Privacy Policy

1. Who We Are and Who This Policy Covers

Sweetie Ears is a music ear-training app for young children, operated by WAWADATA LIMITED ("Sweetie Ears", "we", "us", or "our"). A parent or legal guardian creates and manages the account and permits the child to use the app.

WAWADATA LIMITED is the controller responsible for the information described here. We are a New Zealand company at 44 Oriana Avenue, Lynfield, Auckland 1042, New Zealand. Contact privacy@sweetieears.com, +64 29 0527 5796, or the EU and UK representative named in section 6.

This policy covers the Sweetie Ears app, website, support channels, and related services.

2. Our Privacy Commitments

• No advertising in Sweetie Ears at all, no sale of personal information, and no sharing for cross-context behavioral advertising.
• The app contains no third-party advertising, analytics, attribution, or A/B-testing software, and no crash-reporting software. It collects no advertising identifier.
• We never ask for a child's name, age, birthday, photo, voice, contacts, or location. The child area has no free-text field, public profile, chat, social feed, or user-to-user messaging.
• A child's practice information is used only to provide and protect Sweetie Ears. It is processed by us and our contracted hosting provider, not by advertisers, data brokers, artificial-intelligence services, or another company for its own purposes.
• A parent can review and export the child's information, withdraw consent and erase the child record while keeping the parent account, or delete the entire account.

3. Information We Collect

Parent account and sign-in. A one-time code can be texted to your phone or emailed to you, and both offered on every platform. Sign in with Apple is offered on iPhone and iPad only. We collect the email address or phone number used, and both if you add both. For Apple, we receive its identifier for you, the email information it provides, and whether it is a private relay address; we retain a single-purpose revocation token so we can disconnect Apple when you remove that method or delete the account. For one-time-code sign-in, the destination is stored and a code we send you is stored only as a one-way value that expires within minutes. We do not receive a password, Apple account contents, contacts, profile picture, or payment-card details.

Parent settings and security. We collect your language, timezone, quiet hours, reminder choices, and last-active time. The parent-area PIN and recovery code are stored only as one-way values, together with lockout and failed-attempt information. If support adds a name to your account at your request, we hold that name.

Child practice information. We collect the curriculum stage and unlocked items; practice sessions and questions; each answer, whether it was correct, and response time; mastery, progress summaries, stars, streaks, review and pacing flags; and the date a plan was restarted or practice lapsed. This is the child's learning record. It contains no child name, age, birthday, photo, voice, location, or typed response.

Practice-time preferences and optional inference. For the current child record, we keep the practice timezone, the weekly times set by the parent, and whether automatic suggestions are enabled. If the parent actively enables them, we use the times at which the child practises to create a suggested weekly grid. Automatic suggestions are off by default. They affect only when practice is scheduled and reminded, never what the child is taught. Switching them off deletes the inferred grid and makes the parent's weekly times active again. These preferences are erased with the child record.

App and device information. Signed-in requests include the app version, build number, platform, timezone, and language, plus a stable random identifier generated for that installation. The identifier is not based on device hardware and changes when the app is reinstalled. We do not collect an advertising identifier, location, list of installed apps, or crash reports.

Subscriptions and purchases. We receive the store, plan, subscription status, trial and renewal dates, production or test environment, and the store's transaction and subscription identifiers. We keep the chain of identifiers needed to recognize restores and later store events, and four facts from each store notification: the store, event type, time, and subscription it named. We discard the notification body. We send the store our Sweetie Ears account identifier to link the purchase to the correct account. Apple or Google handles payment; we never receive card or bank details.

Support and feedback. We collect the subject, message, category, and any name or email address you provide, together with app version, language, timezone, and, for the web form, browser type and a keyed one-way hash of the network address used to prevent abuse. Support accepts text only. Please do not include a child's name, age, or other information we do not ask for.

Acceptances and consents. We record the editions of the Terms & Conditions and Privacy Policy acknowledged at sign-in; consent to third-party sign-in, where used; each grant or withdrawal of consent for child practice information; the consent-screen wording and app build shown; and the production store transaction used to verify parental consent. These records let us show what the parent agreed to and when.

Messages, security records, and logs. We keep delivery records for emails and texts: destination, message type, time, language, provider identifier, and delivery status, but not the one-time code or message body. Security and diagnostic logs may identify the parent account or the address or number involved in a failed sign-in message. Our web server is configured not to write an access line for every request, so it does not routinely record the network address, and we use no third-party crash-reporting service.

