Ideas?" box in the app, we receive your message (up to 2,000 characters), the mood you picked, the account's email address, the language and age mode in use, and the time. It is saved on our servers and emailed to us, so we can read it and reply. |
| Contact form messages | If you use the contact form on our website, we receive your name (if you give it), your email address, the topic you picked and your message. It is emailed to us so we can reply. It is not saved on our servers. |
| Security checks | Short-lived counters that stop guessing: wrong passwords and wrong sign-in codes, counted against the email address (cleared after 15 and 10 minutes); and wrong attempts at the owner's own sign-in and admin tools, counted against the IP address (cleared after 15 minutes). Our servers see your IP address with each request, as any website does, but do not otherwise store it. The sign-up, sign-in, password reset and account deletion pages also use Cloudflare Turnstile, a check that tells people from bots (section 8). |
| Deletion record | When an account is deleted on our account deletion page, we keep its email address, when it was created and when it was deleted, for 8 days, so that a delayed copy of the account elsewhere in our host's network cannot be signed in to or saved again (section 11). |
| Emails we send you | Sign-in codes, password reset links, and account deletion links and confirmations. We do not store sign-in codes. We do not use your email address for marketing. |
We never receive anyone's voice. "Say it like Momo" and the Reading tutor's microphone use your browser's own recording feature. The recording stays in the browser's memory on your device so it can be played back there. Each new take replaces the last one, and it is gone when the page is closed or reloaded. Recordings are never uploaded, never saved on our servers, and never sent to anyone. The Reading microphone stays off until a grown-up turns it on for that device.
Nothing listens to or scores speech. There is no speech recognition, pronunciation scoring or accent check anywhere in the app.
Word-game progress is kept on the device. The stars, stickers, streaks and deck scores shown in the word games are saved in the browser on each device and are not synced between devices. Our usage records (section 3) still note stars earned, best scores and missed words each day, under the account's email address.
We do not collect payment information. We do not take payments, and nothing can be bought in the service.
No advertising, and no tracking for advertising. There are no ads, no ad networks, no advertising ID, no behavioural profiling, no outside analytics service and no data brokers. We count usage ourselves, with our own code, and we do not sell, rent or trade personal information.
We do not ask for anyone's date of birth, photo, school, home address, location or contacts, or for a learner's full name. There is no chat, and no way for learners to contact other users.
Learning With Momo is designed for learners of all ages, including young children. Its age modes are Little Explorer (2 to 5), Big Kid (6 to 12) and Teens & Grown-ups (13 and up), and the Reading tutor covers Kindergarten to Grade 3.
An adult holds every account. Children do not have their own accounts, email addresses or passwords. A parent or guardian creates the account, agrees to the Terms and this policy, and decides whether to add learners. When you add a child to the family list or the Reading tutor, you confirm that you are their parent or guardian, or have their parent's or guardian's permission, and you agree on the child's behalf to what this policy describes. We do not ask anyone's age at sign-up, so we rely on you for this.
What we may hold about a child:
Please use a first name or nickname only, and keep personal details out of feedback messages.
Your choices as a parent or guardian.
Parents in the United States. The choices above are how you review a child's information, have it deleted, or stop any further collection, as the Children's Online Privacy Protection Act (COPPA) provides. We collect only what the activity needs, we do not ask a child for more, and we do not disclose children's information to anyone except the service providers in section 8, who use it only to run the service for us. To make a request, write to us (section 13).
We do not show ads to anyone, and we do not build advertising or behavioural profiles of children. If you believe a child has created an account without a parent or guardian, contact us and we will delete it.
One cookie of our own. We set one cookie, momo_session, to keep you signed in. It holds your email address, an expiry date, a session number and a security signature, never your password. It is marked HttpOnly, Secure and SameSite=Lax, and lasts up to 90 days. Signing out clears it. We use no advertising or tracking cookies. Cloudflare, which hosts the site, may add a short-lived security cookie of its own when its bot protection is active. That cookie is used only to tell people from bots.
Storage in your browser. The app also saves some things in the browser's own storage on your device. We cannot see this storage. The app sends us only what section 3 describes. It holds:
Signing out removes the family list and the Reading readers from that device. Word-game progress stays until you clear this site's data in your browser's settings. If you share a device, the next person to sign in on it will see that progress, and usage notes saved while offline are sent under whichever account signs in next.
We do not sell personal information, use it for advertising, or send marketing email. We share it only with the service providers in section 8, who help us run the service, or where the law requires or allows it, for example to answer a valid court order. If our business were sold or merged, personal information would pass only to a buyer who keeps the protections in this policy, and we would tell account holders.
