Privacy Policy

1. Who we are

gugudan ("gugudan", the "app", "we", "us") is a voice-based multiplication-tables practice app for elementary-school children. The app is operated by MariCircuit (마리서킷), a business registered in the Republic of Korea. You can reach us at hello@gugudan.app.

This policy explains what information the app handles, with a focus on children, and how parents and guardians can exercise their rights. It is written to follow the U.S. Children's Online Privacy Protection Act (COPPA).

2. Our approach to children's data

gugudan is designed for children, so we collect as little as possible:

• There is no sign-up and no account. We do not ask for or separately collect a child's name, age, birthday, email address, phone number, contacts, location, or photos. Anything a user types into the feedback comment box after a quiz is stored as feedback, with anything shaped like a contact detail masked and the comment itself erased as soon as we have read it (Section 3.5). A message a parent sends from the Contact us screen in Settings is masked the same way and erased as soon as we reply (Section 3.6).
• The app works fully in keyboard mode, in which no audio is used.
• Information leaves the device only in six cases: the child's spoken answer, when a parent has enabled the optional voice-grading feature (Sections 4 and 5); a diagnostic log, only when a parent taps "Send diagnostics log" in Settings (Section 3.3); a star rating and a comment, only when "Send" is tapped in the question shown after a finished quiz (Section 3.5); a message to us, only when a parent taps "Send" on the Contact us screen in Settings, together with our reply to it (Section 3.6); a crash report, sent automatically the next time the app opens after it closed unexpectedly (Section 3.7); and a random per-install identifier the app uses to check for updates (Section 3.4).

3. Information we handle

3.1 Stored on the child's device

The following are stored on the device and never sent to a company server, except as part of a diagnostic log a parent chooses to send, feedback a user chooses to send or a message a parent chooses to send, or a crash report the app sends by itself (Sections 3.3, 3.5, 3.6 and 3.7). They contain no name, age, or other identifying details, and are removed when the app is uninstalled:

• Learning records (problems solved, correct/incorrect history)
• In-progress session state and per-table study statistics
• Language setting
• A consent record (the date/time of consent, the items consented to, and the disclosure version)

3.2 Handled only when voice grading is ON

• The child's spoken answer (audio). A short spoken answer to a multiplication question (for example, "twenty-one"). It is used only to convert speech to text so the app can grade the answer.
• A device-integrity token (Firebase App Check). A token used only to block automated abuse of our relay. It is not personally identifying and is generated only while voice grading is enabled, or when a parent sends a diagnostic log, a user sends feedback, or a parent sends a message or the app collects our reply to it, or the app sends a crash report.

We do not create a voiceprint, perform speaker identification or any biometric analysis, use the audio to identify the child, profile the child, or use the audio to train any model.

3.3 Sent only when a parent taps "Send diagnostics log"

• A text diagnostic log. Per-question timing records, the recognized answer text, the grading result, the device type (operating system and model name), the app and update version, the language setting, and whether voice or keyboard mode was used. It contains no name, no device identifier, and no audio. It is sent only when a parent taps the button, stored on our private server for 90 days, and then deleted automatically. This feature is present only in our test builds; it is not shown in the app downloaded from the App Store or Google Play.

3.4 Sent automatically to check for app updates

• A random per-install identifier and app version information, sent to our app-update provider (Expo) when the app checks for updates. It is not used to identify, track, or profile the child, and it is not combined with any other record of ours.

3.5 Sent only when "Send" is tapped in the question after a quiz

• Feedback. A star rating (1–5), a comment (optional, up to 300 characters), which quiz it followed (first quiz with table 2 or 3 / first quiz with a paid table / the child's recorded voice played in the quiz), the app and update version, the device type (Android/iOS), and the language setting. We do not add a name, a device identifier or learning records to it. It is used only to hear a user's view of the quiz and improve the app, and is sent only when the button is tapped. If the comment holds something shaped like a phone number or an e-mail address, the app stops the send and asks for it to be taken out, and anything that still arrives is masked as ●●● before it is stored. The comment is erased as soon as we have read it; the rating and the other items are stored on our private server for 90 days, then deleted automatically.

