Privacy Policy

Head and Preamble

CoFlows Limited (hereinafter referred to as “we,” “us,” or “our”) operates the LoroBuddy mobile application and related services (hereinafter collectively referred to as the “Services”). This Privacy Policy (hereinafter referred to as the “Policy”) describes how we collect, use, store, protect, share, and otherwise process information when you and your child use the Services.

We are a company incorporated under the laws of the Hong Kong Special Administrative Region (hereinafter referred to as “Hong Kong”). We are committed to protecting the privacy of children and families and to handling information in compliance with applicable data protection laws, including but not limited to the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong, the Children’s Online Privacy Protection Act of the United States (“COPPA”), the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the United Kingdom GDPR (including Article 8 concerning children’s consent, “GDPR-K”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”) and the California Age-Appropriate Design Code, and other applicable legislation in the jurisdictions in which we operate.

LoroBuddy is a reading and learning application designed for children (recommended for ages 2–12) and the parents and guardians who care for them. Because the Services are directed to children, we have built them to be privacy-protective by design and to collect as little information as possible.

It shall be specially noted that LoroBuddy is designed with an on-device processing architecture. The core functions of the Services — including optical character recognition (scanning a printed page), text-to-speech (reading aloud), speech recognition for reading practice, and offline voice command recognition — are performed entirely on your device. Under normal circumstances, your child’s camera images, drawings, voice recordings, audio, scanned text, and family messages are not transmitted to our servers or to any third party. Such content is stored locally on the device and, where you grant the relevant permission, in the device’s own photo gallery.

The one exception is an optional feature that a parent may choose to switch on: Practise-mode AI scoring in Book Mode. This feature is off by default and works only if a parent enters their own third-party AI provider (Groq) API key in the Settings, behind the parental gate. When, and only when, it is enabled, the Services send a small amount of text — the sentence the child was asked to read and the on-device speech recognizer’s transcript of what the child said, together with the content language — directly to the parent’s chosen AI provider to generate an encouraging score. No audio recording, image, name, email, or device identifier is ever sent. Story mode and all other features never use this. This is described in detail in Section II.v below.

Please read this Policy carefully. The Services are intended to be set up and supervised by a parent or guardian. By downloading, installing, accessing, or allowing a child to use the Services, the supervising adult acknowledges that they have read, understood, and agreed to this Policy. If you do not agree with any part of this Policy, please cease using the Services and uninstall the application from your device.

I. Definitions

For the purposes of this Policy, the following terms shall have the meanings set forth below:

• “Personal Information” or “Personal Data” means any information relating to an identified or identifiable natural person, including but not limited to name, email address, device identifiers, and online identifiers. Under COPPA it also includes persistent identifiers used to recognise a user over time and across services.
• “Child” means a user under the age of 13 (or such higher age as may apply in your jurisdiction, for example under 16 in parts of the European Economic Area).
• “Parent” or “Guardian” means the adult who downloads, configures, supervises, and is responsible for a Child’s use of the Services.
• “On-Device Processing” means the processing of data entirely on the user’s device without transmitting such data to any external server, cloud service, or third party.
• “Sensitive Permissions” means device permissions that grant access to potentially sensitive resources, including camera access, microphone access, and access to the device’s photo library or media storage.
• “Entitlement” means the record of whether a device has an active ad-free subscription, used to unlock the corresponding features.
• “AI Provider” means the third-party artificial-intelligence service (currently Groq, Inc.) that a parent may optionally connect, using their own account and API Key, to power Practise-mode scoring. LoroBuddy does not operate this service and does not maintain an account with it on your behalf.
• “API Key” means the secret credential a parent obtains from the AI Provider and enters into the Services to enable Practise-mode scoring. It is supplied by the parent, stored only in the device’s secure credential storage (Keychain / Keystore), and may be removed at any time.
• “Practise-Mode Scoring” means the optional feature that listens to a child read a sentence aloud, transcribes it on-device, and sends that text to the parent’s AI Provider to return an encouraging, approximate score. It is disabled unless a parent enables it.

