CantoDuck is a Cantonese learning app for young children (ages 3โ5), designed to be used together by a parent and child. We built it around one principle: a child can use everything in CantoDuck without any account, and we collect as little as possible. We show no advertising of any kind, we do not sell data, and we do not track anyone across other apps or websites. We collect only anonymous, aggregate usage statistics (e.g. "the Transport chapter was opened 120 times today") with all advertising features disabled.
The short version for busy parents
- No account needed to play. All learning progress is stored on your device by default. If you never create an account, no progress data leaves your device.
- The microphone is used for one thing: hearing your child say a Cantonese word so the duck can cheer. Speech is converted to text by Apple's speech recognition service, which may process the audio on Apple's servers. We never receive, store, or keep any recording of your child's voice from this feature.
- Accounts are for parents only, protected by a parental gate. An account exists so a family can back up learning progress and use one purchase on several devices.
- No ads. No selling of data. No cross-app tracking. Ever. We keep anonymous counts of which activities get used so we know what to improve โ these are never linked to you or your child.
- You can delete your account and all synced data inside the app at any time (Parent corner โ Family account โ Delete account & data), or by emailing hello@cantoduck.com.
What we collect, and why
If you don't create an account (the default)
No personal information is collected. We receive only anonymous usage statistics via Google Analytics for Firebase โ which screens and chapters are used and standard device categories (e.g. "iPad, iOS 26") โ with every advertising-related signal disabled at the code level, no advertising identifiers (the ad-tracking framework is not even compiled into the app), and no user IDs attached. Learning progress (which words your child has heard, matched, echoed, or traced) and any voice notes you record for your child are stored only on your device. Deleting the app deletes them.
Voice, during Echo practice
When your child repeats a word in Echo mode, the device microphone is active and the audio is processed by Apple's speech recognition service (SFSpeechRecognizer) to check whether the word was said. Because Apple does not currently offer on-device Cantonese recognition, the audio may be sent to Apple's servers for processing, under Apple's own privacy terms (iOS asks for your permission for exactly this the first time). What we get back is only text, which is compared against the target word and immediately discarded. We do not receive, store, transmit, or retain any audio, and no voice data is ever linked to an account by us.
Parent voice recordings (where you record your own pronunciation for your child) are stored on the device only and are never uploaded.
If a parent creates a family account (optional)
Account creation sits behind a parental gate (a challenge a young child cannot pass) and uses Sign in with Apple or Google Sign-In. We then store:
| Data | Where | Why |
|---|---|---|
| Account identifier (a random user ID from Apple/Google sign-in) | Google Firebase (Authentication) | To know which family a progress backup belongs to |
| Email address, if your sign-in provider shares one (Apple's "Hide My Email" is fully supported โ we never require a real email) | Google Firebase (Authentication) | Account recovery only; we do not send marketing email |
| Child profile nickname and avatar choice | Google Firebase (Cloud Firestore) | To label progress per child. Please use a nickname, not a full real name |
| Learning progress (which words have been completed in each activity) | Google Firebase (Cloud Firestore) | Backup and sync across your devices |
| Purchase and subscription status | RevenueCat, Apple App Store / Google Play | To unlock Premium on all your devices and handle restores/refunds |
That is the complete list. We collect no location, no contacts, no photos, no device fingerprinting, and no advertising identifiers. Usage statistics are anonymous and are never joined to your account or your child's profile.
Third parties we use
We share data only with the service providers below, only because the service cannot work without them (they are integral to providing CantoDuck), and never for advertising or marketing:
- Apple Inc. โ speech recognition during Echo practice; Sign in with Apple; App Store payments. apple.com/privacy
- Google LLC (Firebase) โ sign-in authentication, the database that stores your family's learning progress, and anonymous usage statistics (Google Analytics for Firebase, with ads features disabled and a 14-month retention setting). firebase.google.com/support/privacy
- RevenueCat, Inc. โ subscription/purchase management (receives a random user ID and store transaction data; never your child's data). revenuecat.com/privacy
We do not disclose personal information to any other third party, we do not permit these providers to use the data for their own advertising, and we will never disclose children's personal information for targeted advertising.
Children's privacy (COPPA / GDPR-K)
CantoDuck is used by children with their parents. We designed it so that:
- A child cannot create an account, make a purchase, or reach any commerce or data-collection surface โ these all sit behind a parental gate.
- The only child-related data we ever store on our servers (nickname, avatar, learning progress) is created by the parent, under the parent's account, which acts as the parent's consent and remains under the parent's control.
- We collect no persistent identifiers from a child playing without an account, and we never use children's data for advertising, profiling, or any purpose other than showing their learning progress.
Parents may review, download, or delete their family's data at any time โ see "Your controls" below. If you believe a child has provided us information outside these design boundaries, contact hello@cantoduck.com and we will delete it.
Data retention
- On-device data: kept until you delete the app or clear its data.
- Synced progress and profiles: kept while the account exists, so the service can do what you created the account for.
- Account deletion: removes the Firebase account and all synced profiles and progress immediately; we ask RevenueCat to disassociate the account identifier. Store purchase records are retained by Apple/Google under their own policies (we cannot delete an App Store receipt).
- We do not keep children's personal information longer than necessary for the purpose the parent provided it, and we never retain it indefinitely.
Security
Data in transit is encrypted (TLS). Synced data is stored in Google Firebase with access rules that allow only your signed-in account to read or write your family's data. We maintain a written information security programme appropriate to the small amount of data we hold.
Your controls
- Delete everything (in-app): Parent corner โ Family account โ Delete account & data. This is immediate and permanent.
- Sign out: stops any further syncing; the device keeps working locally.
- Microphone: can be revoked any time in iOS Settings โ CantoDuck. Echo mode simply becomes unavailable; everything else keeps working.
- Email us at hello@cantoduck.com for: a copy of your family's data (portability), correction, deletion, or any privacy question. We respond within 30 days.
Regional rights
- EU / UK (GDPR & UK GDPR): our legal bases are performance of a contract (providing sync you asked for) and legitimate interests (app functionality); where consent is the basis it can be withdrawn any time. You have rights of access, rectification, erasure, restriction, portability, and objection, and may complain to your supervisory authority.
- United States: we comply with COPPA as amended (2025). We do not sell or share personal information as defined by the CCPA/CPRA.
- Australia (Privacy Act / APPs), Canada (PIPEDA), Hong Kong (PDPO): the same access, correction, and deletion rights apply โ contact us at hello@cantoduck.com.
Changes to this policy
If we materially change what we collect or how we use it โ in particular anything involving children's data โ we will notify account holders by email (if we have one) and in-app before the change takes effect, and obtain fresh parental consent where the law requires it.
Last updated: 1 July 2026. Previous versions available on request.