3.6 Sent only when a parent taps "Send" on the Contact us screen in Settings

• A message to us. The text of the message (up to 500 characters), the app and update version, the device type (Android/iOS), and the language setting. We do not add a name, a device identifier or learning records to it. It is used only to answer the parent's question and improve the app, and is sent only when the button is tapped. The Contact us screen opens only after an adult check (an arithmetic question). If the message holds something shaped like a phone number or an e-mail address, the app stops the send and asks for it to be taken out, and anything that still arrives is masked as ●●● before it is stored. So that our reply can be collected only by the device that sent the message, the app keeps one random value per message on the device; our server stores only a one-way transformed copy of that value. A new value is made for every message, the values are not linked to one another, and each is used only to collect the reply. The message is erased as soon as we reply, and our reply is erased from our server as soon as the app has received it; a message we have not replied to, or a reply the app has not collected, is deleted automatically after 90 days. The message and the reply stay on the device until the app is uninstalled.

3.7 Sent automatically when the app has closed unexpectedly

• A crash report. If the app closes unexpectedly, the next time it is opened it sends us: the kind of closure (a JavaScript error / an abnormal exit), the error message and where it occurred (the code line), the app's own activity steps just before the closure (such as a sound starting or voice recognition starting), the device type (operating system, OS version and model name), the app and update version, and when the closed run had started. It contains no name, no device identifier, no audio, no recognized answer text and no learning records. Anything shaped like a phone number or an e-mail address in the error text is masked as ●●● before it is stored. It is sent whether or not voice grading is on, goes only to our own server (no third-party crash-reporting service), is kept on our private server for 90 days, and is then deleted automatically. There is no setting to turn it off.

4. How the spoken answer is processed

When voice grading is on, the child's spoken answer is sent over an encrypted (TLS) connection through Cloudflare, which only directs the request to the nearest gugudan relay server, then to gugudan's own relay server (operated by MariCircuit on Google Cloud, in the United States for users in the United States and otherwise in Japan) and then to Google Cloud Speech-to-Text for transcription only, in the United States for users in the United States and otherwise in the region nearest the user.

• The audio is processed ephemerally — held in memory only for as long as it takes to transcribe the answer in real time.
• It is deleted immediately after transcription. Our relay is stateless and stores no audio on disk, in logs, or in any database, and the transcription service is configured not to retain, log, or train on the audio.
• There is no behavioral advertising, profiling, or tracking at any point.

5. The optional voice feature and parental consent

Voice grading is off by default and is a setting a parent turns on. When it is on, the voice feature sends only the child's short spoken answer, used solely to convert speech to text so the app can grade it (Sections 3.2 and 4).

Under COPPA, a child's audio that is collected solely as a replacement for the written answer, used only for that purpose, not used to identify the child, and deleted immediately after it is converted to text may be handled without separate verifiable parental consent — the COPPA "audio file" exception. gugudan is built to meet these conditions: the spoken answer stands in for the written one, is used only for transcription, is never used to create a voiceprint or to identify or profile the child, and is deleted immediately after transcription (Sections 3.2, 4, and 6).

A parent stays in control at all times:

• The feature is off until a parent turns it on, and the app is fully usable in keyboard mode without it.
• A parent can withdraw at any time by turning voice grading off in the app's Settings, which stops any further transfer of the spoken answer immediately.

If we ever change the voice feature so that this exception no longer applies, we will obtain verifiable parental consent before that change takes effect.

6. Retention and deletion

Our data-retention policy is to keep as little as possible, for as short a time as possible:

• Spoken answer (audio): deleted immediately after transcription. We retain none of it.
• On-device data (learning records, statistics, settings, consent record): stored on the device and removed when the app is uninstalled. We do not store this on a server, except as part of a diagnostic log a parent chooses to send, feedback a user chooses to send or a message a parent chooses to send, or a crash report the app sends by itself.
• Consent record: the device-local record is kept until the app is uninstalled. If a de-identified server-side receipt of consent is kept, it is retained for no more than one year and then deleted. Such a receipt contains only the date/time of consent, the items consented to and the disclosure version, and the fact that the voice feature was enabled — never a phone number, name, or government identifier.
• Diagnostic log: kept for 90 days on our private server, then deleted automatically.
• Feedback: the comment is erased as soon as we have read it; the rating and the other items are kept for 90 days on our private server, then deleted automatically.
• Messages and replies: a message a parent sends is erased as soon as we reply, and our reply is erased from our server as soon as the app has received it; anything left is deleted automatically after 90 days.
• Crash report: kept for 90 days on our private server, then deleted automatically.
• Update identifier: processed by our app-update provider (Expo) to deliver app updates. We process it to deliver the app the user installed, on the basis of Article 15(1)4 of the Personal Information Protection Act (performance of the contract with the data subject).

