Privacy policy

Last updated: 11 October 2026.

Who we are

Kalimo is a reading app for children aged 4 to 10. The account belongs to the parent: a child has no account, no email address and no password.

Data controller: the publisher of the Kalimo app, reachable at [email protected].

In short

• No advertising and no selling of data. The only measurements handled by another company are app launch counts and crash reports, with Expo (see below).
• The app does not read the phone's advertising ID.
• Kalimo never records your child's voice.
• You can delete your account and all your children's data at any time, in the app, on our website or by email.

The parent's data

• Email address, first name and last name: to create and manage the account, to send the verification and new-password emails, and the emails about your children's access to the stories.
• Phone number, if you give it: optional, only to contact you about your account.
• Password: never kept in readable form. It is kept hashed by SuperTokens, the sign-in service we host ourselves on our server.
• If you turn notifications on (Kalimo asks after you sign in whether you want them): the phone's notification address (an Expo token), the app's language and the phone's time zone, to send at most one reading reminder a day, at a suitable time, and to announce new stories for your children's class; and the kinds of message you chose. The log of reminders sent (the day and the kind of message) is erased after 30 days; the list of stories already announced is kept while the account and the story exist, so the same one is never announced twice.

The child's data

For each profile, the parent gives:

• a nickname, which does not need to be the child's real first name;
• an avatar: the colour of a parrot, picked from a list, never a photo;
• the school year, from CP to CM2 (French primary school years). We ask for neither age nor date of birth.

While the app is used, it records:

• progress in each story, and favourite stories;
• coins earned and spent, and the parrot companion (its name, outfits, scenery and food);
• words misread, counted per day and erased after 30 days;
• read-aloud accuracy (the number of words read correctly and of words read, per level);
• how long read-aloud listening ran, per day;
• the days the child read (one date per day, nothing else), for their reading week and streak;
• reading time in “I read on my own”, per day (no time of day), and the daily challenge with what fills it (the pages read alone and the stories finished, per day);
• a narration speed suited to the child (a single number);
• their access to the stories: when their free period ends, the paid offer and when it ends, and, with one story a day, the day's story (only today's);
• the emails sent about them (their kind and date).

This data runs the app and shows the parent how each child is progressing. We never collect the child's real name, email address, phone number, date of birth, photo or location.

It is kept as long as the account exists and erased with it. An inactive account is not deleted automatically: you can delete it at any time.

Each night we also use this data to compute totals over groups of children (for example how many children read a story, pages read per day, or the hardest words), to improve the stories and the app. These totals hold no identifier, no name and no time of day, only days. They are computed on our servers, handed to no other company, and only the Kalimo team sees them. After an account is deleted, past days' totals remain, with no link to your child any more.

The child's voice

During read-aloud, the microphone's sound is streamed live, through Kalimo's server, to Deepgram, a speech recognition service, on its European endpoint (api.eu.deepgram.com). It is used to recognise the words read, to colour them on screen.

• Kalimo never records this sound: it passes through our server without being stored.
• We ask Deepgram not to use this sound to train its models (the mip_opt_out option). According to Deepgram's documentation, data from these requests is retained only for the duration necessary to process them.
• Deepgram also receives the proper names on the page being read (words from the story), never the child's nickname or anything about the child or you.
• Kalimo keeps only the daily listening time, the read-aloud accuracy and the misread words described above.

The story voices

Stories are told by synthetic voices from Cartesia and ElevenLabs. These services receive only the story's text, the chosen voice and the language, never any data about you or your children.

How the app runs

The app uses two tools from Expo, the platform it is built on:

• Expo Insights, at each launch: a random identifier for the installation, the app version, the phone's system and its version. Expo also sees the IP address.
• EAS Observe: the same kind of random identifier, start-up timings, the phone model, its system, battery and network type; after a crash, the error message, its technical trace and the country.

No child, no parent and no screen is attached to either.