II. How We Collect and Use Information

i. Overview

We adhere to the principle of data minimisation. The Services do not require an account, do not ask a child to provide personal details, and are engineered so that the content your child creates stays on your device. We collect information only to the limited extent described below.

ii. Information You Provide Directly

(1) Support Communications. If a parent or guardian contacts us for support or feedback, we receive the information provided in that communication, such as an email address and the content of the message. We ask that you do not include a child’s personal information in support correspondence.

(2) On-Device Content and Preferences. Your application settings, dictation and word lists, reading preferences, rewards and progress, and the drawings, recordings, photos, and messages created within the Services are stored locally on your device (using local storage and, for some items, the device’s photo gallery). These data are not transmitted to our servers.

(3) Purchase Information. If you purchase the ad-free subscription, the transaction is processed by your application store provider (Apple App Store or Google Play Store). We receive a purchase receipt and Entitlement status from the store provider to verify your subscription and unlock features. We store Entitlement data locally on your device. We do not receive or store your payment card details, billing address, or other financial information.

(4) AI Provider API Key (Optional). If a parent chooses to enable Practise-mode scoring, they enter an API Key obtained from their own AI Provider (Groq) account. This key is stored only in your device’s secure credential storage and is used solely to authenticate requests that your device makes directly to the AI Provider. We do not transmit the key to our servers, and we never see or store it centrally. You can remove the key at any time in the Settings, which disables the feature.

iii. Information Collected Automatically

(1) Device Information. We may process limited device-level information, such as device model, operating system version, application version, and language or locale settings, for the purpose of ensuring compatibility, delivering the correct voice and language model files, and operating the Services. Such information is processed in anonymised or aggregated form.

(2) Advertising Data (Free Tier). When the Services are used without an active subscription, they display banner advertisements served by Google AdMob. Because the Services are directed to children, AdMob is configured for child-directed treatment and serves only non-personalised, contextual advertisements. We do not use advertising identifiers to build advertising or behavioural profiles of children, and we do not permit interest-based or personalised advertising to children. AdMob processes a limited set of data necessary to serve, cap, and measure non-personalised ads and to prevent fraud, in accordance with Google’s Families policies.

(3) No Analytics or Tracking. The Services do not integrate third-party analytics, advertising attribution, crash-reporting, or behavioural tracking software development kits. We do not track your child across other apps or websites.

iv. Information We Do Not Collect

To make the scope of our practices clear, we expressly declare that we do not collect, store, or transmit the following:

• Camera images and scanned pages. Optical character recognition is performed on-device. Images captured by the camera or selected from the gallery for scanning are processed in device memory and are not stored on, or transmitted to, our servers.
• Microphone audio. Voice command recognition and reading-practice speech recognition are performed on-device, and the audio is discarded immediately after processing. Voice messages your child records are saved locally on your device (and, with permission, your gallery). No microphone audio is ever uploaded to us or to any third party. (If a parent enables the optional Practise-mode scoring, only the on-device text transcript — not the audio — is sent to the parent’s AI Provider; see Section II.v.)
• Drawings, photos, and family messages. Content created in the messages feature is stored on your device and, where you grant media permission, saved to the device’s own photo gallery so it is not lost if the app is reinstalled. It is never transmitted to us or shared by us with any third party.
• Precise location. We do not collect GPS or other precise geolocation data.
• Contacts, call logs, or messages. We do not access your device’s contacts, call history, or SMS.
• Biometric data. We do not perform facial recognition, voiceprint analysis, or any biometric identification. On-device speech recognition transcribes words only and does not create or store biometric templates.
• Personalised advertising profiles of children. See Section II.iii(2) and Section VII.

v. Optional Practise-Mode AI Scoring

Book Mode includes an optional “Practise” mode in which a child reads a sentence aloud and receives a gentle, encouraging score. This is the only feature that sends any content a child produces to a third party, and it operates under the following strict conditions:

