Privacy Policy

1. Who this policy comes from

LearnPK Kids is operated by Slah Ud Din (registration number Not applicable — published by an individual, not a company), of Pakistan — written enquiries by email, to the address below. On Google Play the app is published by Slah Ud Din, and on the Apple App Store by Slah Ud Din.

For a family account, we decide what is collected and why — in data-protection language, we are the controller. Where a school sets up profiles for its pupils, the position is different, and section 14 explains it.

For anything in this policy, write to slahuddinch1@gmail.com.

2. The short version

• A grown-up holds the account. A child has no account, no password and no way to log in.
• About a child we store a first name or nickname, their class, the cartoon character they build, and what they did in the games. No birthday, no surname, no photograph, no voice recording, no address.
• There are no adverts anywhere in LearnPK Kids, and no advertising identifier is used or sent.
• There is no third-party analytics service, no crash reporter, no tracking pixel and no social-media code in the app. We have no data broker, no ad network and no marketing partner.
• The app never asks for the camera, the microphone, your location or your contacts.
• Progress data is kept in our own database on our own server. The only thing that ever leaves it is described in section 8.
• One thing leaves our server: the words of a lesson go to the voice service that reads them aloud — never your child's name, never an identifier, never your child's device address. Section 8 sets it out in full.
• The parent area shows your child's profile, progress, skills, badges, recent play and latest weekly report. You can correct any of it and delete the profile outright. For the complete record we hold, or to delete the whole account, write to us — section 12 says how.

3. Grown-ups have accounts. Children do not.

Only an adult — a parent, guardian or teacher — can create an account. An account needs an email address and a password. A child profile inside that account has no email address, no password and no login of its own: a child starts playing by tapping their picture on a screen that the adult has already opened.

Because of that, a child can never sign up, sign in, reset a password, or reach the app on a device where an adult has not already logged in.

There is a grown-ups' gate between the playing area and anything adult-facing. Once a child starts playing, the device stays in child mode until an adult passes that gate.

4. What we collect from grown-ups

Your account

Your email address, your display name, the language you prefer, your time zone (Asia/Karachi unless you change it), the date you signed up and the date you last logged in.

Your password

We never store your password. We store a scrypt hash of it, with a random salt, from which the password cannot be read back. When you log in we compare hashes, not passwords.

If you register a school

The school's name, city, type and phone number, and which teachers belong to it.

If you send us a school enquiry

Your name, your school, your city and your phone number, plus your email address, the number of children and a message if you choose to give them. We use this to contact you about LearnPK Kids for schools, and it is stored in our enquiry list with a status such as "new" or "contacted".

The school enquiry list has no self-service delete button today. To have your enquiry removed, email slahuddinch1@gmail.com and we will delete it.

5. What we store about a child

For each child profile an adult creates, we store:

A first name or a nickname

Whatever the grown-up types. Nothing else identifies the child.

The class or stage

For example Preschool or Class 1, so the right levels appear.

The cartoon character

The colours, face and clothes the child picks. These are drawings we supply, not a photograph.

The voice language

English or Urdu, for the spoken instructions.

A daily time limit

Only if you set one.

A family code

Only for a profile created by a school, so that a parent can later link it to their own account.

What happened in the games

Which levels and activities were played and when, how long each took, how many mistakes were made, whether hints were used, whether it was right the first time, stars, XP, badges, rewards, streaks and which skills look strong or need practice.

The answer given each time

Usually a number or a choice — which picture was tapped, which number was typed. In the tracing and route games it is the shape itself: a short list of points showing the path the finger took across the letter. It is a rough outline of a letter, not a picture of your child.

Weekly reports

The summary of a week's play that the parent area shows you, stored so you can look back at it.

Product events

Short records such as "signed up", "level completed" or "badge earned", each one holding only an internal ID and a learning fact. These are written into our own database and never leave our server.

This information is linked to your child's profile by an internal ID, so we do not call it anonymous. It is not used for advertising, it is never combined with data from other apps or websites, and it is never sold.