Home-screen widget. If you add the widget, our servers create a picture containing practice dots, streak count, and next practice time. It has no child name or age. It is held under a signed link that expires within a day or two.

The app does not collect camera, microphone, photo-library, precise or approximate location, contacts, calendar, health, biometric, advertising, or audio-recording data. A progress card shared by a parent is created and shared on the parent's device and does not pass through our servers.

4. How We Use Information

We use information to:

• create, authenticate, secure, and support the parent account;
• provide practice sessions, adapt exercises and reviews, track progress, and show the parent dashboard;
• schedule reminders chosen by the parent and, only when enabled, suggest practice times;
• verify and administer subscriptions, trials, restores, refunds, and store events;
• answer support requests;
• prevent abuse, diagnose faults, maintain backups, and protect the service;
• comply with law and enforce our Terms & Conditions; and
• produce aggregated or irreversibly de-identified statistics where practical.

We do not use personal information for advertising, data brokerage, unrelated profiling, or an automated decision with legal or similarly significant effects.

5. Children's Privacy and Parental Consent

Sweetie Ears is directed to young children, but the account and all consent decisions belong to the parent. A child never creates an account, signs in, enters contact information, makes a purchase, or makes information public.

Before collecting child practice information, we show the parent a separate direct notice explaining what we collect, why, who receives it, and how to withdraw. Nothing is pre-ticked. We record the parent's explicit choice and link the full policy on that screen. If the parent does not consent, we collect no child practice information and practice cannot begin because that learning record is the state the service needs to run.

A completed production App Store or Google Play subscription transaction verifies that the consent came from the adult store-account holder. This includes a production transaction that starts an introductory free trial. It does not include a sandbox purchase, access grant, free access without a production store transaction, a transaction belonging to another account, or an old restore without a newly verified consent or an existing verified-consent chain. Sweetie Ears does not support Family Sharing or subscription sharing. We verify the transaction with the store, link its identifier to the consent record, and send the parent a confirmation notice. Payment does not itself constitute consent: the separate consent choice always comes first.

The child practice history is used to choose exercises and reviews inside the learning service. Optional practice-time inference is a separate parent-controlled feature, is off by default, and is used only to schedule and remind practice. Neither is used for advertising, ranking children, or decisions with legal or similarly significant effects.

The parent may withdraw consent at any time in the parent area. Withdrawal immediately stops consent-based collection and use and permanently erases the child learning record, practice-time grids, and widget pictures. There is no withdrawal option that keeps the child record. The parent account, sign-in methods, subscription, other parent settings, and consent ledger remain; practice-time preferences reset with the child record, and the store subscription must be cancelled separately. Re-consent starts a new child record from the beginning. Download the export described in section 11 first if you want to keep a copy.

Parents can review and export the child's information, erase it by withdrawing consent, refuse further collection, or delete the entire account. These controls are in the parent area behind the parent check, and the same requests can be sent to privacy@sweetieears.com.

The U.S. Children's Online Privacy Protection Act applies to us. We obtain verifiable parental consent before collecting child personal information, collect no more than the learning service reasonably needs, keep it confidential and secure, disclose it only to DigitalOcean as an integral contracted hosting service, and provide the parental rights described above. For the United Kingdom, we apply the child's best interests, data minimization, high-privacy defaults, and the Age Appropriate Design Code; the optional inference is off unless the parent chooses it. Where another country requires consent from a holder of parental responsibility or sets a different digital-consent age, we apply that rule.

6. Legal Bases and EU/UK Information

Where a legal basis is required:

• Consent supports collection and use of child practice information, including using it for optional reminders and optional practice-time inference, and the separate transfer of a sign-in credential to Apple. The parent-area switch controls whether practice-time inference runs; this choice does not replace the child-data consent described above. Withdrawal does not affect earlier lawful processing but stops future consent-based processing; withdrawing child-data consent also erases the child record.
• Contract performance supports the parent's account, sign-in, subscription administration, and support requested by the parent.
• Legitimate interests support proportionate security, fraud prevention, delivery records, diagnostic logs, and service reliability. We do not use those interests for advertising or unrelated profiling.
• Legal obligation supports required tax and accounting records and disclosures compelled by law. Contract performance and legitimate interests also support limited refund, chargeback, and dispute records.

EU and UK users have rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent, subject to applicable conditions. Contact us or use the in-app controls. We respond without undue delay and no later than one calendar month after a valid EU or UK request, unless the law permits an extension; if so, we explain why and when we will respond. You may complain to the authority where you live or work, or to the UK Information Commissioner's Office.