• Off by default; parent-activated. The feature does nothing unless a parent obtains their own API Key from the AI Provider (Groq) and enters it in the Settings, which are protected by the parental gate. Story mode and every other part of the Services never use it.
• Only text is sent — never audio. Your device transcribes the child’s speech on-device using the operating system’s speech recognizer. Only the resulting text (the target sentence and the transcript of what was said) and the content language are sent. The microphone audio itself never leaves the device.
• No identifiers. The request contains no name, email, account, device identifier, or advertising identifier. Nothing in what is sent is designed to identify your child, and we do not attach any profile to it.
• Sent directly, using your own key. The request goes directly from your device to the AI Provider, authenticated with the parent’s own API Key. It does not pass through, and is not stored on, any LoroBuddy server — we operate no account with the AI Provider on your behalf and never receive the content that is sent.
• Governed by the AI Provider’s terms. Because the request uses the parent’s own account, the AI Provider (Groq) processes it under its own privacy policy and terms, which the parent accepts when creating their key. We encourage parents to review Groq’s privacy policy at groq.com/privacy-policy before enabling the feature. LoroBuddy does not control the AI Provider’s retention or use of data.
• Easily disabled. A parent can turn the feature off at any time by removing the API Key in the Settings; no further text will be sent thereafter.

III. Third-Party Services

We engage only the following third-party providers in the operation of the Services:

• Google AdMob — to serve non-personalised, child-directed banner advertisements on the free tier. Google’s privacy policy is available at policies.google.com/privacy.
• Apple App Store / Google Play Store — for application distribution, updates, and in-app purchase transaction processing. These providers receive standard distribution data and purchase receipts under their own policies.
• Content delivery for model files — voice and language model files used for on-device reading and recognition may be downloaded over a secure connection from our content delivery network or the platform’s services. These requests do not include your child’s content or personal information.
• Groq, Inc. (optional AI Provider) — engaged only if a parent enables Practise-mode scoring and supplies their own Groq API Key. In that case your device sends the target sentence and on-device transcript text (no audio, no identifiers) directly to Groq to generate a score. Groq processes this under the parent’s own account and its own policies, available at groq.com/privacy-policy. If the feature is not enabled, no data is sent to Groq.

We do not sell, rent, lease, or trade personal information to any third party, and we do not permit any third party to use children’s information for their own purposes. We require our providers to handle data only as necessary to provide their service and in accordance with applicable law.

IV. Device Permissions and Sensitive Features

The Services request certain device permissions only at the time the related feature is used, with an explanation of why the permission is needed. You may decline or later revoke any permission in your device settings; some features may then be unavailable.

i. Camera

Used to scan a printed page, book, or worksheet so that Loro can read it aloud. Images are processed on-device for text recognition and are not stored or transmitted by us.

ii. Microphone

Used to record voice messages for the family, to operate offline voice commands, and — in Book Mode’s Practise mode — to let a child read a sentence aloud. Audio is processed on-device only. If a parent has enabled the optional Practise-mode scoring, the on-device text transcript (not the audio) is sent to the parent’s AI Provider, as described in Section II.v.

iii. Photos and Media Library

Used to attach a photo to a family message and to save your child’s drawings, recordings, and photos to your device’s gallery so they survive reinstalling the app. We access only the items you choose, and saved media remains under your control.

iv. Notifications

If you enable them, notifications are used for gentle, optional reminders. They are not required to use the Services.

V. Data Retention

On-device content (settings, lists, drawings, recordings, photos, messages, progress) is retained on your device until you delete it within the application or uninstall the app. Media you have saved to your device gallery remains there until you remove it, even after uninstalling.

The AI Provider API Key (if you enable Practise-mode scoring) is retained in your device’s secure credential storage until you remove it in the Settings or uninstall the app.

Third-party data handled by Google (AdMob), the app stores, and — only where you have enabled Practise-mode scoring — the AI Provider (Groq) is retained according to their respective policies. We do not maintain a central database of your child’s personal information, and therefore hold no such records to retain.

VI. Data Security

Because content is processed and stored on your device, your information benefits from the security controls of your device and operating system. Entitlement data is held in encrypted local storage, and network requests for model files are made over encrypted (HTTPS) connections. No method of storage or transmission is completely secure; however, by minimising what we collect and keeping content on-device, we substantially reduce privacy and security risk.

VII. Children’s Privacy

LoroBuddy is intended for children, and we take children’s privacy seriously. The Services are designed to comply with COPPA, the GDPR/GDPR-K (including Article 8), the California Age-Appropriate Design Code, and other applicable children’s privacy laws.

