Your data

Privacy policy

Kawi respects your privacy and the General Data Protection Regulation (GDPR). This page explains what data we collect and why.

What we collect

On this site, the only personal data we collect directly is your email address, and only when you enter it yourself in a form to be notified about the launch or to get in touch. We also measure how the site is used, within the limits of what you agree to (see "Audience measurement" below). No advertising tracker is loaded without your consent (see “Meta ads” below).

For the Kawi app, see the "The Kawi app" section below.

Audience measurement

To understand how the site is used and improve it, we measure audience with PostHog, hosted in the European Union, acting as a data processor. No data leaves the European Union, and none is used for advertising or sold.

This measurement works at two levels, depending on your choice. Without your consent, it stays anonymous: nothing is stored on your device, your IP address is anonymised, and we only see aggregate statistics (page views, device type, approximate country). With your consent, a cookie lets us recognise your browser from one page to the next: we then measure your journey through the site and record your navigation in anonymised form (movement, clicks, scrolling).

What you type is never recorded. Form fields are masked at the source: we see neither your email address nor any text you enter, even once you have accepted measurement.

The legal basis for this measurement is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time, and doing so changes nothing about your browsing.

Cookies and trackers

The kawi_consent cookie is set whatever your choice, including a refusal: its only purpose is to remember that choice so we stop asking. On that basis it is exempt from consent.

Meta ads: if you accept, the Meta pixel measures how well our ads on Facebook and Instagram work. It sends Meta the pages viewed and the fact that a sign-up happened, never your email address. Meta Platforms Ireland is joint controller for this processing and may transfer data to the United States (EU-US Data Privacy Framework); see its privacy policy. Legal basis: your consent. This pixel only concerns the kawi.lu website: the Kawi app contains no tracker and no advertising.

Kawi TV videos: until you start a video, the page does not contact YouTube. When you click, the player loads from youtube-nocookie.com and YouTube’s own rules then apply, as described in Google’s privacy policy.

Withdrawing your consent: click "Manage cookies" at the bottom of any page. Your choice is erased and the banner reappears.

Why

Your email is used solely to keep you informed about the launch of Kawi and the news that concerns you. It is never sold or passed on to third parties for commercial purposes.

Where your data is stored

The emails we collect are stored via Cloudflare (the site's host). Information emails about Kawi (news, the app's release) are sent to you by Brevo (Brevo SAS, Paris, France), acting as a processor: it receives your email address and your language, and uses them for nothing else. Every email contains a one-click unsubscribe link. Brevo covers any transfer outside the European Union with the safeguards provided by the GDPR. Service emails (sign-in codes, welcome message) are still sent by Cloudflare.

App data: see "The Kawi app".

How long we keep it

Your email is kept until launch and then for as long as needed for our relationship, or until you ask us to delete it.

For the app, see "The Kawi app".

Your rights

In accordance with the GDPR, you have the right to access, correct and delete your data, as well as the right to withdraw your consent at any time. To exercise these rights: moien@kawi.lu.

You also have the right to data portability and the right to object to processing. To delete your app account, see "Delete your Kawi account". You can also lodge a complaint with the data protection authority of your country; in Luxembourg, the CNPD (cnpd.public.lu).

The Kawi app

Who is responsible. The data controller is Steven Lozach, reachable at moien@kawi.lu.

Without an account. Kawi works without an account. Your children's profiles (first name or nickname, age range, avatar) and their progress stay on your phone. Only two things leave it: the anonymous statistics (below) and, for subscriptions, the exchanges with Apple or Google and with our provider RevenueCat.

With an account (backup). If you create an account to find your children's progress on another phone, we store:

• your email address;
• for each child: their first name (or a nickname), their age range (never a date of birth), their avatar and the Kawi they designed;
• their progress: the words and games completed, their hazelnuts and what they did with them, their level, the days they played, how far they got on the path and the date the subscription offer was shown;
• your answer about how much Luxembourgish your child already hears;
• the phones signed in to the account (a fingerprint of the sign-in token, never the token itself).

This data is used to back up and restore progress on another phone and, as totals, for our internal analysis to tune the difficulty of the games. Your children's first names never enter these analyses. The data is never sold or used for advertising.

News by email. If you agree (the box is never pre-ticked), we keep the date of your consent and the version of the text you accepted, and we write to you at most once a month. Every email has an unsubscribe link, and you can also withdraw your consent in the app.

