Privacy Policy

1. Who we are

gugudan ("gugudan", the "app", "we", "us") is a voice-based multiplication-tables practice app for elementary-school children. The app is operated by MariCircuit (마리서킷), a business registered in the Republic of Korea. You can reach us at hello@gugudan.app.

This policy explains what information the app handles, with a focus on children, and how parents and guardians can exercise their rights. It is written to follow the U.S. Children's Online Privacy Protection Act (COPPA).

2. Our approach to children's data

gugudan is designed for children, so we collect as little as possible:

• There is no sign-up and no account. We do not ask for or separately collect a child's name, age, birthday, email address, phone number, contacts, location, or photos. Anything a user types into the feedback comment box after a quiz is stored as feedback, with anything shaped like a contact detail masked and the comment itself erased as soon as we have read it (Section 3.5).
• The app works fully in keyboard mode, in which no audio is used.
• Information leaves the device only in four cases: the child's spoken answer, when a parent has enabled the optional voice-grading feature (Sections 4 and 5); a diagnostic log, only when a parent taps "Send diagnostics log" in Settings (Section 3.3); a star rating and a comment, only when "Send" is tapped in the question shown after a finished quiz (Section 3.5); and a random per-install identifier the app uses to check for updates (Section 3.4).

3. Information we handle

3.1 Stored on the child's device

The following are stored on the device and never sent to a company server, except as part of a diagnostic log a parent chooses to send or feedback a user chooses to send (Sections 3.3 and 3.5). They contain no name, age, or other identifying details, and are removed when the app is uninstalled:

• Learning records (problems solved, correct/incorrect history)
• In-progress session state and per-table study statistics
• Language setting
• A consent record (the date/time of consent, the items consented to, and the disclosure version)

3.2 Handled only when voice grading is ON

• The child's spoken answer (audio). A short spoken answer to a multiplication question (for example, "twenty-one"). It is used only to convert speech to text so the app can grade the answer.
• A device-integrity token (Firebase App Check). A token used only to block automated abuse of our relay. It is not personally identifying and is generated only while voice grading is enabled, or when a parent sends a diagnostic log or a user sends feedback.

We do not create a voiceprint, perform speaker identification or any biometric analysis, use the audio to identify the child, profile the child, or use the audio to train any model.

3.3 Sent only when a parent taps "Send diagnostics log"

• A text diagnostic log. Per-question timing records, the recognized answer text, the grading result, the device type (operating system and model name), the app and update version, the language setting, and whether voice or keyboard mode was used. It contains no name, no device identifier, and no audio. It is sent only when a parent taps the button, stored on our private server for 90 days, and then deleted automatically. This feature is present only in our test builds; it is not shown in the app downloaded from the App Store or Google Play.

3.4 Sent automatically to check for app updates

• A random per-install identifier and app version information, sent to our app-update provider (Expo) when the app checks for updates. It is not used to identify, track, or profile the child, and it is not combined with any other record of ours.

3.5 Sent only when "Send" is tapped in the question after a quiz

• Feedback. A star rating (1–5), a comment (optional, up to 300 characters), which quiz it followed (first quiz with table 2 or 3 / first quiz with a paid table / the child's recorded voice played in the quiz), the app and update version, the device type (Android/iOS), and the language setting. We do not add a name, a device identifier or learning records to it. It is used only to hear a user's view of the quiz and improve the app, and is sent only when the button is tapped. If the comment holds something shaped like a phone number or an e-mail address, the app stops the send and asks for it to be taken out, and anything that still arrives is masked as ●●● before it is stored. The comment is erased as soon as we have read it; the rating and the other items are stored on our private server for 90 days, then deleted automatically.

4. How the spoken answer is processed

When voice grading is on, the child's spoken answer is sent over an encrypted (TLS) connection to gugudan's own relay server (operated by MariCircuit on Google Cloud, in Japan) and then to Google Cloud Speech-to-Text for transcription only, in the United States for users in the United States and otherwise in the region nearest the user.

• The audio is processed ephemerally — held in memory only for as long as it takes to transcribe the answer in real time.
• It is deleted immediately after transcription. Our relay is stateless and stores no audio on disk, in logs, or in any database, and the transcription service is configured not to retain, log, or train on the audio.
• There is no behavioral advertising, profiling, or tracking at any point.

5. The optional voice feature and parental consent

Voice grading is off by default and is a setting a parent turns on. When it is on, the voice feature sends only the child's short spoken answer, used solely to convert speech to text so the app can grade it (Sections 3.2 and 4).

