Privacy Policy

Last updated: 27 July 2026

Doodloo is a learning and play app made for children and controlled by a parent or guardian. We designed it to be safe, private, and free of advertising. This policy explains exactly what we collect, why, and the choices you have.

The short version

• A parent is in control. A parent or guardian (18+) sets up the account and consents to this policy on the child's behalf.
• No ads, no tracking. Doodloo has no third-party analytics or advertising SDKs, and we never build advertising profiles of children.
• We collect the minimum. Only what's needed to run the app — and we never sell personal information or use your child's content to train AI models.
• Voice isn't stored. Audio is transcribed to text and discarded; conversations and images auto-delete on a schedule, and you can erase everything at any time.

1. Who we are

Doodloo is operated by Aayush Gelal ("Doodloo", "we", "us", or "our"), who provides the Doodloo mobile application. If you have any questions about this policy or your data, contact us at aayush@kfxdigital.com.

2. Information we collect

Information you provide

• Parent account — when a parent signs in with Apple or Google, we receive the parent's name and email address to create and secure the account.
• Child profile — a display name or nickname, age or age range, and avatar/preferences that the parent enters to personalise the experience. One account can hold up to four child profiles. We ask parents not to include full legal names or other sensitive details.
• Content your child creates — messages typed or spoken to the AI companion, drawings, image prompts, quiz answers, and lesson progress.

Information collected automatically

• Voice — when your child talks to their AI friend, audio is captured only to be transcribed into text. The audio recording is not stored on our servers; only the resulting text is processed to generate a reply.
• Photos & camera — if your child chooses to show a photo to ask a question about it, that image is used to generate a response. Access to the camera and photo library is only used when the child actively picks or takes a photo. Doodloo has no always-on or background camera or video feature.
• Usage & device data — limited technical information such as app version and error logs, handled by our own servers to keep the app working. Doodloo contains no third-party analytics or advertising SDKs, and we do not send personal information or device identifiers to any analytics or advertising service. Weekly recaps for parents are computed on the device wherever possible.
• Purchase data — if you subscribe, our payment partners provide a purchase token and subscription status. We never receive or store your full card number.

Personalisation memory (optional)

To make conversations feel more personal, Doodloo may remember small, individual facts your child chooses to share — such as a favourite animal, a hobby, or a learning goal. These are tied to your child's profile and used only to personalise your child's own experience. They are never used for advertising, shared with third parties, or used to train AI models, and they are permanently erased the moment you delete the child profile or your account.

3. How we use information

• To provide the core experience — generating AI responses, lessons, images, and play activities.
• To personalise content to your child's age and progress.
• To operate subscriptions, verify purchases, and prevent abuse of usage limits.
• To keep the app secure, debug problems, and improve features and safety.
• To respond to your support requests.

We do not use your child's data to show behavioural advertising, we do not sell personal information, and we do not build advertising profiles of children.

4. AI processing

To answer questions and create images, the text of a prompt (and, when the child shares one, an image) is sent to trusted AI service providers that generate the response. These providers process the content only to return a result to Doodloo and under contractual terms that prohibit using it to train their models on identifiable children's data. We do not use your child's conversations, voice, or creations to train our own AI models. We add safety instructions designed to keep responses age-appropriate, but no automated system is perfect — parental supervision is encouraged.

5. Service providers we share with

We share limited information with the following vendors, only as needed to run Doodloo. This is the complete list of third parties who may receive your child's personal information:

We also use infrastructure providers to host the app and deliver updates and bug fixes to your device. These providers handle only limited technical information (such as app version and a device installation identifier) needed to deliver the app itself — never your child's name, profile, conversations, or creations.

Each of these providers is bound by contract to handle information only on our instructions, for the purposes described above, and to provide the same or equal protection of user data as stated in this privacy policy. We do not permit them to use your child's information for their own purposes. We may also disclose information if required to comply with a legal obligation or to protect the rights and safety of a child or others.

Doodloo does not include third-party analytics software or third-party advertising, and does not send personally identifiable information or device information to third parties for those purposes.

6. Children's privacy (COPPA & GDPR-K)

Doodloo is built for children and complies with applicable children's privacy laws, including the U.S. Children's Online Privacy Protection Act (COPPA, 16 CFR Part 312) and the "children" provisions of the EU/UK GDPR, where they apply.

• A parent or guardian sets up the account and provides verifiable consent before a child uses the app.
• We collect the minimum information needed to run the app and never condition play on a child disclosing more than is reasonably necessary.
• We do not knowingly allow children to publicly share personal information, and there is no open social network or user-to-user chat.
• Parents can review, correct, or delete their child's information and revoke consent at any time (see "Your choices").

Legal basis (EU/UK GDPR). Where the GDPR applies, we rely on the parent's consent for a child under the applicable age of digital consent (Article 6(1)(a) and Article 8) and on our legitimate interests in keeping the service secure, preventing abuse, and improving safety (Article 6(1)(f)). You can withdraw consent at any time by deleting the profile or account, or by contacting us.

7. Data retention

We retain your child's personal information only for as long as is reasonably necessary to provide the service it was collected for, and never indefinitely. Automated jobs run every day and delete content once it reaches the limits below:

• Voice audio — never written to our servers; discarded the moment it has been transcribed.
• Conversation transcripts — automatically deleted after 30 days.
• Generated images — automatically deleted after 90 days, unless you save them.

Account and child-profile details (such as the display name and age range) are kept while the account is active, because they are needed to provide the experience and preserve your child's progress. When you delete a child profile or your whole account from within the app, we permanently delete the associated data — including conversations, images, and personalisation memory — from our servers within 24 hours, except for limited records we must keep to meet legal, security, or accounting obligations.

8. Your choices & rights

• Delete in the app — you can delete a child profile directly in the app, which erases the data associated with it, and you can permanently delete your entire account and all its data from within the app at any time.
• Access & export — you can request a copy of, or the full deletion of, your child's data by emailing aayush@kfxdigital.com.
• Permissions — microphone and photo access can be turned off any time in your device settings.
• Subscriptions — manage or cancel from your Google Play or App Store account.
• Depending on where you live, you may have additional rights (access, correction, portability, objection), and the right to lodge a complaint with your local data protection authority.

9. Your U.S. state privacy rights

If you are a resident of California or another U.S. state with a consumer-privacy law (such as Virginia, Colorado, Connecticut, or Utah), you have the right to know what personal information we collect, to access and delete it, to correct it, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not knowingly sell or share the personal information of anyone under 16. We will not discriminate against you for exercising any of these rights. To make a request, email aayush@kfxdigital.com.

10. Cookies & tracking

The Doodloo app uses no advertising cookies, no advertising identifier (such as the IDFA), and no cross-app tracking. This website uses no third-party analytics or advertising cookies — only what is strictly necessary to serve the page.

11. Security

We use encryption in transit, access controls, and reputable infrastructure providers to protect information. No method of transmission or storage is 100% secure, but we work to protect your data and to notify you of material breaches as required by law.

12. International transfers

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards (such as the European Commission's Standard Contractual Clauses) for those transfers, and we apply strict data minimisation.

13. Changes to this policy

We may update this policy as the app evolves. When we make material changes we will update the "last updated" date and, where appropriate, notify you in the app. Continued use after changes take effect means you accept the updated policy.

14. Contact us

Questions, requests, or concerns? Email aayush@kfxdigital.com and we'll respond as soon as we can.