Privacy Policy
Effective date: 20 August 2026 · Version 1.2 (updated 25 October 2026: section 14, problem reports; 24 October 2026: section 13, YouTube API Services)
1. Who we are
YAKKI ("YAKKI", "we", "us") is an educational application for language learning by children of school age. At this stage the data operator is Baruch Chazon, acting as a private individual (Israel). For any data-related questions, contact us at [email protected].
2. Who this policy applies to
YAKKI operates on a tutor-mediated model: student accounts are created by the Tutor or Studio, who obtain parental consent. Our users are Tutors (adults), Students (children), and Parents.
3. What data we collect
- When a student is enrolled (entered by the Tutor): the parent's email, a nickname, and the child's age. The password is generated automatically and sent to the email provided.
- When a Parent activates the account: the child's age and the fact and date of consent (the legal basis for processing).
- During learning: answers and entered text, speech (audio for pronunciation assessment and recognition), results, scores, progress, collected words, and typical errors (the learning profile).
- Technical data: a random device identifier (not an advertising identifier, not ANDROID_ID or IMEI), device model and version; an IP address only when a contact form is submitted (to protect against abuse).
We do NOT collect: precise geolocation, phone number, advertising identifier, or contacts. We do not run advertising or third-party analytics, and we include no advertising SDKs.
4. How we use data
Exclusively for educational purposes: teaching, assessment, personalization, and the learning profile.
We do NOT show advertising, profile users for advertising, or sell data — and we do NOT use student data (text, speech, transcripts) to train AI models, neither we nor our subprocessors. Processing is carried out under contract with the use of data for model training switched off.
5. Children's data (special protection)
- All students are treated as minors with the highest level of protection. The consent threshold is 16 years (with an additional "under 13" rule for COPPA).
- Parental consent is obtained by the Tutor or Studio before a child is given access; for contexts without an intermediary, consent is obtained directly from the Parent. The Parent is notified of the data collection (the email provided when the student is enrolled serves as the notification channel).
- Right to withdraw: a Parent may withdraw consent at any time; processing then stops and, on request, the data is deleted.
- Content safety: learning content is generated by AI with the provider's child-content filtering enabled (Microsoft Azure). Final pedagogical decisions are made by a human (the Tutor), not by AI.
6. Who we share data with (subprocessors)
We share data only with service providers acting under a data processing agreement (DPA) that obligates them not to retain data beyond what processing requires and not to train models on it. We do not share data with advertisers, data brokers, or third-party trackers.
| Subprocessor | What it receives | Purpose | Residency |
|---|---|---|---|
| Microsoft Azure OpenAI | Student answer text | Generating learning content; checking and assessing answers | EU (Sweden Central, Data Zone) |
| Microsoft Azure Speech | Student speech (audio) plus the reference text | Speech recognition (STT) and pronunciation assessment | EU (Sweden Central) |
| Google Cloud Text-to-Speech | System text to be voiced (tasks, words) — not the student's personal data | Speech synthesis for playback | Global (receives system content, not children's personal data) |
| Google Cloud Vertex AI and Gemini API | System text and prompts for producing lesson material and videos — not the student's personal data | Producing learning content, voice-over and video lessons before publication | EU regions; video generation in the US where the model is not offered in the EU |
| Zoho Mail (SMTP) | Email addresses and message bodies (account details, notifications) | Delivering account details and notifications to the Parent | Zoho email infrastructure |
| Google Cloud (backend hosting) | All application data (storage) | Hosting the YAKKI service and database | Israel (Tel Aviv region, me-west1) |
Speech (voice): processed solely for speech recognition and pronunciation assessment; it is not used for biometric identification, and no voiceprint is created. Audio is not stored on our servers — it is passed to the provider and then deleted. Processing of children's speech takes place in the EU (Microsoft Azure, Sweden Central).
7. Where data is stored and processed
- Storage: application data (including student data) is stored on YAKKI's servers in Israel (Google Cloud, Tel Aviv region,
me-west1). Israel has been recognized by the European Commission as a country providing an adequate level of data protection (an adequacy decision), so transferring children's data from the EEA to Israel is lawful without additional mechanisms. - AI processing (content generation, speech recognition, and assessment): in the EU (Microsoft Azure, Sweden Central region) — children's data from the EEA does not leave the EU during AI processing.
- Speech synthesis (TTS) is performed by Google on the system text of tasks and words — the student's personal data is not sent there.
8. Retention periods
- AI verification events (request/response) — 7 days, then automatically deleted.
- Speech audio — not stored (processed and deleted).
