CantoDuck is a Cantonese learning app for young children (ages 3β5), designed to be used together by a parent and child. We built it around one principle: a child can use everything in CantoDuck without any account, and we collect as little as possible. We show no advertising of any kind, we do not sell data, and we do not track anyone across other apps or websites. We collect only anonymous, aggregate usage statistics (e.g. "the Transport chapter was opened 120 times today") with all advertising features disabled.
The short version for busy parents
- No account needed to play. All learning progress is stored on your device by default. If you never create an account, no progress data leaves your device.
- The microphone is used for one thing: hearing your child say a Cantonese word so the duck can cheer. Speech is converted to text by Apple's speech recognition service, which may process the audio on Apple's servers. We never receive, store, or keep any recording of your child's voice from this feature.
- Accounts are for parents only, protected by a parental gate. An account exists so a family can back up learning progress and use one purchase on several devices.
- No ads. No selling of data. No cross-app tracking. Ever. We keep anonymous counts of which activities get used so we know what to improve β these are never linked to you or your child.
- Invitations are optional. If you share or accept an invitation link, we use your account email to work out who invited whom, to stop bulk redemption, and to give you any reward you earn. The link itself carries a random token, never your email or your name. Ignore the whole thing and nothing about CantoDuck changes.
- You can delete your account and all synced data inside the app at any time (Parent corner β Family account β Delete account & data), or by emailing hello@cantoduck.com.
What we collect, and why
If you don't create an account (the default)
No personal information is collected. We receive only anonymous usage statistics via Google Analytics for Firebase β which screens and chapters are used and standard device categories (e.g. "iPad, iOS 26") β with every advertising-related signal disabled at the code level, no advertising identifiers (the ad-tracking framework is not even compiled into the app), and no user IDs attached. Learning progress (which words your child has heard, matched, echoed, or traced) and any voice notes you record for your child are stored only on your device. Deleting the app deletes them.
Voice, during Echo practice
When your child repeats a word in Echo mode, the device microphone is active and the audio is processed by Apple's speech recognition service (SFSpeechRecognizer) to check whether the word was said. Because Apple does not currently offer on-device Cantonese recognition, the audio may be sent to Apple's servers for processing, under Apple's own privacy terms (iOS asks for your permission for exactly this the first time). What we get back is only text, which is compared against the target word and immediately discarded. We do not receive, store, transmit, or retain any audio, and no voice data is ever linked to an account by us.
Parent voice recordings (where you record your own pronunciation for your child) are stored on the device only and are never uploaded.
If a parent creates a family account (optional)
Account creation sits behind a parental gate (a challenge a young child cannot pass) and uses Sign in with Apple or Google Sign-In. We then store:
| Data | Where | Why |
|---|---|---|
| Account identifier (a random user ID from Apple/Google sign-in) | Google Firebase (Authentication) | To know which family a progress backup belongs to |
| Email address, if your sign-in provider shares one (Apple's "Hide My Email" is fully supported β we never require a real email) | Google Firebase (Authentication) | Account recovery, and, if you take part in the optional invitation scheme, referral attribution, fraud prevention and reward administration (see Invitations and referrals). We do not send marketing email |
| Child profile nickname and avatar choice | Google Firebase (Cloud Firestore) | To label progress per child. Please use a nickname, not a full real name |
| Learning progress (which words have been completed in each activity) | Google Firebase (Cloud Firestore) | Backup and sync across your devices |
| Purchase and subscription status | RevenueCat, Apple App Store / Google Play | To unlock Premium on all your devices and handle restores/refunds |
That is the complete list. We collect no location, no contacts, no photos, no device fingerprinting, and no advertising identifiers. Usage statistics are anonymous and are never joined to your account or your child's profile.
This website (cantoduck.com)
Everything above is about the app. The website is separate, and it is measured with two tools:
- Cloudflare Web Analytics β counts page views, referrers, country and browser, and measures how fast pages load for you. It is added by Cloudflare, which serves this site, uses no cookies, and does not fingerprint your device or follow you to other sites.
- Google Analytics 4 β runs in Google's Consent Mode with all storage denied. In that mode it sets no cookies, and the measurement it sends carries no identifier that would let us recognise you on a later visit or on another site. Advertising storage, advertising personalisation and ad-user-data are all switched off, so nothing collected here is used for advertising or shared with an ad network.