The name box is an ordinary text box, so it will accept more than we ask for. Please type only a first name or a nickname — the app has no use for a surname and we would rather not hold one.

6. What we never collect

None of the following is asked for, recorded or sent anywhere by LearnPK Kids:

• A child's date of birth, age or birthday.
• A child's surname, home address or phone number.
• A photograph or video of a child. The app has no camera feature and asks for no camera permission.
• A recording of a child's voice. The app has no microphone feature and asks for no microphone permission.
• Location of any kind. The app asks for no location permission and holds no location field.
• Your contacts, your calendar, your photo library or your files.
• An advertising identifier (the Android advertising ID or Apple's IDFA), a device serial number, IMEI, IMSI, MAC address or Wi-Fi network name.
• Payment card details. The app takes no payments at all (see the Terms).
• Anything a child types as free text. There is no box anywhere in the playing area where a child types words that we save.
• A child's free drawing. The drawing board keeps the picture on the device and never sends it. The only thing recorded is how many strokes were drawn — a number, nothing more.

One thing might sound like an exception, so we will say it plainly rather than let you find it later. In the tracing and route games inside a level, we do record the path the finger took across the letter or the map. It is a short list of points, described in section 5. It stays in our own database and goes nowhere else.

The app sends browsers a Permissions-Policy header that switches the camera, microphone, location and payment features off for every page, so they cannot be used even by mistake.

The one device feature the app uses is the buzz when a child gets something right. It needs no permission and you can switch it off.

7. What we use it for

• To run the app: to show the right levels, remember where a child got to, award stars and XP, and read the lesson aloud in the chosen language.
• To decide what to offer next, from the skills the child has practised.
• To show you, the grown-up, how your child is getting on — the progress screens and the weekly report.
• To keep the account safe: we limit how often anyone may try to sign up, log in or send an enquiry from one internet address.
• To understand which parts of the app are used, from our own counts held in our own database.

We do not use any of it for advertising, for building a marketing profile, or for anything we sell or rent to anyone.

8. Who else ever sees any of it

We run the app, the database and the stored pictures and audio on a single server we rent and control ourselves. The machine itself is rented from Amazon Web Services (Amazon EC2), who provide the computer and the building it sits in and have no part in running the application. Beyond that there is no outside company running our database for us, no outside file store, and nobody else with an account on the system.

There are three places where something does leave our server. Each is listed here.

a) The voice that reads the lessons — ElevenLabs for the English voice, and WaveSpeed — which runs Google's Gemini voice — for the Urdu voice

Phones have no Urdu voice and their English voices sound robotic, so our server asks a speech service to record each line. What is sent is the words of the lesson or a line of praise, together with the voice settings. What is not sent: your child's name, your child's profile ID, your account, the login cookie, or the internet address of your child's device. The request is made by our server, so the speech service sees our server's address and nothing about your child's device. Each finished recording is stored on our server under a fingerprint of the words, so the same line is only ever sent once and every child afterwards hears the stored copy.

b) Your own device's voice

If no recorded voice is available, the app may ask the device's own built-in speech engine to read a line aloud. On some phones and browsers that engine is a service run by the maker of the device or browser. What is read out is a line of a lesson. Your child's name and data are not involved, and this is the device's behaviour rather than anything we add to the app.

c) If the law requires it

We would disclose information if we were legally required to, and we would tell you unless we were forbidden to.

The speech services never receive anything that identifies your child. That is the plainest and most important sentence in this policy, and it is true of every line of the code that talks to them.

9. No adverts, no tracking, no outside analytics

• There are no adverts in LearnPK Kids — not banners, not videos, not sponsored content.
• There are no in-app purchases and no payments of any kind.
• There is no chat, no messaging, no comments and no way for one user to contact another.
• There are no public profiles and no leaderboards. A child's progress is visible only inside your own account.
• There is no Google Analytics, no Firebase, no Sentry or other crash reporter, no Facebook or other social-media code, no advertising network and no tracking pixel. The app carries nine outside code libraries in total, and none of them collects anything about you or your child.
• We do not track anyone across other apps or websites, and there is nothing to track with: no advertising identifier is read or sent.
• Nothing is sold, rented or shared with a data broker.