- Learning results, profile, and errors — until the account is deleted; kept no longer than necessary for the educational purpose.
- Consent records — for the duration of the relationship and thereafter as needed to establish or defend legal claims.
- IP addresses from the contact form — within the retention period of our technical logs.
9. Your rights
You have the rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and the right not to be subject to a significant automated decision without human involvement. On a child's behalf these rights are exercised by the Parent or guardian (in a studio, under the Studio's policy). Our response time is 30 days. Contact channel: [email protected].
10. Account deletion
Deletion is available from within the application (a Tutor deletes a student's account in the tutor area; a user can delete their own) and at a public address:
- https://www.yakki.app/en/legal/delete-account.html (EN) / https://www.yakki.app/ru/legal/delete-account.html (RU).
We delete the learning records, answers, results, profile, and email traces. Narrow lawful exceptions (security logs) are kept for their own short retention period.
11. Security
Data in transit is protected with TLS/HTTPS; passwords are stored as a cryptographic hash (bcrypt); account secrets on the device are encrypted; access is role-based (a Tutor sees only their own students). We apply reasonable technical and organizational measures. No system is perfectly secure, but we protect children's data in proportion to the risks.
12. No advertising or trackers
YAKKI contains no advertising, no advertising identifiers, and no third-party advertising or analytics SDKs, and it does not perform behavioral targeting. We do not sell data.
13. YouTube API Services
YAKKI uses YouTube API Services to publish and manage videos on its own YouTube channel, YAKKI EDU (@Yakki-Edu): uploading our video lessons, editing their titles, descriptions and playlists, and posting one comment under our own videos with a link to a free practice page.
- YouTube and Google terms. When you watch YAKKI videos or use YAKKI content on YouTube, you are also bound by the YouTube Terms of Service, and YouTube handles your data under the Google Privacy Policy.
- What data our API client accesses. Only the data of our own channel: our videos, their metadata and playlists, our own comments, and our channel's statistics. The client is run only by our own server-side scripts and is authorized only by the channel owner. We do not collect, store, or share any data of website visitors, app users, or YouTube viewers through the YouTube API, and we never ask anyone to sign in with Google for it.
- Storage and deletion. The authorization token for our channel is kept only on our own computer and is never published. We keep only the IDs and public links of our own videos. Because we hold no data of YouTube users, there is nothing of theirs to delete; correspondence sent to us is deleted on request.
- Revoking access. If you have ever authorized any application to access your Google account, you can revoke that access at any time in your Google security settings: security.google.com/settings/security/permissions.
- Questions about our use of YouTube API Services: [email protected].
14. Problem reports ("Report a problem")
The YAKKI app has a "Report a problem" button. A report is sent only when you press it and confirm; sending one is voluntary.
- What a report contains. The category you choose (for example, "I'm stuck" or "wrong content"); for adult users (and for visitors of the web version who are not signed in), an optional short text (up to 280 characters) from which personal details such as email addresses, phone numbers and links are automatically removed before it is stored; the platform (Android or web); the app version; the operating system version, interface language and device type (phone, tablet or computer); the template of the screen the report came from (for example, "game screen", never what was on it); a short list of the last screen templates and error codes before the report; and a technical request number (request-id) generated by our server.
- What a report never contains. No screenshots, no logs or screen recordings, no audio, no IP address, no device identifier, no contacts, no location. To limit abuse, our server counts reports per network address only in its memory and in hashed form; the address itself is not saved.
- Students and children. A student account (including a child account), anyone using the Android app without signing in, and anyone who opened a student's practice link can only choose a category: the text field is not shown to them, and our server refuses text from them.
- Link to an account. A report from a signed-in user carries a pseudonymous key (a keyed hash of the account identifier), not a name or email address. It is used only to apply limits and to delete the reports together with the account. A report sent without signing in is not linked to anyone.
- Retention. The report text is erased 30 days after the report is sent; the whole report is deleted 90 days after it is sent. The automatic removal of personal details is heuristic, which is why the text is kept for the shortest time.
- Deletion. When an account is deleted, its reports are deleted with it. A report sent without signing in cannot be found by person and therefore cannot be deleted on request; it is deleted automatically after 90 days.
- Use. Reports are stored on our servers in Israel (see section 7), are used only to find and fix errors in YAKKI, and are not passed to AI providers, advertisers or other third parties.
15. Changes to this policy
For material changes (including a new subprocessor or an expansion of children's data processing) we give advance notice; any expansion of children's data processing requires renewed parental consent.
16. Contact
[email protected] — for privacy questions and for exercising data-subject rights and deletion.