This website collects no email addresses. The launch waiting list closed when CantoDuck reached the App Store, nobody had joined it, and there is no longer a form on the site to give us an address through. The app is a separate matter and is covered above: an address reaches us only if your sign-in provider shares one, and Apple's "Hide My Email" is fully supported.
The website sets no advertising cookies and no cross-site trackers.
Google Analytics starts with all storage denied, so nothing is written to your
device before a decision is made. If your browser reports a European timezone
β the region where consent is legally required β you are shown a cookie
notice and nothing is stored unless you accept. Decline and measurement stays
cookieless; the site behaves identically either way. Elsewhere, Google
Analytics sets its own _ga cookies to recognise a returning visit.
Clearing your browser's site data for cantoduck.com resets the choice.
Invitations and referrals (optional)
CantoDuck has an invitation scheme: a parent can share a link that gives someone else a free trial of Premium. Taking part is entirely optional. The app, the paywall and the standard free trial work exactly the same for anyone who ignores it, and nothing is withheld from you for not joining in.
If you share an invitation. We generate an opaque token for your
account: a random 22-character string. It contains no name, no email address
and nothing anyone can read your identity back out of. It is what appears in
the link you share (cantoduck.com/refer?by=β¦), so the people you
send it to see the token and nothing about you that you have not told them
yourself. Your email address never appears in an invitation link or an
invitation code.
If you receive an invitation. Opening the link sets one cookie,
cd-refer-nonce. It holds a random value with nothing in it that
identifies you, cannot be read by scripts on the page, is never sent to
Google Analytics or any other measurement tool, and exists for exactly one
reason: so that refreshing the page or tapping the button twice does not
spend two invitation codes. When you tap to redeem, we ask our own server for
one unused Apple offer code and send you to the App Store to redeem it.
Redemption and payment happen entirely inside Apple. We never see your Apple
Account, your name or your payment details.
What your email address is used for here. If you have a CantoDuck account and take part in the invitation scheme, the email address on that account is also used to work out which invitations belong to which account (attribution), to check that invitations are not being redeemed in bulk or fraudulently (fraud prevention), and to administer and tell you about any reward you earn (reward administration). It is not used for marketing, and it is never shown to the person you invited or to the person who invited you.
Wherever we show you the Apple redemption step, the invitation is
copied to your clipboard. That is an iPhone or iPad in the normal
case, and also a Mac, because Apple's own browser on an iPad identifies
itself as a Mac and we cannot reliably tell the two apart.
Tapping the redeem button attempts to put a link on your device's
clipboard before opening the App Store, and the button says so. If your
browser refuses, does not support it, or does not answer in time, the page shows
you the link to copy by hand and lets you carry on. If that copy step never
runs at all, because scripting is switched off or something in between
blocked it, then nothing is copied and the App Store simply opens. Nothing can cancel a copy
once the browser has started one, so in the slow case the page tells you it
could not confirm rather than promising nothing was copied. It contains two things: the same random
invitation token as the link you arrived on, and the random one-time value
from the cd-refer-nonce cookie, which is what lets the app claim
the specific invitation code reserved for you. Neither is a name or an email
address. They are pseudonymous: on their own they say nothing about you, but
we can match the token back to the account that created the invitation, and
the pair identifies the particular invitation code you were given. Note that
anything on your
clipboard can be read by other apps you open, and on an Apple account with
Universal Clipboard turned on it is also shared with your other Apple devices;
that is true of everything you copy, and it is why the link carries nothing
about you. After you install CantoDuck, the app checks
whether a link is on the clipboard without reading it, using an Apple
feature made for exactly this, and shows you a card. Only if you tap that card
does it read the clipboard, and iOS asks your permission at that moment. If you
decline, nothing is read and nothing is recorded.
If you use a Google Play link on this page, the invitation travels
through Google Play. That is the normal path on Android, and the page
also offers it to a desktop or Chromebook visitor who cannot redeem an Apple
code. The install link carries the same random token as a referrer parameter,
which Google passes to the app when you install it. Google receives that token.
It is a pseudonymous identifier: a random string carrying nothing about you,
which we can match back to the account that created the invitation and which
Google may associate with the Play account or device that installs the app.
The referrer parameter contains nothing else. Visiting Google Play is a visit
to Google, so Google receives what any website receives, your IP address and
browser details, exactly as it would if you had opened the Play Store
yourself.