Under COPPA, a child's audio that is collected solely as a replacement for the written answer, used only for that purpose, not used to identify the child, and deleted immediately after it is converted to text may be handled without separate verifiable parental consent — the COPPA "audio file" exception. gugudan is built to meet these conditions: the spoken answer stands in for the written one, is used only for transcription, is never used to create a voiceprint or to identify or profile the child, and is deleted immediately after transcription (Sections 3.2, 4, and 6).

A parent stays in control at all times:

• The feature is off until a parent turns it on, and the app is fully usable in keyboard mode without it.
• A parent can withdraw at any time by turning voice grading off in the app's Settings, which stops any further transfer of the spoken answer immediately.

If we ever change the voice feature so that this exception no longer applies, we will obtain verifiable parental consent before that change takes effect.

6. Retention and deletion

Our data-retention policy is to keep as little as possible, for as short a time as possible:

• Spoken answer (audio): deleted immediately after transcription. We retain none of it.
• On-device data (learning records, statistics, settings, consent record): stored on the device and removed when the app is uninstalled. We do not store this on a server, except as part of a diagnostic log a parent chooses to send or feedback a user chooses to send.
• Consent record: the device-local record is kept until the app is uninstalled. If a de-identified server-side receipt of consent is kept, it is retained for no more than one year and then deleted. Such a receipt contains only the date/time of consent, the items consented to and the disclosure version, and the fact that the voice feature was enabled — never a phone number, name, or government identifier.
• Diagnostic log: kept for 90 days on our private server, then deleted automatically.
• Feedback: the comment is erased as soon as we have read it; the rating and the other items are kept for 90 days on our private server, then deleted automatically.
• Update identifier: processed by our app-update provider (Expo) to deliver app updates. We process it to deliver the app the user installed, on the basis of Article 15(1)4 of the Personal Information Protection Act (performance of the contract with the data subject).

Apart from diagnostic logs a parent chooses to send and feedback a user chooses to send, we store no information about a child on a company server, and we keep no server-side profile of any child.

7. Parental rights

As a parent or guardian, you may:

• Review the information the app handles about your child (the categories are listed in Section 3);
• Refuse further collection by turning off voice grading in Settings, by not tapping "Send diagnostics log", by not tapping "Send" in the question, or by uninstalling the app;
• Delete on-device data by uninstalling the app. The spoken answer is never retained, so there is nothing to delete after transcription.

Diagnostic logs are stored without a name or device identifier, so we cannot pick out one child's log, and they are deleted after 90 days. Feedback is stored without an account or device identifier, so we cannot pick out one person's feedback; the comment is deleted as soon as we have read it and everything else after 90 days. For any request or question, contact us at hello@gugudan.app and we will respond without undue delay.

8. Third parties and processors

We do not sell children's personal information and do not disclose it to third parties for their own purposes. Data is shared only with the service providers below, solely to operate the app:

9. Security

• Data in transit is encrypted with TLS.
• The relay is stateless and stores no audio.
• Learning records are stored on the device (and on our server only inside a diagnostic log a parent sends or feedback a user sends).
• Diagnostic logs and feedback are kept in private storage with a 90-day automatic deletion rule.
• Contact-shaped strings typed into the feedback comment box are blocked before the send and masked again on the server before anything is stored; the comment itself is erased as soon as we have read it.
• Device-integrity checks (App Check) help block abuse.
• We minimize what we collect — no account, no identifying details.

10. No tracking, ads, or analytics

The app uses no cookies, no advertising, and no analytics or crash-reporting tools. This website also uses no analytics or tracking. The automatically generated values are the device-integrity token described above, only while voice grading is on or when a parent sends a diagnostic log or a user sends feedback, and the random per-install identifier the app uses to check for updates.

11. Changes to this policy

We may update this policy as the law, our service, or our legal review changes. When we do, we will post the updated policy here with a new effective date. For any change that materially affects how we handle children's information, we will obtain parental consent where the law requires it.

• Posted September 14, 2026 (effective September 21, 2026): disclosed the diagnostic log and the update identifier; corrected the relay and transcription locations.
• Posted September 16, 2026 (effective September 23, 2026): added parent feedback after a finished quiz (replacing the September 15 draft before it took effect).
• Posted September 23, 2026 (effective September 30, 2026): the feedback sheet after a finished quiz opens without a parental step; stated that contact-shaped strings in a comment are masked and the comment is erased once read (the rating is kept 90 days); stated the lawful basis for the update identifier (performance of the contract); stated that the diagnostic-log feature exists only in our test builds.

12. Contact

MariCircuit (마리서킷) · hello@gugudan.app