Allô Lou
Privacy policy
This policy covers the Allô Lou apps for Android, iPhone and iPad, and the teacher website teach.allolou.com. In this policy, "we" means the people who make Allô Lou. Allô Lou is a learning game for children in Grades 1 to 8, used with their parents, and optionally with a teacher or tutor the parent chooses.
In short
- There are no accounts. Nobody signs up, and we never ask for a name, email, phone number or birth date.
- There are no ads, no analytics and no tracking in the app or on our websites.
- Your children's names, progress and settings stay on your own devices.
- If you choose to link your devices (Family link) or a teacher (Teachers), what travels between them is locked on your device first, and we cannot read it.
- Teachers only see a child when a parent links that child, and the parent chooses what they see.
1. What stays on your device
Everything the game knows about your family is stored on the device it runs on: the children's names and nicknames, avatars, grades and school programs, their answers and progress, points and rewards, missions, your settings and play hours, the activity log, and the Parent Code and the children's picture codes (stored only in a scrambled form called a hash). None of this is sent to us.
The app keeps a second copy of this game file in the app's own private folder, so progress survives if the system clears the app's web storage. Your phone or tablet may include the app's files in its own backups (Google or iCloud), depending on your device settings; the family code is kept out of those backups.
The Parent Area can make a backup file that you save yourself. It contains your family's progress (no family code), so keep it somewhere private.
2. Voices
Lou's recorded voice comes inside the app and in voice packs that Google Play or Apple's App Store deliver to your device, the same way they deliver the app itself. Anything without a recording is read by your device's own text to speech voice. Children's names are never sent anywhere to be read aloud.
3. Family link (optional)
Family link lets your family's devices share the same children and progress. Nothing is shared unless a parent turns it on in the Parent Area and links a second device with the family code.
- Locked before it leaves the device. Changes are encrypted on your device (AES-256-GCM) with a key made from your family code. Our server, which runs on Cloudflare, stores only these locked copies. We cannot open them, and neither can Cloudflare.
- What our server can see: a random family number made from your code, how many devices are linked (as numbers 1, 2, 3), when they sync and how much data is stored. Device names are locked too. From these we keep only totals for running the service (for example how many families use Family link and how much storage they take).
- What it cannot see: children's names, answers, progress, points, settings, the Parent Code, the family code or any key.
- Network addresses. Like any internet service, Cloudflare sees the address a device connects from while it connects. Request logs are off and we do not store addresses. To stop abuse, the number of new families is counted per address in memory only, in a scrambled form, and forgotten within an hour.
- The family code is kept in your device's secure storage (Keychain on iPhone and iPad, Keystore on Android). It is the only key to your family's data, so write it down and keep it safe.
- Lost device or leaked code. Making a new family code in the Parent Area deletes the old locked copy from our server, and the old code then reaches nothing.
- Deleting the copy on our server. Making a new family code deletes the previous copy. TODO before publishing: describe how a family deletes its last copy when it stops using Family link (see the note in docs/PLAY-CONSOLE.md).
4. Teachers and tutors (optional)
A parent can link a child to a teacher or tutor they know. Nothing is shared with a teacher unless a parent scans or types that teacher's class invite in the Parent Area, reads the consent screen, checks a 6 digit number with the teacher and agrees.
What a linked teacher can see
| Always | The child's name as the parent entered it, grade, school program and subject languages; progress by subject and skill; questions answered and right per day for 14 days; the last 20 finished levels and challenges; skills the child is struggling with; what was marked as taught; how assigned work is going. |
|---|---|
| If the parent allows (on by default, each can be turned off) | The child's answers to the last 50 questions; learning minutes per day. |
| Never | Points, the piggy bank and money, rewards, the child's nickname, play hours and family settings, the Parent Code, the activity log, other children in the family. |
What a teacher can do
Depending on the parent's switches: mark skills as taught, assign levels or their own sets of questions, give special avatar items, and send short messages. The parent sees every message and every question set. Children can only answer with a few ready made replies (such as "Thanks!" or "I need help"), never with their own text. Question sets that contain words not suitable for children are refused.
How it is protected
- Everything between a family and a teacher is encrypted end to end with keys made for that one link. Our server stores only locked copies and cannot read them.
- Teachers do not have accounts. A class is opened with a class code that only the teacher has. The teacher's name and class name are locked too.
- A parent can unlink a teacher at any time. The link's data is then deleted from our server, and the teacher no longer receives anything.
- A child's summary on the server is replaced each time, not kept as a history. Messages waiting to be delivered are deleted after 30 days.
- A class that its teacher has not opened for 30 days is deleted with all its data. A small marker saying the class was removed is kept for 90 days so linked families see why.
Like the family, the teacher keeps on their own device or browser what they received. Choose teachers you trust, as you would for any tutoring.
Question reports from teachers
Teachers can tell us about a question that has a mistake. A report contains the question's number, grade, language, the kind of problem, the teacher's note and a random class number. It is not encrypted so that we can read and fix it, and it never contains information about a student (the form asks teachers not to write any student names). We delete reports once the question is fixed.
5. The camera
The app asks for the camera only to scan a family code or a class code. You can type the code instead. Pictures are processed on the device and are not saved or sent. On Android, scanning uses Google's ML Kit, which sends Google basic technical information about the scanner (such as the device model, Android version, app version, a random installation number and how long scanning took) to measure and improve the feature, as Google describes in its ML Kit data disclosure.
6. Purchases
If the app offers purchases or a subscription, Google Play or Apple's App Store handles the payment. We never receive your card details or store account details, only what was bought.
7. Our websites
allolou.com and teach.allolou.com are simple websites with no ads, no analytics, no tracking and no cookies. On teach.allolou.com a teacher can choose to keep their class code in that browser; it is stored there in a locked form and can be removed with "Forget this computer".
8. Children's privacy
Allô Lou is made for children and their parents. We designed it so that we do not collect personal information from children at all: there are no accounts, no ads, no analytics, no chat and no way for a child to share anything with strangers. The Parent Area is protected by a Parent Code, and only a parent can link devices or teachers. We follow Canada's privacy law (PIPEDA) and the United States Children's Online Privacy Protection Act (COPPA), and the Google Play Families Policy and Apple's rules for the Kids Category.
9. Keeping and deleting information
- On your devices: uninstalling the app deletes everything on that device, apart from backups you made yourself or your device's own backups.
- Family link: unlinking a device stops it syncing. See section 3 for the copy on our server.
- Teachers: unlinking a teacher deletes that link's data from our server right away; classes unused for 30 days are deleted automatically.
- Question reports: deleted once the question is fixed.
10. Security
Everything sent over the internet uses HTTPS, and family and teacher data is also encrypted end to end inside it. Keys stay on your devices in their secure storage. Our server keeps no logs of requests.
11. Changes
If we change this policy, we will update it here and change the effective date. If a change affects what is shared, the app will tell parents before it applies.
12. Contact
Questions about privacy: TODO: contact email