What Apple tells us, and what it does not. Apple does not tell us which individual invitation code was redeemed, or who redeemed it. That is why someone who accepts an invitation is asked to open the invitation link once more after installing the app: that step happens on their own device and is the only point at which an invitation is connected to an account. If they skip it, nothing is recorded and nobody is credited. Their free trial is unaffected either way.
Your device remembers that it has opened an invitation, in a second cookie
(cd-refer-sent) holding nothing but the fact itself. It exists
so that coming back to the link shows you the step you still need rather
than the offer you have already taken. Like the other one, it identifies
nobody and is cleared with your browser's site data.
How long any of this is kept. An invitation token lasts as long as the account it belongs to. Records of which invitation led to which subscription are kept while they are needed to work out and deliver rewards and to investigate abuse, and are deleted when the account is deleted.
Third parties we use
We share data only with the service providers below, only because the service cannot work without them (they are integral to providing CantoDuck), and never for advertising or marketing:
- Apple Inc. β speech recognition during Echo practice; Sign in with Apple; App Store payments. apple.com/privacy
- Google LLC (Firebase) β sign-in authentication, the database that stores your family's learning progress, and anonymous usage statistics (Google Analytics for Firebase, with ads features disabled and a 14-month retention setting). firebase.google.com/support/privacy
- RevenueCat, Inc. β subscription/purchase management (receives a random user ID and store transaction data; never your child's data). revenuecat.com/privacy
We do not disclose personal information to any other third party, we do not permit these providers to use the data for their own advertising, and we will never disclose children's personal information for targeted advertising.
Children's privacy (COPPA / GDPR-K)
CantoDuck is used by children with their parents. We designed it so that:
- A child cannot create an account, make a purchase, or reach any commerce or data-collection surface β these all sit behind a parental gate.
- The only child-related data we ever store on our servers (nickname, avatar, learning progress) is created by the parent, under the parent's account, which acts as the parent's consent and remains under the parent's control.
- We collect no persistent identifiers from a child playing without an account, and we never use children's data for advertising, profiling, or any purpose other than showing their learning progress.
Parents may review, download, or delete their family's data at any time β see "Your controls" below. If you believe a child has provided us information outside these design boundaries, contact hello@cantoduck.com and we will delete it.
Data retention
- On-device data: kept until you delete the app or clear its data.
- Synced progress and profiles: kept while the account exists, so the service can do what you created the account for.
- Account deletion: removes the Firebase account and all synced profiles and progress immediately; we ask RevenueCat to disassociate the account identifier. Store purchase records are retained by Apple/Google under their own policies (we cannot delete an App Store receipt).
- Invitation data: a referral token lasts as long as the account.
Records linking an invitation to a subscription are kept only while they
are needed to work out and deliver rewards and to investigate abuse, and go
when the account is deleted. The
cd-refer-noncecookie sits on your own device and is cleared with your browser's site data. - We do not keep children's personal information longer than necessary for the purpose the parent provided it, and we never retain it indefinitely.
Security
Data in transit is encrypted (TLS). Synced data is stored in Google Firebase with access rules that allow only your signed-in account to read or write your family's data. We maintain a written information security programme appropriate to the small amount of data we hold.
Your controls
- Delete everything (in-app): Parent corner β Family account β Delete account & data. This is immediate and permanent.
- Sign out: stops any further syncing; the device keeps working locally.
- Microphone: can be revoked any time in iOS Settings β CantoDuck. Echo mode simply becomes unavailable; everything else keeps working.
- Email us at hello@cantoduck.com for: a copy of your family's data (portability), correction, deletion, or any privacy question. We respond within 30 days.
Regional rights
- EU / UK (GDPR & UK GDPR): our legal bases are performance of a contract (providing sync you asked for) and legitimate interests (app functionality); where consent is the basis it can be withdrawn any time. You have rights of access, rectification, erasure, restriction, portability, and objection, and may complain to your supervisory authority.
- United States: we comply with COPPA as amended (2025). We do not sell or share personal information as defined by the CCPA/CPRA.
- Australia (Privacy Act / APPs), Canada (PIPEDA), Hong Kong (PDPO): the same access, correction, and deletion rights apply β contact us at hello@cantoduck.com.
Changes to this policy
If we materially change what we collect or how we use it β in particular anything involving children's data β we will notify account holders by email (if we have one) and in-app before the change takes effect, and obtain fresh parental consent where the law requires it.
Last updated: 3 September 2026 (invitations now work on Android too, and the iPhone clipboard step is described). Previous versions available on request.