Our own counts of what is used — "a level was completed", "a badge was earned" — are written straight into our own database, alongside an internal child ID. Because they are tied to a profile we do not describe them as anonymous, but they never leave our server and are sent to no outside company.

10. Cookies and what stays on the device

LearnPK Kids sets exactly two cookies. There are no third-party cookies and no advertising cookies.

lpk_session — strictly necessary, 30 days

A long random token that keeps you logged in. It cannot be read by scripts in the page, it is only sent to our own site, and it is marked secure in production. On our server we store only a one-way hash of it, so the token itself exists nowhere except in the cookie on your device. Logging out deletes it from both places.

lpk_lang — preference, 1 year

Holds either "en" or "ur" so the site opens in the language you chose. It contains nothing else.

The app also remembers a few settings in your browser's own storage. These stay on the device and are never sent to us:

• whether sound is on or off,
• whether the buzz on a correct answer is on or off,
• whether stories play by themselves,
• which language the stories and the body lesson are read in,
• whether you have hidden the "add to home screen" banner.

So that the app keeps working without a connection, it also stores lesson content, pictures, recorded audio and the play screens recently visited on the device itself. If a level is finished while offline, the result — including the answers given — waits in the browser's own storage on that device until it can be sent to us, and is deleted as soon as it has been. Switching to a different child clears the stored play screens.

11. How long we keep it

Today, information is kept for as long as the account exists. Nothing is deleted on a timer: your child's progress is there whenever you come back to it, and it goes when you delete the child profile or the account.

• A child profile and everything recorded about that child: until you delete the profile or the account.
• Your account: until you ask us to delete it. An account left unused is kept for as long as you keep the account, and for 24 months after the last time anyone signs in.
• After you ask us to delete an account, anything at all that survives, and why: nothing — deletion removes the records immediately and there is no database backup to restore them from.
• School enquiries: 24 months from the enquiry.
• Our web server's own access logs, which record internet addresses: 14 days.
• Recorded lesson audio is kept indefinitely. It is the same for every child and contains nothing about anybody.

One honest note about the 24-month figure. Deleting an account, or a child profile, removes the records straight away — that part is automatic and you can do it yourself. The clear-out of accounts nobody has signed into for two years is a periodic review we carry out rather than something a machine does on the exact day, so treat 24 months as the point after which an unused account may be removed, not a promise that it vanishes that morning. You never have to wait for it: delete the account and it goes immediately.

12. Your choices, and how to use them

See what we hold

The parent area shows your child's profile, their totals and this week's figures, their skills, their progress through the worlds, their badges, their recent play and their latest weekly report. It does not show everything we hold: the answer given at each individual attempt, the traced paths described in section 5, the product events and the earlier weekly reports are stored but are not on screen. For the complete record, ask us at slahuddinch1@gmail.com and we will send it to you.

Correct it

You can change a child's name, class, voice language, daily limit and character at any time in the parent area.

Delete one child

In the parent area you can delete a child profile. You are asked to retype the child's name first, so it cannot happen by accident. Deleting the profile also deletes that child's attempts, activity answers, level progress, skill mastery, streaks, XP, badges, rewards, weekly reports and product events.

Delete your whole account

You can do this yourself, in two places: in the parent area, and on our website at thetaleem360.com/delete-account. Either route deletes your account, your parent profile, every child profile you added at home and all of the learning data listed above, straight away, and signs you out. If one of your children is a school's pupil, that profile is unlinked from you and stays with the school, because it is the school's record rather than ours to erase. If you cannot sign in, write to slahuddinch1@gmail.com and we will do it for you within 7 working days.

Stop further collection

Deleting a child's profile stops anything further being recorded about that child. Deleting your account stops everything.

Ask a question or complain

Write to slahuddinch1@gmail.com. We answer within 7 working days.

If you are in the European Union or the United Kingdom, you also have the right to a copy of your data in a portable form, to object to processing, and to complain to your national data-protection authority.

