Privacy Policy

Last updated: 15 June 2026 · Version 1.0

This Privacy Policy explains what personal data we collect in the Vabyk app and websites (the “Service”), how and why we process it, with whom we share it, and what rights you have. Vabyk is an educational speech-practice app for children. An account is created solely by an adult (a parent or other legal guardian of the child); children do not register on their own.

By using the Service you confirm that you have read this Policy. If you do not agree with it, please do not use the Service.

1. Who is the data controller

The data controller is Taras Gordiienko, acting as a sole proprietor (FOP) registered in Ukraine (“we”, “us”, “Vabyk”).

For any questions about the processing of personal data, contact support@vabyk.com.

2. Who this Policy applies to

This Policy covers two categories of people: (a) the adult account holder who registers and uses the Service; and (b) the child whose profile the adult creates within their account. A child's data is processed only on the basis of, and within the scope of, the adult's consent and instructions.

3. Data we collect

• Adult account data: email address and a unique identifier provided by the sign-in service (Google or Apple Sign In). We do not receive or store your password for those services.
• Child profile data entered by the adult: name or nickname, date of birth (to tailor difficulty by age), timezone.
• Lesson and progress data: game results (success/failure), levels, streaks, collected “moths”, and internal progression metrics.
• Technical and analytics data: anonymized usage statistics, device and operating-system type, crash and error logs, and approximate interaction data.
• Subscription-related data: subscription status and the fact/date of purchase. We do not receive or store payment details (such as card numbers) — payments are processed by the App Store or Google Play.
• Support communications: the content of your correspondence with us.

We deliberately minimize the amount of data we collect about a child and do not collect more than is necessary to run the lessons.

4. Legal bases for processing (for EU/EEA users)

• Performance of a contract (Art. 6(1)(b) GDPR): creating the account, providing lessons, tracking progress, and supporting subscriptions.
• Consent (Art. 6(1)(a) and Art. 8 GDPR): processing the child profile and optional analytics. Consent is given by the adult and may be withdrawn at any time.
• Legitimate interests (Art. 6(1)(f) GDPR): ensuring security, preventing abuse, basic error diagnostics, and improving the Service, to the extent these do not override your rights.
• Compliance with legal obligations (Art. 6(1)(c) GDPR): retaining data where required by law.

5. Children's data and parental consent

The Service is intended to be used by children under adult supervision. A child cannot register, submit data, or make a purchase on their own. By creating a child profile, the adult confirms that they are the child's parent or legal guardian and are entitled to consent to the processing of the child's data.

For EU/EEA users, a child's data is processed on the basis of the adult's consent under Art. 8 GDPR. For US users, we act in line with the Children's Online Privacy Protection Act (COPPA): we collect the minimum data needed to run the Service, do not require a child to disclose unnecessary information, and give the adult the right to review and delete the child's data.

If you believe a child has provided us with data without an adult's consent, email support@vabyk.com and we will delete it.

6. How we use data

• To provide lessons and adapt their difficulty to the child's age and results.
• To show the adult progress, lesson history, and the collected set.
• To create, maintain, and protect the account and subscription.
• To keep the Service stable, detect and fix bugs, and prevent abuse.
• To respond to your support requests.
• To comply with legal requirements.

We do not use children's data for advertising, do not show ads to children, and do not sell personal data.

7. Who we share data with (service providers)

We rely on trusted providers (processors) that process data on our behalf and only to operate the Service, including:

• Supabase — database hosting, authentication, and cloud file storage.
• Vercel — website hosting and content delivery.
• Google LLC and Apple Inc. — sign-in services (Google / Apple Sign In).
• Apple App Store and Google Play — subscription payment processing.
• PostHog — anonymized product analytics.
• Sentry — error monitoring and diagnostics.

We may also disclose data where required by law, court order, or a competent authority, or to protect our rights and the safety of users. We do not sell personal data to third parties.

8. International data transfers

Some of our providers may store or process data outside your country, including in the US or the EU. Where they do, we rely on appropriate legal transfer mechanisms — primarily the Standard Contractual Clauses (SCCs) approved by the European Commission, or other safeguards permitted by law.

9. How long we keep data

We keep data for as long as your account exists and it is needed to provide the Service. After you delete your account, the associated child data is permanently deleted within a reasonable technical period, except data we are required by law to retain (for example, payment records) or data kept in anonymized form for statistics.

10. Data security

We apply organizational and technical safeguards: encrypted connections (TLS), access controls, and authentication via trusted services. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we continually work to improve it.

11. Your rights

Depending on your jurisdiction, you have the right to: access your data and the child's data; rectify it; erase it (the “right to be forgotten”); restrict or object to processing; receive a copy of the data in a machine-readable format (portability); and withdraw previously given consent without affecting the lawfulness of prior processing.

Most of these actions are available directly in the app: you can review, change, or delete the child's data and delete your account. If needed, email support@vabyk.com and we will respond within the timeframes required by law.

EU/EEA users have the right to lodge a complaint with their national data-protection supervisory authority. Ukrainian users may contact the Ukrainian Parliament Commissioner for Human Rights.

12. Cookies and analytics

The Service uses only technically necessary files and anonymized analytics to improve the product. We do not use third-party advertising or tracking cookies and do not profile children.

13. Changes to this Policy

We may update this Policy from time to time. We will notify you of material changes in the app or by email. The last-updated date and version number are shown at the top of the page. Continued use of the Service after changes take effect means you accept the updated Policy.

14. Contact

For privacy matters, exercising your rights, and general support: support@vabyk.com.