We do not knowingly collect personal information from children. By design, the Services do not require an account, do not ask a child for name, email, phone number, or other contact details, and process the content a child creates entirely on the device.

No behavioural advertising to children. Advertisements on the free tier are non-personalised and child-directed. We do not use persistent identifiers to build advertising profiles of children or to serve interest-based ads, and we do not disclose children’s information to third parties for advertising purposes.

Parental controls and the parental gate. Setup and purchases are intended to be performed by a parent or guardian. A parental gate (an adult-only challenge) protects in-app purchases, the AI Provider settings, and any links that would leave the child-safe area of the app, so that children cannot make purchases, enable cloud features, or navigate away without an adult.

Optional AI scoring and parental consent. The optional Practise-mode scoring (Section II.v) is the only feature that sends a child’s content to a third party, and it is disabled unless a parent deliberately enables it from behind the parental gate using their own AI Provider account and key. Only text (never audio) and no identifying information are sent. By enabling the feature the parent or guardian both provides consent for this limited processing and accepts the AI Provider’s own terms. A parent can withdraw that consent at any time by removing the key. We recommend enabling this feature only where a parent is comfortable with the AI Provider’s practices.

Parental rights and control. Because a child’s content is stored on your device, a parent or guardian can at any time review it within the app, delete any item, stop further creation of content, or remove all of it by uninstalling the application. Given the limited, on-device nature of our processing, no personal information is collected from a child that would require separate verifiable parental consent for non-exempt purposes; where any consent is appropriate, the parent or guardian who configures and operates the Services provides it. If you have questions or wish to exercise these rights with our help, contact us using Section XI.

If you believe a child has provided us with personal information (for example, within a support email), please contact us and we will promptly delete it.

VIII. Regional Privacy Rights and Compliance

i. European Economic Area and United Kingdom — GDPR

Our legal bases for the limited processing described above are: the performance of the Services you request and our legitimate interests in operating, securing, and supporting them; and, where required, consent. For children, we rely on the authority of the parent or guardian under Article 8. You have the rights of access, rectification, erasure, restriction, objection, and data portability, exercisable as described in Section VII (most data is on your device and within your direct control). You may also lodge a complaint with your local supervisory authority.

ii. United States — COPPA and CCPA/CPRA

Consistent with COPPA, we provide this notice of our practices, limit collection from children, and give parents control over their child’s content. Consistent with the CCPA/CPRA and the California Age-Appropriate Design Code, we disclose the categories of information involved (device and advertising data as described above) and confirm that we do not “sell” or “share” personal information as those terms are defined, and in particular never sell or share the personal information of children. California residents may exercise the rights to know, delete, and opt out, and will not be discriminated against for doing so.

iii. Hong Kong — Personal Data (Privacy) Ordinance

We handle personal data in accordance with the Data Protection Principles of the Personal Data (Privacy) Ordinance (Cap. 486), including in relation to purpose, use, security, and access and correction.

iv. Other Jurisdictions

Where other data protection laws apply (such as Brazil’s LGPD or Canada’s PIPEDA), we comply with their applicable requirements. Some features or advertising behaviour may differ by region or platform to meet local legal requirements.

IX. International Data Transfers

We are based in Hong Kong. The limited third parties we rely on (Google and the app store providers) operate globally and may process data in countries other than your own. If a parent enables the optional Practise-mode scoring, the AI Provider (Groq, Inc.) is based in the United States and will process the text sent to it there. Where such transfers occur, they are governed by those providers’ own safeguards and contractual mechanisms (such as standard contractual clauses) as applicable.

X. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will revise the version number and effective date above and, where appropriate, provide additional notice within the application. Your continued use of the Services after an update takes effect constitutes acceptance of the revised Policy.

XI. Contact Us

If you have any questions, concerns, or requests regarding this Policy or your child’s privacy, please contact us:

CoFlows Limited (Hong Kong)
Email: hello@lorobuddy.com

XII. Miscellaneous

This Policy is published in English, which is the governing language; any translation is provided for convenience only. If any provision of this Policy is held to be invalid or unenforceable, the remaining provisions shall continue in full force and effect. Headings are for convenience only and do not affect interpretation.