Bamboo Academy · Legal

Privacy Policy

Last updated: August 16, 2026

A note on this page: drafted in plain language from how the app actually works today, not boilerplate. It has not yet been reviewed by counsel. Treat it as an accurate description of current practice, not a substitute for legal advice if you need one.

Bamboo Academy ("we," "us") is a Traditional Chinese learning app for children, built and operated by JL Digital Ltd. This policy explains what information we collect, why, and what choices a parent has — written for a parent to actually read, not just file away.

The short version: we collect the minimum needed to save your child's progress and, if you choose to use it, generate a parent-facing report. We don't run ads, don't use advertising or tracking SDKs, don't collect device advertising identifiers (IDFA/AAID), and don't sell data to anyone.

Who this applies to

Bamboo Academy is directed at children learning Chinese, used under parental supervision. Accounts — where any personal information is attached to an identity — are created and controlled by a parent or guardian, never by the child directly. We collect only what's described below, and never more than a child's first name and age.

What we collect

If you create a parent account, we (via Supabase, our backend provider) store:

Your email address, to sign you in. We never see or store your password in plain form.
Your child's first name and age — no last name field exists anywhere in the app.
Learning progress — which lessons are complete, stars earned, stroke-tracing accuracy, spaced-review scheduling, and which characters your child tends to confuse — so progress can sync across devices and power the report card.

Before you create an account, progress is saved only on your device (browser local storage) and never leaves it.

If you make a purchase, it’s processed by RevenueCat, our subscription management provider, and Apple’s or Google’s app store. RevenueCat sees an anonymous purchaser ID linked to your parent account and your purchase/subscription history — never your child’s name, age, or learning data.

If you use the feedback button, the beta survey, the "join the beta" form, or the contact form, we store whatever you typed there (rating, free-text comments, your email if you provided one) so we can act on it.

The AI report card

If a parent requests an AI-written progress report, we send a summary to Anthropic's API to generate it — your child's first name, age, which characters they've studied/mastered/are still working on, and their most common mix-ups. We do not send raw lesson-by-lesson logs or any account identifiers to Anthropic — only the summary needed to write the report. This is the one point where a summary of your child's learning data leaves our infrastructure; everything else stays inside Supabase, our backend provider.

What we don't do

No advertising, no ad networks, no ad SDKs of any kind.
No IDFA/AAID or other device-advertising-identifier collection.
No behavioral tracking or cross-app/cross-site tracking.
No selling or renting personal information to anyone, ever.
No public profiles, chat, or any way for your child to contact or be contacted by another user — there is no user-generated content visible to anyone but you.

Crash reporting

We use Sentry to catch app crashes so we can fix them, once configured. Crash reports are stripped of personal information before being sent (no child names, no account identifiers) — they contain only the technical details needed to diagnose a bug. As of this writing, crash reporting is not yet active — see the Diagnostics row of our store privacy labels for current status.

Your rights and choices

Delete your account: available directly in Settings, no need to contact us. This permanently removes your account and your children's data from our systems.
Export your data: also available in Settings — a plain-language copy of everything we hold about your account and children, in a portable format.
Opt out of anything optional: the AI report, feedback prompts, and any future email updates are all opt-in, never required to use the app.

Children's privacy (COPPA, and equivalents elsewhere)

We designed Bamboo Academy to comply with the U.S. Children's Online Privacy Protection Act (COPPA), and to meet the spirit of equivalent protections elsewhere your family may be — including the EU/UK's GDPR provisions for children's data, Canada's PIPEDA, and Hong Kong's Personal Data (Privacy) Ordinance. A parent or guardian must create and control any account; a child never provides personal information directly, and account-level actions (sign-in, purchases, data export/deletion, contact forms) all sit behind a parental gate a young child can't casually pass.

If you believe your child has provided us with information without your consent, contact us (below) and we'll delete it.

Where your data lives

Account and progress data is stored with Supabase (backend infrastructure) and is not shared with any third party except as described above (Anthropic, only for a report you explicitly request; RevenueCat and the app stores, only for purchases).

Changes to this policy

If we change what we collect or how we use it, we'll update this page and the "last updated" date above. Material changes affecting your child's data will be communicated directly, not just posted quietly.

Contact us

Questions, a data request, or anything else — use the contact form, email hello (at) jldigital.ca, or the in-app feedback button. A real person reads every message.