Apart from diagnostic logs a parent chooses to send, feedback a user chooses to send, messages a parent chooses to send and crash reports the app sends by itself, we store no information about a child on a company server, and we keep no server-side profile of any child.

7. Parental rights

As a parent or guardian, you may:

• Review the information the app handles about your child (the categories are listed in Section 3);
• Refuse further collection by turning off voice grading in Settings, by not tapping "Send diagnostics log", by not tapping "Send" in the question or on the Contact us screen, or by uninstalling the app;
• Delete on-device data by uninstalling the app. The spoken answer is never retained, so there is nothing to delete after transcription.

Diagnostic logs are stored without a name or device identifier, so we cannot pick out one child's log, and they are deleted after 90 days. Feedback is stored without an account or device identifier, so we cannot pick out one person's feedback; the comment is deleted as soon as we have read it and everything else after 90 days. A message sent from the Contact us screen is stored without an account or device identifier and is deleted as soon as we reply (after 90 days if we do not). A crash report is sent only after the app has closed unexpectedly; it is stored without an account or device identifier, so we cannot pick out one device's report, and it is deleted after 90 days. For any request or question, contact us at hello@gugudan.app and we will respond without undue delay.

8. Third parties and processors

We do not sell children's personal information and do not disclose it to third parties for their own purposes. Data is shared only with the service providers below, solely to operate the app:

9. Security

• Data in transit is encrypted with TLS.
• The relay is stateless and stores no audio.
• Learning records are stored on the device; what reaches our server is only a diagnostic log a parent sends, feedback a user sends, a message a parent sends with our reply to it, or a crash report the app sends by itself.
• Diagnostic logs, feedback, messages and crash reports are kept in private storage with a 90-day automatic deletion rule.
• Contact-shaped strings typed into the feedback comment box or a message are blocked before the send and masked again on the server before anything is stored; the comment itself is erased as soon as we have read it, and a message as soon as we reply. The error text in a crash report is masked the same way on the server.
• Device-integrity checks (App Check) help block abuse.
• We minimize what we collect — no account, no identifying details.

10. No tracking, ads, or analytics

The app uses no cookies, no advertising, and no third-party analytics or crash-reporting services; a crash report goes only to our own server (Section 3.7). This website also uses no analytics or tracking. The automatically generated values are the device-integrity token described above, only while voice grading is on or when a parent sends a diagnostic log, a user sends feedback, or a parent sends a message or the app collects our reply, or the app sends a crash report, and the random per-install identifier the app uses to check for updates.

11. Changes to this policy

We may update this policy as the law, our service, or our legal review changes. When we do, we will post the updated policy here with a new effective date. For any change that materially affects how we handle children's information, we will obtain parental consent where the law requires it.

• Posted September 14, 2026 (effective September 21, 2026): disclosed the diagnostic log and the update identifier; corrected the relay and transcription locations.
• Posted September 16, 2026 (effective September 23, 2026): added parent feedback after a finished quiz (replacing the September 15 draft before it took effect).
• Posted September 23, 2026 (effective September 30, 2026): the feedback sheet after a finished quiz opens without a parental step; stated that contact-shaped strings in a comment are masked and the comment is erased once read (the rating is kept 90 days); stated the lawful basis for the update identifier (performance of the contract); stated that the diagnostic-log feature exists only in our test builds.
• Posted September 28, 2026 (effective October 5, 2026): added Cloudflare, Inc., which directs each request to the nearest relay server; changed the relay server's location from Japan to the United States for users in the United States and otherwise Japan.
• Posted September 30, 2026 (effective October 7, 2026): added the Contact us screen in Settings, where a parent can send us a message and read our reply (it opens only after an adult check; the message is erased as soon as we reply and the reply as soon as the app has received it); disclosed the random per-message value used to collect the reply.
• Posted October 2, 2026 (effective October 9, 2026): added the crash report the app sends by itself the next time it opens after closing unexpectedly (the error message and location, the app's own activity steps just before the closure, device type, app version; kept 90 days; no audio, recognized answer text or learning records; no third-party service; no setting to turn it off).

12. Contact

MariCircuit (마리서킷) · hello@gugudan.app