← Birdsay

Privacy Policy

Birdsay — GoodVibesLab

Version of November 10, 2026 · effective from that date

1. Who we are

Birdsay is a pronunciation game for children ages 2 to 8. The same app exists in other languages as ¡Habla!, Parle ! and Fala!; this policy covers all of these versions, as well as the goodvibeslab.app/habla pages.

The data controller is GoodVibesLab, a French single-member limited liability company (EURL) registered with the Paris Trade and Companies Register (RCS) under number 952 035 566, with its registered office at 1 rue de Stockholm, 75008 Paris, France (“we”). For any question about your data: contact@goodvibeslab.app. We have not appointed a data protection officer: this address is the point of contact for every request.

2. The short version

  • No account, no email address, no ads.
  • The app never records your child’s voice: no audio file is created, on the phone or on our servers. To recognize words, the sound goes through the phone’s speech recognition service (Apple or Google), which may process it on the device or on its own servers (section 3.a).
  • Progress and the game log (words played, recognized text, scores) stay on the phone.
  • If you subscribe and ask for the parent analysis, a summary of your child’s attempts (at most 100, with the recognized text, without their name) is sent to OpenAI, whose artificial intelligence writes the analysis (section 3.d).
  • If you enter your child’s first name, it is sent to ElevenLabs to create the spoken greetings (section 3.c).
  • Usage statistics, crash reports and subscription data are tied to random identifiers, with no name or contact details: they are pseudonymous data, not anonymous data.
  • No advertising identifier is collected, and we never sell or rent any data.

3. What we process, why, and for how long

The identifiers described below are random and contain no name or contact details. They are still personal data under the GDPR, the European data protection regulation that applies to us (“pseudonymous” data), and we treat them as such.

a. Speech recognition

Data:
the sound picked up by the microphone while your child speaks, then the text the recognition service derives from it.
Why:
compare what your child says with the expected word and award stars.
Legal basis:
performance of the service you use (GDPR art. 6(1)(b)).
Who receives it:
the phone’s speech recognition service, to which the app streams the sound live, without keeping it. On iPhone and iPad, iOS decides whether to process the sound on the device or on Apple’s servers, depending on the model and language. On Android, the app first asks for the phone speech service’s online recognition (usually Google’s); it switches to the recognition built into the phone when the network fails and the language pack is installed (Android 13 and later). Apple and Google handle this sound under their own privacy terms, not on our behalf. The app only receives the text.
Retention:
neither the app nor we keep the sound. The recognized text is kept on the phone, in the game log (section b).

Some workshop games (rhythm, voice) only measure how loud the voice is, on the phone: nothing is recorded or sent.

b. Progress and game log (on the phone)

Data:
stars, badges, scores, days played, settings, the first name if entered, and a log of recent attempts: expected word, recognized text, score, stars, date and time. The log keeps at most 500 attempts and 500 workshop rounds per language; beyond that, the oldest are erased.
Why:
move your child forward in the game and build the report in the parent area.
Legal basis:
performance of the service (GDPR art. 6(1)(b)).
Who receives it:
no one: this data stays on the phone and is not synced with any server. Only the summary sent for the analysis leaves it, and only if you ask for it (section d).
Retention:
until you erase it. In the parent area, “Reset progress” erases the progress and the log of the current language; the first name is removed separately (section c). Uninstalling the app erases everything.

c. First name and personalized greetings (optional)

Data:
your child’s first name, offered in a window that opens after the first game or entered in the parent area, and the app language.
Why:
have the app’s voice say your child’s name.
Legal basis:
your consent (GDPR art. 6(1)(a)), which you can withdraw at any time by removing the name in the parent area.
Who receives it:
our server function (Google Cloud, United States), which has the phrases generated by ElevenLabs (speech synthesis, United States). Only the first name, the language and the chosen phrases are sent, with no device or user identifier. The resulting audio is stored in our storage (Firebase Storage, Google, United States), in a shared folder sorted by first name and reused for every child with the same name, then downloaded to the phone.
Retention:
on the phone, until you remove the name. The audio files in the shared folder are kept as long as the service exists; on request, we delete those for a given name. ElevenLabs also keeps these phrases in our account’s history, linked to no device or person, until we delete them, which we do for a name together with its audio files.