Anonymous statistics, with or without an account. At the end of each session, the app sends the day, the part of the day when it started (morning, midday, afternoon, evening or night), how long Kawi has been played on this phone (first day, next day, under a week, under a month or longer) and whether this is the first session of the day, the age chosen for the child (3 to 6, never a date of birth) and whether this is the first time statistics are sent for this child from this phone, the level, the place, your answer about the Luxembourgish your child hears and, for each game, the number of answers and successes. No identifier is sent (not the phone's, the account's or the child's), and no exact time: the part of the day only tells us when reminders are useful, and the time since the first session to know whether families come back. The date of the first session never leaves the phone. Your IP address is only used, for the duration of the request, to limit abusive sending: it is not stored. We only keep totals per day, per part of the day, per time since the first session and per age. You can turn this off at any time in the parent area ("Help Kawi get better").

How the app is used, with or without an account. When the app goes to the background, it sends the day's counters, taken from a list fixed in advance: app openings, children created, sessions started, finished or left (and at which activity), screens viewed, subscription offer seen and the outcome of a purchase, reminders accepted or opened, shop exchanges, words seen and words missed. With them go the interface language, the type of device (phone or tablet), the app version and how long Kawi has been used on this phone. No identifier, no time of day, no first name: these totals help us understand what helps families and what stops them. Same switch as the anonymous statistics ("Help Kawi improve").

Subscriptions. Payment is handled by Apple (App Store) or Google (Google Play): we never see your payment details. Our provider RevenueCat, Inc. checks the subscription using an anonymous purchase identifier created by the app, the purchase history, the language of the app's interface (French, German, English or Portuguese) and technical data about the phone (model, system version, language, store country, IP address and, on iPhone and iPad, a device identifier specific to our app). RevenueCat never receives your email address or your children's first names.

Your child's voice. In the "Repeat" game, the microphone records your child so they can hear themselves right away. The recording stays on the phone, is never sent, and is deleted at the next question.

What we do not collect. No date of birth, no location, no contacts, no photos, no advertising identifier, no ads.

Our providers. Cloudflare, Inc. hosts the backup and the statistics, and sends the emails (sign-in codes, news). RevenueCat, Inc. checks subscriptions. Apple and Google handle payments under their own rules. Cloudflare and RevenueCat are US companies acting on our behalf; transfers outside the European Union are covered by the EU-US Data Privacy Framework for Cloudflare, and by the European Commission's standard contractual clauses for RevenueCat.

How long we keep data.

• The account, the family backup and the consent to news: until you delete them (see "Delete your Kawi account").
• A sign-in code is valid for 10 minutes. Code requests (your email and a fingerprint of the code) are deleted at the latest 24 hours after they are sent.
• A phone stays signed in for 365 days at most.
• Anonymous statistics are totals per day, per part of the day, per time since the first session and per age, with no personal data.
• Technical backup copies of our database disappear on their own within 30 days.

Legal basis. The backup and subscriptions: performing the service you ask for (Article 6(1)(b) GDPR). News by email: your consent (6(1)(a)). Anonymous statistics and the security of the service: our legitimate interest in improving the games (6(1)(f)), which you can switch off at any time.

Delete your Kawi account

You can delete your Kawi app account and the data linked to it at any time.

In the app. Tap your child's avatar, then "Parent area", and follow the short code instruction. Open "Account and backup", tap "Erase the backup", then confirm with "Erase". Deletion is immediate. On a new phone, first sign in with your email and the code you receive, then do the same.

Without the app. Email moien@kawi.lu with the email address of the account. We reply to that address to confirm the request comes from you, then delete the account within 30 days of your confirmation.

What is deleted. Your email address, your consent to news, the family backup (first names, age ranges, avatars, progress), the signed-in phones and the sign-in codes.

What remains.

• The progress kept on your phone: it disappears when you delete the child's profile in the parent area, or when you uninstall the app.
• The anonymous statistics already added up: they are totals without any identifier, which cannot be linked to anyone.
• Technical backup copies of our database, deleted on their own within 30 days.
• Purchase data kept by Apple, Google and RevenueCat, which is not linked to your Kawi account.

Your subscription is not cancelled when you delete your account. To stop it: on iPhone or iPad, Settings > your name > Subscriptions; on Android, Google Play app > Payments & subscriptions > Subscriptions.

Kawi TV and the YouTube API Services

Kawi uses the YouTube API Services to publish and update the videos of its own Kawi TV channel. This is an internal tool: no data about website visitors or app users is collected through it.

By watching Kawi TV videos, you agree to the YouTube Terms of Service. Data processed by YouTube is covered by the Google Privacy Policy.

To revoke access granted to an application through the YouTube API: your Google account security settings. To request data deletion: moien@kawi.lu.

Contact

For any question about your data: moien@kawi.lu.