Privacy Policy

This policy explains what data the Karo app and the karo-learn.com website (together, the "Service") collect, why that data is needed and what choices you have. By using Karo, you agree to what is described here.

Our approach

The best way to protect data is not to hold on to more than you need. So we collect the minimum, we do not sell personal data, and we do not show the contents of your learning to anyone but you.

What we collect

Account. Your email address and display name when you sign in with Google or with email. We never see or store your password: it is protected by the sign-in provider (Firebase Authentication).

Learning. Your lesson progress, streak, experience (XP), review history, achievements and settings, so we can save and sync where you left off.

Technical data. Device model, system and app version, interface language, an anonymous installation identifier and crash reports.

Account security. When you change your password or sign in from a new device, we work out your approximate region from your IP address through a third-party geolocation service, so we can warn you by email. The IP address itself is not stored in the email.

Ads (free plan only). If you use Karo for free, the advertising provider (Google AdMob) may use your device's advertising identifier to show and measure ads. There are no ads in Karo Pro.

Payments. Purchases are handled by the app store and its payment providers. Your card details never reach us.

Notifications. If you turn on push notifications, we store your device token (Firebase Cloud Messaging) so we can remind you to practice. You can turn them off in the app settings or in your system settings.

Email. The welcome email, confirmation codes and account security warnings are sent through the Resend email service. Only your address and the text of the message are passed to it.

Microphone and pronunciation

Pronunciation exercises ask for access to the microphone. The permission is requested only at the moment you tap the record button yourself, and you can refuse it.

Speech is recognised by the Android speech service built into your phone, not by Karo. We do not record, store or receive your voice: the app gets back only the recognised text, and it is compared with the correct answer on the device itself. Neither the audio nor that text is sent to our servers.

Why we need it

To run the Service; to save your progress and carry it between devices; to find and fix bugs; to protect accounts from other people's access; to tell you about important changes. The contents of your learning are never used for advertising.

Analytics and crash reports

We use Google Firebase (Analytics and Crashlytics) on anonymized, aggregated data, so we can see which lessons work and fix crashes. There is no third-party behavioral ad tracking inside the lessons.

Protection against abuse

To stop automated abuse we apply server-side access rules and request rate limits, and we may verify that requests come from the genuine Karo app (Google Play Integrity). That check uses technical signals, not the contents of your learning.

Legal bases (GDPR)

Where GDPR applies, we process data to perform our contract with you (running the app), in our legitimate interests (security and improving the product), with your consent where consent is required, and to comply with the law. You can withdraw your consent at any time.

Who we share data with

We do not sell or rent your personal data. It is seen only by the contractors who work on our behalf: Google Firebase (hosting, sign-in, sync, crash analytics), Google AdMob (ads on the free plan), the app store (purchases), Resend (sending email) and an IP geolocation service (for security warnings only). Data may also be disclosed to public authorities where the law requires it, and to a successor if the business is sold, under the same protections.

Storage and deletion

We keep your data while your account is active. You can delete your account together with all of its data in the app: Profile, then Settings, then "Delete account". Or write to us. After deletion, the related data is erased or anonymized within a reasonable period, normally up to 90 days, unless the law requires otherwise.

Security

Data travels over a secure connection (TLS), access to it is limited by server-side rules, and every check runs on the server, not only in the app. No protection is perfect, but we take reasonable measures.

Your rights

Depending on your country (including GDPR and CCPA), you have the right to access, correct, delete, restrict or object to processing, to data portability and to withdraw consent. Write to support@karo-learn.com and we will answer. Using your rights will never count against you.

Children

Karo is not intended for children under 13, and we do not knowingly collect their data without the consent of a parent or guardian. If we learn that we have, we will delete it.

International data transfers

Your data may be processed on servers in other countries, including the European Union and the United States. In those cases we apply the safeguards required by law, such as standard contractual clauses.

Changes

We may update this policy. We will announce important changes in the app or by email and update the date at the top. By continuing to use Karo, you accept the updated policy.

Contact us

Questions about data and general support: support@karo-learn.com.