A child profile that a school created is handled differently: deleting it from your family account unlinks it from you and leaves the profile with the school, because the school created it. Ask the school to delete it, or write to us.

13. Children's privacy

This app is made for young children, so children's privacy is the whole design, not a section at the end. A child cannot create an account, cannot be contacted through the app, cannot be seen by anyone outside your account, and is never shown an advert.

A parent, guardian or teacher sets up every child profile and types the child's first name. By creating a profile you are telling us that you are the child's parent or guardian, or that you are a teacher acting with the school's authority and the parents' agreement, and that you agree to what this policy describes.

A child's first name on its own does not identify them. Combined with the internal ID that links it to a week of learning records and to your email address, it is personal information about a child, and we treat it that way.

United States — COPPA

As a parent you may look at everything we hold about your child, have it deleted, and refuse to let us collect any more. Section 12 says how, and the address for those requests is slahuddinch1@gmail.com. We do not condition your child's use of the app on giving us more information than the app needs.

European Union and United Kingdom — GDPR

Every child using LearnPK Kids is below the age at which a child can consent for themselves, so we rely on the agreement of the parent or guardian who created the profile. You can withdraw it at any time by deleting the profile or the account.

Pakistan

Pakistan does not yet have a comprehensive data-protection statute. The Personal Data Protection Bill is still before Parliament, and privacy is protected in the meantime by Article 14 of the Constitution and by the Prevention of Electronic Crimes Act 2016. We have chosen to apply the stricter international children's standards described above everywhere we operate, including Pakistan.

14. Schools and classrooms

A school can create profiles for its pupils so that a class can play together. The school chooses which children to add and what to call them, and the school is responsible for having the parents' agreement before it does. We hold and process those profiles on the school's behalf.

The school sees its own pupils' progress. It does not see anything about children in other schools or in family accounts.

A school can hand a parent a family code so the parent can link their own account to the child's profile and see the same progress at home. If the parent later unlinks, the profile stays with the school. If the school removes a pupil who is linked to a family, the profile stays with the family.

Schools: the written agreement covering who is responsible for what, and the parental consent the school confirms it holds, is set out in our school agreement. Ask us at slahuddinch1@gmail.com for a copy.

15. How we protect it

• The app is served over an encrypted connection (HTTPS). Your login cookie is marked so that a browser will only ever send it over one, and every reply from the app tells the browser to use HTTPS for this site from then on.
• Passwords are stored as scrypt hashes with a random salt, and are compared in a way that does not leak timing information. We cannot read your password, and neither can anyone who obtained the database.
• Your login token is stored on our side only as a one-way hash, and the cookie holding it cannot be read by page scripts.
• We limit how often anyone can try to sign up, log in or send an enquiry from one internet address. That address — and, for a login attempt, the email address that was typed — is held only in the running server's memory, for up to an hour, and is lost whenever the server restarts. It is never written to the database.
• The app sends browsers instructions that block it from being framed by another site, stop content-type guessing, and switch off the camera, microphone, location and payment features.
• Every request for a child's data checks that the child belongs to the account making the request.

No system is perfectly secure. If anything ever happened that put your information at risk, we would tell you and the relevant authority promptly.

16. Where your information is

Our server and our database are in Northern Virginia, United States (AWS us-east-1), on a machine we rent from Amazon Web Services (Amazon EC2). That is where your account and your children's learning records live.

The one thing that travels further is described in section 8: the words of a lesson going to the speech service (the United States). It carries nothing that identifies a child.

17. Changes to this policy

If we change what we collect or who sees it, we will change this page and update the date at the top. If a change materially affects a child's information, we will tell account holders by email before it takes effect.

This version takes effect on 15 September 2026 and was last updated on 15 September 2026.

18. How to reach us

Privacy questions, requests to see or delete data, and complaints: slahuddinch1@gmail.com. Anything else: slahuddinch1@gmail.com.

By post: Slah Ud Din, Pakistan — written enquiries by email, to the address below.