d. Parent analysis (subscribers)

Data:
only when a subscribing parent taps the analysis button in the parent-area report, the app sends a game summary: the language; at most the last 100 scored attempts, each with the expected word, the recognized text, the score, the recognizer’s confidence, the stars, the attempt number, the world, the difficulty, the date and time; totals (number of attempts and words, period covered, average score); the difficult words, with the most common mistake, and the improving words; a workshop summary (rounds played, a few words with what was heard and, for the listening game, the pictures mixed up). No first name, and no account or device identifier.
Why:
write you a comment on your child’s progress, with ideas for games to play at home. This comment is written automatically by an artificial intelligence: it is not a diagnosis, nor medical or speech-therapy advice.
Legal basis:
performance of the service you subscribed to, at your request (GDPR art. 6(1)(b)).
Who receives it:
our server function (Google Cloud, United States), which rebuilds the summary field by field and sends it to OpenAI (gpt-4o-mini model, United States) through its programming interface. Under its terms, OpenAI does not use data received through this interface to train its models.
Retention:
we keep neither the summary nor the analysis on our servers, and the app shows the analysis without saving it on the phone. OpenAI keeps the exchanges for at most 30 days to detect abuse, then deletes them.

e. Usage statistics

Data:
game events (screens viewed, games started and finished, word played, stars, durations, technical outcome of speech recognition — never the recognized text or the first name), the phone model and operating system, the app version, the language, an approximate location (country, region, city) that Google derives from the IP address, and a random identifier specific to the installation (Firebase). Collection of the advertising identifier and of the device identifier, as well as ad personalization, are turned off in the app.
Why:
understand what works or gets stuck in the game, improve it, and measure the effect of a new version.
Legal basis:
our legitimate interest in improving the app (GDPR art. 6(1)(f)).
Who receives it:
Google (Firebase Analytics, and the copy of the events in our Google BigQuery database, United States), our processor.
Retention:
at most 14 months in Firebase Analytics; 25 months in BigQuery, then deleted automatically.

f. Remote settings and version tests

Data:
the random installation identifier (Firebase), the app version, and the phone’s language, country and time zone.
Why:
adjust a feature without releasing a new version of the app, and compare two variants of a screen (A/B test) on randomly chosen installations.
Legal basis:
our legitimate interest (GDPR art. 6(1)(f)).
Who receives it:
Google (Firebase Remote Config, Firebase A/B Testing), our processor.
Retention:
Firebase keeps the installation identifier until we request its deletion (it is then erased within 180 days). Reinstalling the app creates a new identifier.

g. Crash reports

Data:
the technical trace of the error, the phone model and operating system, the app version, the language, the current screen and world, the last statistics events before the error, and random installation identifiers (Crashlytics and Firebase). Never the first name.
Why:
detect and fix errors.
Legal basis:
our legitimate interest (GDPR art. 6(1)(f)).
Who receives it:
Google (Firebase Crashlytics, and the copy of the reports in our Google BigQuery database, United States), our processor.
Retention:
90 days in Crashlytics; 25 months in BigQuery, then deleted automatically.

h. Protecting our servers

Data:
an attestation token provided by the operating system (DeviceCheck on iOS, Play Integrity on Android) and, for each request to our server functions (greetings, analysis), the IP address, the date and technical details of the request.
Why:
check that requests to our server functions really come from the app, diagnose errors, and protect these functions, which trigger paid services.
Legal basis:
our legitimate interest in securing the service (GDPR art. 6(1)(f)).
Who receives it:
Google (Firebase App Check, Google Cloud), our processor.
Retention:
Firebase does not keep the attestation material, and the token is only valid for a short time. The logs of our server functions are erased after 30 days.

i. Subscriptions

Data:
a random purchase identifier (RevenueCat), the transactions sent by the store (offer, price, currency, country, purchase, trial and renewal dates), the phone model and operating system, the app version, and the IP address during exchanges.
Why:
know which languages are unlocked, and manage the trial, renewals and purchase restores.
Legal basis:
performance of the subscription contract (GDPR art. 6(1)(b)).
Who receives it:
RevenueCat (United States), our processor. Payment is handled by the App Store (Apple) or Google Play, under their own responsibility: we never have access to your payment details, your name or your email address.
Retention:
for the duration of the subscription, then 3 years after it ends.

