1. Who we are
Nanabird is operated by Black Layers Corp., Ontario, Canada ("we"). Contact our privacy team at privacy@blacklayers.ca. We will answer within 30 days.
2. Children's privacy (COPPA, PIPEDA, Quebec Law 25, UK Children's Code)
We do not let children create accounts. A parent or guardian signs in with Apple and gives verifiable consent before a child can speak with Tilo. The parent can review the child's information, refuse further collection, and delete it at any time. We never make a child's participation depend on sharing more information than the lesson needs.
3. What we collect
| Information | From | Why | How long |
|---|---|---|---|
| Parent's Apple account identifier, and the name if Apple shares it | Sign in with Apple | To run the family account | Until the account is deleted |
| Child's nickname, buddy picture, age range, languages, reading level, interests, and who speaks the language at home (chosen from lists, never free text) | Parent, and the child in "Meet Tilo" | To personalise lessons | Until the parent deletes the child or the account |
| Voice audio while a lesson is open | The child | So Tilo can hear and answer | Not stored by us. It streams through our server to Google Cloud and is discarded when the lesson ends. |
| A running transcript of the lesson | Generated automatically | To write the parent summary | Held in memory only and deleted when the lesson ends. It is never written to disk. |
| Learning results: word scores, lesson stars, minutes, traced-letter scores, picture matches, family missions, and a one- or two-sentence lesson summary | Lessons and practice | To show progress and choose the next activity | Until the parent deletes them |
| Letter-tracing strokes | The child's finger | To score the tracing on the device | Never leave the device. Only the score is sent. |
| Consent records | The parent | To prove consent | For as long as the law requires |
| Purchases of minute packs (Apple transaction ID, product, date) and minutes used | Apple and the app | To add the minutes you bought and count talk time | While your family account exists, and as tax law requires after |
We do not collect location, contacts, photos, the advertising identifier, precise device identifiers or payment card details. Apple handles all payments.
4. Who receives information
- Google Cloud (Vertex AI), our AI provider. It receives the child's voice and lesson content during a lesson, to produce Tilo's voice and replies, under Google Cloud's data processing terms. We have configured it not to use this data to train models. Your separate consent to this is recorded before the first lesson.
- Google Cloud also hosts our servers and encrypted backups, in the United States.
- Apple, for sign-in and in-app purchases.
We do not sell or rent information and do not share it for advertising. We disclose information only if the law requires it, or to protect a child's safety.
5. Safety
Tilo is an AI and tells children so. It follows strict rules: it stays on lessons, never asks for personal details, and blocks unsafe content. If a child says something that suggests they may be at risk, Tilo gently stops, suggests finding a trusted grown-up, and we show the parent an alert. We record only the category of concern and the time, never the words.
6. Your choices and rights
- Review and change: in Nanabird Parents, under Family.
- Delete a child or delete the whole family: in Nanabird Parents, under Family. Deletion is immediate on our servers and is gone from backups within 30 days.
- Withdraw consent: contact us, or delete the family. Lessons stop.
- Residents of Canada, Quebec, the UK and the EU have rights to access, correct, delete and port their data, and to complain to their regulator. In Canada that is the Office of the Privacy Commissioner. In Quebec it is the Commission d'accès à l'information. In the UK it is the ICO.
7. Security
All connections use TLS. Tokens are stored as one-way hashes. Servers run with least-privilege accounts. Access to production is limited to named staff. We keep a written security and incident-response programme and will notify you and regulators of a breach as the law requires.
8. Changes
If we change this policy in a way that affects children's information, we will ask for your consent again in the app before it applies.
This draft was prepared for legal review before public launch.