Our EU Article 27 representative is Euverify Ltd (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland. Our UK Article 27 representative is Euverify Ltd (UK), 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom. Contact either at gdpr@euverify.com or through the verification and request portal.

7. Who Receives Information

This is the complete list of recipients outside WAWADATA LIMITED. DigitalOcean receives child practice information because it hosts the service. Other recipients receive parent, device, communication, or purchase information, unless a parent puts child information into a support message.

• Apple, only when a parent chooses Sign in with Apple: Apple receives the sign-in request and, on removal or account deletion, a request to disconnect. We receive the account information listed in section 3. Nothing about the child is sent. Email- or text-code sign-in hands your credential to nobody.
• Apple and Google, for subscriptions: the store receives our account identifier and returns subscription and transaction status. It already holds the purchasing store account and payment details; we send nothing about the child.
• DigitalOcean, LLC, our hosting provider: its servers, database service, and object storage hold the account data, child practice information, audio catalogue, and widget images under a data processing agreement and our instructions. It may not use them for its own purposes.
• Titan Solution Ltd SEZC, operator of the Neo mailbox service: it and its published infrastructure providers handle email addresses and transactional sign-in, consent-confirmation, and support messages. We use no email marketing, tracking, or analytics service.
• TNZ Group Limited and the mobile networks it uses, for text messages: they receive the parent's phone number and the finished sign-in-code or consent-confirmation message. They receive no account, learning, or child details. TNZ uses the data for delivery, status reporting, and billing and has given us written confidentiality, incident, and deletion assurances. TNZ states that message data moves from live storage after three months, to offline storage, and after two years to cold archive, with a retention aim of at least seven years; a requested purge does not remove its billing record of the number and time. Networks vary by destination and may process the number and message outside New Zealand or Australia.
• Professional advisers, regulators, courts, or law enforcement, only where legally required or necessary to establish or protect rights, safety, and security.
• A successor organisation, if the service is reorganised, sold, or transferred, subject to this policy or equivalent protections.

There is no advertising network, analytics provider, crash-reporting provider, artificial-intelligence service, or data broker on this list. We do not sell personal information.

8. International Transfers

WAWADATA LIMITED is in New Zealand. DigitalOcean hosts the servers, database, and files in Sydney, Australia; DigitalOcean is a U.S. company and authorised personnel may access infrastructure from the United States for support and operations. Titan is a Cayman Islands company and its published mailbox infrastructure includes a U.S. provider. Apple and Google operate internationally. Text messages travel through networks determined by the destination number.

New Zealand has an EU adequacy decision recognised by the UK. For DigitalOcean processing, its data processing agreement relies on its EU-U.S. Data Privacy Framework certification and UK Extension where applicable and incorporates the European Commission's 2021 Standard Contractual Clauses and the UK International Data Transfer Addendum where required. Other transfers are assessed under applicable law and contractual or statutory safeguards. Contact us for a copy of relevant transfer clauses. A new provider, region, or data flow will be assessed before use.

9. How Long We Keep Information

We keep personal information only for the purpose and period stated below. Fixed periods are enforced automatically.

• Child practice information and widget images: while consent and the account continue; erased immediately on withdrawal or account deletion. Widget links expire within a day or two and images are replaced as the displayed state changes; if 24 months pass with no practice session, no sign-in, and no active subscription, we delete the account. Where we have an email address, we notify the parent first.
• An account that never completes consent is kept for 30 days from its creation, then deleted. If it has a subscription, we notify the parent after purchase and again before deletion, including how to cancel at the store.
• Consent and policy-acceptance records: while the account exists, then deleted with it.
• The record of each email we send you is kept for 30 days.
• The record of each text message we send you is kept for 30 days. TNZ's separate provider-side retention is disclosed in section 7.
• Support conversations are kept for 6 months after the last message on them. On account deletion, names, addresses, subjects, messages, browser information, and network-address hashes are erased immediately; a de-identified shell containing category, app context, and timestamps remains until that limit.
• Subscription and purchase records: while the subscription is active and for seven tax years after the end of the tax year containing the final transaction. An unresolved refund, chargeback, legal claim, audit, or lawful hold extends retention only for the necessary records and only until resolved or no longer legally required. Store-event facts that cannot yet be linked to a purchase are kept for no more than 30 days for reconciliation; if linked, they follow the purchase record's period, and if still unlinked they are automatically deleted.
• Security and diagnostic logs: 30 days, unless entries relating to a specific incident must be preserved for the investigation or a legal obligation.
• Blocked sign-in tokens: until the token expires, no more than 12 months from issue, so a token issued before deletion cannot be reused. After account deletion the blocked entry identifies no person.