Notifications

Kalimo asks after you sign in whether you want them; you can also turn them on in the parent area. Messages go through Expo's notification service, then through Google (Firebase Cloud Messaging) on Android or Apple on iPhone. Firebase uses an installation identifier, which is not the advertising ID. A message never contains the child's nickname or anything about their reading; it may contain the parrot's name. It also carries, without showing it, the technical id of the profile it is about, so the app opens in the right place: that code says nothing about the child. To choose that profile, we compare how many pages each child read in the week, without storing anything more.

Payments

Nothing is paid in the app. Payment goes through Konnect, a payment provider based in Tunisia.

• Konnect receives from us the amount, a payment number and the word "Kalimo", never your name, your address or anything about your children. What you type on its page (bank card, wallet, e-DINAR) is handled by Konnect under its own policy: we never see your bank details.
• For each payment, we keep the amount, the offers, the children it was for, the dates and Konnect's reference. If you delete your account, the payment stays to keep our accounts, without your name, your address or your children's names. It keeps Konnect's reference, under which Konnect holds what you entered on its page, and a month given by hand stays in the console's log with the account's and the child's internal ids. It is kept for 10 years.
• Of the payment link, we keep only a fingerprint, which cannot open it. It expires after 14 days and is erased with the account.
• The free period is given once per email address. For that, we keep a fingerprint of your address (a code computed from it with a secret key, which does not contain the address), even after the account is deleted: a new account opened with the same address does not get another free period. It is kept for 3 years.

Emails

The verification and new-password emails are sent by Brevo, which receives your address and the message. They show a picture of the parrot, the same for everyone, which cannot tell us whether you opened the email.

The emails about your children's access (welcome, the free period or paid month ending in 7, 3 and 1 days, the last day) also go through Brevo, which then receives your address, the nicknames of the children concerned, the end dates and a payment link. They are written in the language and at the time of your newest phone if you turned notifications on, otherwise in French, on Paris time.

Hosting and storage

• Kalimo's server (the app's server, the database and the sign-in service) is a virtual private server rented from Hostinger, located in France (Paris).
• Illustrations, story voices and the words those voices speak are stored with Backblaze B2, in a United States region. This storage holds no data about you or your children.
• The server keeps technical logs to run and stay secure. They never contain the child's voice. A server backup, if one exists, may hold the account's data for as long as it is kept. No period is set yet for these logs and backups.
• Some providers are based outside the European Union, mainly in the United States: Expo, Google, Apple, Cartesia, ElevenLabs, Deepgram (which receives the voice on its European endpoint) and Backblaze (which stores no data about you), and Konnect, in Tunisia, for payment.

Who can see your data

The Kalimo team, from its administration console, can find an account by its email address to help you, export it, correct it or delete it. Each of these actions is written to a log that keeps the account's internal identifier and the names of the fields changed, never their content. It also sees the account's payments and each child's access, and can give a child a month: that gift is written to the log with the child's internal identifier and the offer.

Deleting your account

In the app, in the parent area, or without the app, with the form on our website or by writing to us: the steps are on the Delete your account page. Deleting erases the account, your children's profiles and everything attached to them, except the payments, kept without your name or your children's, and the fingerprint of your address (see "Payments"). The email address sent with the form is kept only until we have handled the request, then erased.

Why we process this data

• The account, the children's profiles, read-aloud and the account emails: to provide the service you ask for by creating an account.
• Access to the stories, payments and the emails about your children's access: to provide the service you pay for.
• Payments kept after the account is deleted: our obligation to keep our accounts.
• The fingerprint of your address: our legitimate interest in giving the free period only once.
• Notifications: with your consent, which you withdraw by turning them off in the parent area.
• Launch counts and crash reports: our legitimate interest in running the app and fixing its errors.
• Totals over groups of children: our legitimate interest in improving the stories and the app.
• A child's data is given by their parent, who creates and manages the child's profile from their own account.

Your rights

You can ask for access to your data, a copy, a correction or its deletion, or object to a processing, by writing to [email protected]. You can also complain to the CNIL, the French data protection authority (cnil.fr).