Privacy Policy: Glovoy Words

Glovoy ("we", "us", "our") is operated by TecEnc, a sole proprietorship registered under the Udyam MSME scheme, India. This policy covers Glovoy Words, our vocabulary-learning app for Grade 1-6 children preparing for English olympiads and spell-bee competitions. For the umbrella Glovoy policy that covers our sibling products, see glovoy.com/privacy.

Glovoy Words is designed for parents to help their children build a daily vocabulary habit through short spaced-repetition sessions. The parent gives consent and sets up the profile; the child then uses the app under parental supervision.

1. What Data We Collect

Account & Profile Data

• Anonymous sign-in via Firebase Authentication. No email, phone, or password is collected at sign-up. A random anonymous user ID is created on the device the first time the app is opened.
• Child's first name (display only, shown as a greeting on the home screen)
• Grade level (1, 2, 3, or 4)
• Timestamp of the parental DPDP-consent tick during onboarding (legal audit trail)
• No date of birth, photograph, address, or sensitive personal information

Learning & Usage Data

• Which words the child has been introduced to and which Leitner "box" each word is currently in (Learning, Getting it, Got it, Locked in, Mastered)
• Per-word correct/incorrect counts and the date each word was last reviewed
• Daily-session completion records (date, words seen, correct count, total)
• Practice-test sessions (the 20 questions served, the answers given, score, time taken)
• Current streak (consecutive days a session was completed)

Technical Data (automatic)

• Device type and operating system version
• App version and build flavour (staging or production)
• Crash reports via Firebase Crashlytics (file/line/stack only, no personal data in breadcrumbs; this is enforced in our codebase)
• Session timestamps for streak calculation

Payment Data

We do not process payments directly. If you upgrade to Premium, subscription is managed by Apple App Store (iOS) or Google Play Store (Android), with RevenueCat handling entitlement state. We receive only your subscription status (active / inactive), not your card details, name, or billing address.

2. Why We Collect It

We do not:

• Sell your data to any third party
• Use your child's data for advertising; Glovoy Words is ad-free by design
• Track behaviour across other apps or websites
• Use your data to train AI or machine-learning models
• Show third-party content or ads in the app (Apple App Store Kids Category compliance, BRD §3.10)
• Collect IDFA (iOS) or Advertising ID (Android); these are explicitly disabled in our Firebase Analytics configuration

3. Children's Data: Special Provisions

India: Digital Personal Data Protection Act 2023 (DPDP Act)

Under DPDP §9 (processing children's data), we apply the following safeguards:

• Verifiable parental consent is captured during onboarding via an explicit consent screen before any child data is stored. The consent timestamp is recorded on the child's profile document.
• We collect the minimum data necessary to provide the service (per the data-minimisation principle in DPDP §8(7)).
• We do not engage in tracking, behavioural monitoring, or targeted advertising of children, all prohibited under DPDP §9(3).
• A parent or legal guardian may erase all of their child's data at any time, either via Settings → Delete all my data in the app (server-side erasure in seconds via our F7 Cloud Function) or by emailing privacy@glovoy.com with a 30-day action SLA.

If you are a parent and believe your child used this app without your knowledge, contact us immediately at privacy@glovoy.com and we will delete their data.

International Users: COPPA Notice

For users accessing this app from the United States: Glovoy Words is intended for children under 13 and we comply with the Children's Online Privacy Protection Act (COPPA). The same data-minimisation safeguards apply; parents may review, correct, or delete their child's data at any time using the in-app deletion flow or the email channel above.

App Store Kids Category compliance

Glovoy Words is listed in the Apple App Store Kids Category (age band 6-8) and complies with Apple's Kids-Category requirements: no third-party advertising, no third-party analytics (we use Firebase Analytics with IDFA and Google Signals disabled), and no purchases without parental authentication. A parental gate (math question) is required before any out-of-child-surface action, including the paywall and Settings entry.

4. How We Store Your Data

• All data is stored in Google Firebase (Firestore + Storage), operated by Google LLC, on servers in the India (asia-south1) region.
• Firebase Security Rules ensure that anonymous user IDs can only read and write their own data. No user can access another user's records.
• Pre-generated audio files for vocabulary words are served from Firebase Storage and require authentication to access.
• All data in transit is encrypted via HTTPS / TLS.

5. Third-Party Services

Audio files are generated server-side before being uploaded to Firebase Storage. The child's device only ever talks to Firebase; it never sends data to ElevenLabs directly.

6. Data Sharing

We do not share your personal data with any third parties except:

• The service providers listed in Section 5 (only to the minimum extent needed to provide the service)
• If required by law, court order, or government authority in India or applicable jurisdictions
• In the event of a business acquisition (you will be notified by in-app banner and given the option to delete your data before any transfer takes effect)

7. Your Rights

Under the DPDP Act 2023 (§§11-13) and applicable law, you have the right to:

• Access: request a copy of all data we hold about your child
• Correction: request correction of inaccurate data (e.g., child's name or grade)
• Erasure (DPDP §11): request deletion of your child's profile and all associated data. The fastest path is in-app: Settings → Delete all my data, which deletes everything server-side in seconds. Alternatively, email us with a 30-day action SLA.
• Withdraw consent: at any time by using the in-app deletion flow; withdrawal does not affect the lawfulness of processing before withdrawal
• Grievance redressal: file a complaint with the Data Protection Board of India if you believe your rights have been violated

To exercise any of these rights by email, write to privacy@glovoy.com with subject line: Privacy Request: Glovoy Words. Please include the date you first installed the app and your child's first name so we can locate the anonymous user record.

8. Data Retention

Why no auto-expiry on learning data: spaced-repetition only works if review history persists across years. A word the child mastered in Grade 2 still informs which words appear in Grade 3 revision. Auto-deletion would defeat the pedagogic purpose. You retain full control via the deletion flow described in Section 7.

9. Security

• Firebase Authentication with secure anonymous-session token management
• Firestore Security Rules: users can only access their own data; default-deny on any path not explicitly allowed
• Cloud Storage Security Rules: admin-only writes; authenticated read on audio and image assets
• All data transmitted over HTTPS / TLS
• No passwords stored by us; anonymous auth means there is no password to store
• Firebase App Check protects against API abuse from non-genuine app instances

10. Changes to This Policy

We will notify you of material changes by:

• Displaying an in-app notice the next time you open the parent dashboard
• Updating the "Last updated" date at the top of this page

Continued use of the app after such notice constitutes acceptance.

11. Contact and Grievance Redressal

Data Controller

• Entity: TecEnc (sole proprietorship, Udyam MSME)
• Address: Mumbai, Maharashtra, India
• Email: privacy@glovoy.com

Grievance Officer (DPDP Act 2023)

In accordance with Rule 13 of the Digital Personal Data Protection Act 2023, the following contact is designated for data-protection grievances regarding Glovoy Words:

• Grievance Officer: Glovoy (TecEnc)
• Email: grievance@glovoy.com
• Acknowledgement: within 48 hours of receipt
• Resolution: within 30 days

If you are not satisfied with our response, you may approach the Data Protection Board of India once it is constituted under the DPDP Act 2023.

---

Looking for the umbrella Glovoy policy that covers our sibling apps (Glovoy Math, etc.)? See glovoy.com/privacy.