Store-notification bodies are never retained. Only the four facts described in section 3 are used for reconciliation; once linked they remain with the purchase record, and otherwise they follow the 30-day limit above. Nothing about a child is retained after child-data or account erasure for billing, tax, or dispute purposes.

Deletion removes information from the active service at once. Encrypted backups may hold an earlier copy until overwritten or deleted under the applicable schedule; they are unavailable through the app and not used for ordinary operations.

10. Security

We use encryption in transit, hosting-provider encryption at rest, access controls, least-privilege permissions, one-way storage for PINs and codes, rate limits and lockouts, monitoring, backups, supplier review, and secure development practices. No system is perfectly secure. We assess incidents and notify affected people or regulators when applicable law requires it.

11. Your Rights and Data Export

Depending on where you live, you may access, correct, delete, restrict, object to, or receive a portable copy of personal information; withdraw consent; and complain to a regulator. We do not discriminate against anyone for exercising a privacy right.

In the parent area, choose download your data for a machine-readable export of the account, sign-in methods, settings, app installations, subscriptions and store-event facts, support records, communication delivery records, acceptances and consents, and the complete child practice history. The file arrives immediately.

The download presents the information in a useful form rather than repeating technical duplicates. Contact privacy@sweetieears.com if you need additional access information or help understanding the file.

The export omits your parent-area PIN, which we store only as a one-way hash; the one-way recovery-code value; the purchase tokens the app stores issue to our server; the sign-in tokens held by your devices; and widget pictures whose underlying data is already included. These are credentials or derived images, not omissions from the account data.

The file is not stored anywhere. We generate it for that response and keep no copy, link, attachment, and nothing sitting in a bucket afterwards.

You can instead write to privacy@sweetieears.com. We may verify the account using information we already hold. We respond within one calendar month for EU/UK requests and otherwise within 20 working days, subject to extensions permitted by law; we explain any extension. If we refuse a request, we explain why and how to appeal. Reply with appeal for review by a different person, normally within 20 working days. You may complain directly to the relevant regulator at any time.

12. California and Other U.S. State Notices

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. We do not knowingly sell or share personal information of anyone under 16.

The categories we collect are identifiers and contact information; commercial and subscription information; app, device, security, and network activity; support-message contents; and the child practice information and limited inferences described in section 3. Sources are the parent, the child's use of the app, the app, and the app stores. Purposes, recipients, and retention are stated in sections 4, 7, and 9. We collect no precise geolocation, biometric, sensory, health, employment, or advertising data unless a parent voluntarily puts information into a support message despite our request not to.

Sweetie Ears does not track people across third-party sites or apps. A browser Do Not Track signal does not change the service because there is no cross-site tracking to disable. Where Global Privacy Control or another legally recognised signal applies, we treat it as an opt-out; the service is already configured not to sell or share personal information for targeted advertising.

13. Deletion

Parents can use the parent area to withdraw consent and delete only the child record, or delete the entire account. Both actions take effect immediately in the active service and cannot be undone. Account deletion can also be requested by email; full steps are at sweetieears.com/data-deletion. It does not cancel an App Store or Google Play subscription.

Withdrawal deletes the child's learning and practice-time records and widget pictures. Account deletion also removes parent account, sign-in, settings, app-install, acceptance, consent, and communication records; support contents and contact details; unlinked store-event facts; and active sessions.

Section 9 gives the periods for the limited records retained after deletion: purchase and subscription records and linked store-event facts; the minimal account marker needed to connect them; support category, app context, and timestamps after contents and contact details are removed; security and diagnostic logs and blocked-token records; and specific legal holds. We do not retain child learning information for billing, tax, security, support, or disputes. Ask us to remove retained information and we will remove anything not legally required.

14. Changes to This Policy

We may update this policy as the product or law changes. We provide advance notice of material changes where required. An earlier consent does not expand to cover a material change: the app asks again before child-data collection continues.

15. Contact

For privacy, data, or child-privacy questions, contact privacy@sweetieears.com. For general support, contact support@sweetieears.com. You can also contact WAWADATA LIMITED at +64 29 0527 5796 or Hugh HE, WAWADATA LIMITED, 44 Oriana Avenue, Lynfield, Auckland 1042, New Zealand. EU and UK users may instead contact the representative in section 6.