j. Downloaded content

Data:
the phone’s IP address and the technical details of the request.
Why:
download the word audio and the game content.
Legal basis:
performance of the service (GDPR art. 6(1)(b)).
Who receives it:
Google (Firebase Storage, United States), our processor.
Retention:
we keep no log of these downloads.

k. Messages to support

Data:
your email address, your message, and what the app adds below your text when you write from the parent area: app name and version, operating system and version, language. Nothing about your child.
Why:
reply to you.
Legal basis:
our legitimate interest in answering requests (GDPR art. 6(1)(f)).
Who receives it:
Mailgun (Sinch, United States), which receives messages sent to contact@goodvibeslab.app, and Google (Gmail), where we read them.
Retention:
3 years after our last exchange.

l. The goodvibeslab.app/habla website

Data:
the IP address, the browser and operating system, the page visited, the referring page and an approximate location. No analytics or advertising cookies.
Why:
serve the pages and count visits in aggregate.
Legal basis:
our legitimate interest (GDPR art. 6(1)(f)).
Who receives it:
Vercel (hosting and Vercel Web Analytics, United States), our processor.
Retention:
audience measurement recognizes a visit by a fingerprint computed from the request, erased after 24 hours, and then keeps only data with no identifier. The host’s technical logs are erased after 3 days at most.

Reminder notifications are scheduled on the phone itself: they do not go through any server.

4. What we don’t do

  • record or keep your child’s voice;
  • show ads, collect the advertising identifier, or track your child across other apps or websites;
  • sell or rent data, or share it for commercial purposes;
  • ask for an account, an email address or a phone number;
  • access the phone’s location (only an approximate location is derived from the IP address, for statistics);
  • make automated decisions that have legal effects on you or similarly significantly affect you: stars and the analysis are game feedback, with no other consequence.

5. Children and parental control

Birdsay is made for children and is used under a parent’s responsibility. Subscribing, the parent analysis, writing to support and the settings are behind a parental gate (a math question to solve). The first name can be entered in the window that opens after the first game or in the parent area; you can change or remove it at any time from the parent area. If you believe a child has sent us data without your permission, write to us and we will delete it.

6. Processors and transfers outside the European Union

The following providers process data on our behalf, following our instructions:

  • Google (Firebase, Google Cloud, BigQuery) — United States;
  • RevenueCat, Inc. (subscriptions) — United States;
  • OpenAI (parent analysis) — United States;
  • ElevenLabs (personalized greetings) — United States;
  • Vercel Inc. (website) — United States;
  • Mailgun / Sinch and Google (Gmail) (support email) — United States.

Acting under their own responsibility: Apple and Google for the phone’s speech recognition, and the App Store and Google Play for purchases.

Because we are based in France, sending data to the United States is a transfer outside the European Union. These transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework for certified providers and, failing that, on the standard contractual clauses adopted by the European Commission. You can ask us for a copy of these safeguards.

7. Your rights

You can ask to access your data, correct it, delete it, restrict its processing or receive it in a portable format; object to processing based on our legitimate interest; withdraw your consent at any time; and set instructions for what happens to your data after your death. Write to contact@goodvibeslab.app; we reply within one month.

Since we don’t know your name or email address (unless you write to us), we can only find some data if you help us identify it, for example the first name entered for the greetings. Statistics and crash reports are tied to an installation identifier that the app does not display: without it, we cannot link them to a request. Uninstalling the app breaks the link between the phone and this data. The data left on the phone you erase yourself (section 3.b). Practical steps are at goodvibeslab.app/habla/en/delete-data.

If you believe your rights have not been respected, you can file a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr). If you live outside France, you can also contact the data protection authority of your country.

8. Security

Exchanges with our servers are encrypted (HTTPS). The keys to paid services stay on our servers, never in the app. We only collect what the game or its improvement needs.

9. Changes

We will post any change on this page, with its new version date.

10. Contact

GoodVibesLab, 1 rue de Stockholm, 75008 Paris, France
contact@goodvibeslab.app

TermsSupport

GoodVibesLab · contact@goodvibeslab.app