We use a few providers to run the service. Each one receives only what is listed below. Some of them process information outside Canada, including in the United States, and while it is there it may be accessible to courts and law enforcement under that country's laws.
| Provider | What it does for us, and what it receives | Location |
|---|---|---|
| Cloudflare | Hosts the website and the app, runs our server code, and stores everything in section 3 that we keep on our servers. Runs Turnstile, the bot check on the sign-up, sign-in, password reset and account deletion pages, which looks at browser and device signals. Like any host, it sees the IP address and browser details of every visit. | Global network, including Canada and the United States |
| Twilio SendGrid | Sends our emails: sign-in codes, password resets, account deletion links and confirmations, and account notices. Also delivers feedback, contact form messages and our weekly usage summary to our inbox. It receives the email addresses and the content of those emails. | United States |
| Google (Gmail) | Hosts the inbox where feedback, contact form messages and our weekly usage summary arrive. It holds the content of those messages, including email addresses. | United States and other countries |
| Google Play | Will distribute our Android app once it is published. Downloading and updating the app through Google Play is covered by Google's own privacy policy. Google gives us summary statistics, such as install counts and crash reports, which we do not link to accounts. | Global |
| ElevenLabs and Microsoft | Their computer voices made the app's pre-made audio, in advance: ElevenLabs for Arabic, Microsoft for the other languages, the English helper line and the Reading tutor. ElevenLabs also converted at least one recording we made ourselves into its voice. They receive nothing about you or any learner: the app plays stored audio files from our own servers. | Not applicable: no personal information |
A few words, such as Arabic letter names, are spoken by your device's built-in voice instead. That voice belongs to your device or browser. On some devices it uses its maker's online service, which then receives the word being spoken. We send nothing to it.
We serve all our fonts (Baloo 2, Baloo Bhaijaan 2, Nunito and Lexend) from our own servers, so no font service sees your visit.
Our Android app, Learning With Momo, which will be published on Google Play, is the same service as the website, with the same account. It opens learningwithmomo.com full screen in your phone's browser, usually Google Chrome, using a standard Android feature called a Trusted Web Activity. Everything in this policy applies to it in the same way.
We keep personal information only as long as it is needed, then delete it automatically. The email addresses on old feedback are removed by a clean-up that runs once a week. Most other things expire on their own, as listed below.
| Information | How long |
|---|---|
| Account (email, password hash, trial or membership, agreement record) | Until you delete it (section 11), or until we stop offering the service. We do not currently delete unused accounts automatically. If we start, we will update this policy first and email the accounts affected before anything is deleted. |
| Family list | Kept while the account exists, and deleted with it. If a family account is switched back to a single learner, we keep the list in case it is switched back, until the account is deleted or you ask us to remove it. |
| Reading tutor profiles and results | Kept while the account exists, and deleted with it. Weekly summaries cover only the last 8 weeks. You can delete them yourself at any time. When a reader is deleted, we keep a random reader code and the date, with no name, so that another device does not bring the reader back. It stops being used after 90 days, and it is cleared the next time your readers change, or with the account. |
| Per-person usage records | Each day's record is deleted automatically 61 days after the day it covers. |
| Site-wide daily totals, including your line | Each day's totals are deleted automatically 121 days after the day they cover. |
| Feedback | Your email address is removed from the saved message after 90 days. The rest is deleted after 12 months. |
| Copies in our inbox (feedback, contact form messages, our weekly usage summaries, and emails you send us) | Deleted within 12 months. |
| Security counters | 15 minutes for wrong passwords and wrong attempts at the owner's tools; 10 minutes for wrong sign-in codes. |
| Deletion record | 8 days after the account was deleted. |
| Sign-in codes and links | Sign-in codes are never stored, and work for 10 minutes. Password reset and account deletion links work for 30 minutes. |
| Storage on your device | The family list and Reading readers until you sign out. Everything else until you clear this site's data in your browser. |
| Pre-made teaching audio | Kept indefinitely. It is our own audio library and contains no information about learners. |
You can delete your account, and the data we store with it, at any time.
What is deleted, straight away: the account (email, password hash, trial or membership, and agreement record), the family list, every Reading profile and its results, the per-person usage records and your line in each day's site totals, feedback that still carries your email address, and the short-lived sign-in counters. Every device signed in to the account is signed out the next time it connects to us, and we email you a confirmation.
What remains:
Apart from this list, we keep nothing ourselves, for legal, security or any other reason. Our providers may keep short technical records, such as a log of emails sent, under their own retention rules.
Signing in to an account normally needs your password and a 6-digit code we email you, which works for 10 minutes on the device that asked for it. Three wrong passwords pause sign-in for that email address for 15 minutes.
Passwords are stored as PBKDF2-SHA256 hashes with 100,000 iterations, an individual salt and a server-side secret. Some older accounts keep an earlier scheme (salted SHA-256, repeated 1,000 times, with the same server-side secret) until their next sign-in or password reset, when they move to the new scheme automatically. We never store your actual password.
Sessions are signed, so they cannot be altered to reach another account. After a password reset, sessions started before it can no longer load the app from our servers, or reach the family list or Reading results kept there. All traffic is encrypted in transit with TLS. The usage reports and saved feedback can be opened only by the owner of the business.
No system is perfectly secure. If a breach creates a real risk of significant harm, we will notify the people affected and the Office of the Privacy Commissioner of Canada, as PIPEDA requires.
Before acting on a request, we may ask you to confirm that you control the account's email address. We respond to access, correction and deletion requests within 30 days.
If we change this policy, we will update the effective date above. If a change matters, the app will show you the updated policy and ask you to agree before you carry on, and we may also email account holders.