Privacy Policy
Version 1.6 · Effective 1 September 2026 · Last updated 8 October 2026
If the English and French versions ever differ, the reading most favourable to you applies.
The short version
Voci helps a family raise a child in more than one language. To do that it has to hold some things about your child. These are their first name, roughly how old they are, which languages are around them, and what it has learned about how those languages are going.
It does not hold their birthday, where you live, their voice, or their face. There is no advertising in Voci and no analytics service, and nothing about your family is sold. What Voci holds about your child goes only to the company that stores it and the company that serves the pages. The company that sends our emails receives your email address. If you pay for Voci Family, Paddle, the company that sells it, receives what it needs to take your payment, and nothing about your child. Section 8 names every company and what each one sees, including Google if you choose to sign in with it.
If you came to Voci through one of our own links, for example under a video, Voci notes which link on your account and later counts whether that account used Voci at least once. It does not look at what was done or by which child, and the note is never saved on a child's profile. Section 3 explains this.
You can take a copy of everything at any time, and you can delete all of it, yourself, from inside the app.
If you read nothing else, read the section called What Voci works out on its own. It is the part most families do not expect.
1. Who is responsible
The controller for this processing is Nikita Jevpalovs, micro-entrepreneur, 5 Allée de la Licorne, 64600 Anglet, France, registered under SIREN 109182162.
Contact for anything in this policy: help@voci.family.
No Data Protection Officer has been appointed. Voci does not appear to meet the conditions in Article 37(1). It is not a public authority, its core activity is not large-scale systematic monitoring, and it does not process special category data on a large scale. This is reassessed as Voci grows.
2. Who the people in this policy are
| You | The parent or guardian who created the account. You hold the account, you accept the terms, and every control described here is yours. |
| Your child | A learning profile inside your account. Your child is not a user. They have no account, no login, no password and no session, and there is no screen in Voci from which a child can reach any setting, any control, or any of their own data. |
| The people you describe | Anyone you tell Voci is part of your child's language life, such as grandparents, childminders or siblings. They are records in your account, not users. Voci never contacts them. Voci has no way to reach them and does not ask for one, so this policy is written for them too: it is where they can read what Voci keeps about them and how to have it removed (Art. 14(5)(b)). |
3. What you tell us
About your child
- Their first name. Voci uses it on every card it shows you and never uses a
pronoun instead, so the name is doing real work.
- Their birth year and month. Not the day. Voci deliberately does not ask
for a date of birth: every decision the system makes is measured in whole months, so the day could never change an answer, and a birthday is a piece of a child's identity that Voci has no reason to hold. It was collected once and it was removed.
- If your target language requires it, whether to use **masculine or feminine
agreement** when a phrase is addressed to your child. This is asked only for languages where there is no neutral form, it can be left unanswered, and it decides which ending is printed on a card and nothing else.
About your household
- Which languages are present, who speaks them, how well, and whether they are
used with your child.
- The names and relationships of the people in your child's life.
- Roughly how much time each source of language provides, how interactive it is,
how consistent, and how much of it your child understands.
- Your country and community language.
- How much time you realistically have in a week, and on which days.
About what happened
- Which activities you marked as done, on which day, and by whom.
- What your child did with language, meaning whether they understood something,
answered, or said something unprompted.
- Whether an activity worked, and any note you choose to write. That note is
free text you control; nothing reads it but you.
One thing you do not type: which of our links brought you
Some of Voci's own links carry a short label, such as TT-UWS-001, that says where the link was posted: under one of our videos, or on one of our profiles. The label is in the address of the page, where you can see it. If you create an account after following one, Voci saves two things with your account: the label and the date.
Voci also counts how many times each labelled page was opened in a day. That count is a number and holds nothing about who opened the page.
We use this to learn which of our videos bring families who go on to use Voci. For each label we count how many accounts were created, how many set up a child, how many used Voci at least once, and how many subscribed. "Used Voci at least once" is a yes or a no. We do not look at what was done or by which child. Only these totals are read, on a page only the founder can open.
The label is about the adult's account and is never saved on a child's profile. It changes nothing in Voci. Your recommendations and your price are the same with or without it. Voci stores nothing in your browser for it and records no IP address or device details for it. The label goes to no analytics or advertising company. It is held by the same providers that hold your account (section 8), and it is part of the address our hosting provider sees when the page is opened. If the address has no label, or one Voci does not recognise, nothing is saved.
Voci deletes the label and date 90 days after the account is created, or when you delete your account if that is sooner. You can ask us to delete them earlier (section 11).
4. What you never tell us, because Voci never asks
- Your child's date of birth.
- Where you are. No location of any kind, precise or approximate. Your country
is a country, not a position.
- Your child's photograph or video.
- Your child's voice. See section 6.
- An email address or phone number for your child.
- Anything about health, religion, politics, or identity documents.
- Your family's ethnic or national origin. Voci does not ask for it, but one
answer can point to it, and the next paragraph explains which.
One answer can say where your family comes from. When you describe a language as part of who you are (a heritage language), that answer, next to the country you live in, can show your family's origin. The law treats that as sensitive data (Article 9). So Voci keeps it only if you tick a separate box agreeing to it, and that box is never ticked for you. If you leave it unticked, the language is saved as one you speak at home and your plan still works. Voci uses the heritage answer only to give that language more of your week. You can withdraw at any time in Parent Space → Your data. Voci then records each of those languages as one you speak at home, including in its history.
5. What Voci works out on its own
This is the part worth reading properly, because it is most of what Voci holds and it is not something you typed.
From what you tell it, Voci maintains a reading of how each language is going for your child. It covers things like how much they understand, whether they answer in the language, and how consistent their exposure is. Those readings are words, not numbers: there is no score and no percentage anywhere in Voci, by design.
Each reading carries how confident Voci is and where it came from. That can be something you reported, something observed in the app, or something the system inferred. When a reading changes, Voci writes down why, in a sentence you can read.
From those readings it produces recommendations and a weekly plan. When you tell it that something changed, for example that nursery started, you moved or a grandparent left, it records that as a life event, adjusts the model as of the date it actually happened, and keeps a record of what it changed and what the value was before.
Voci never rewrites its own history. A correction is added, not substituted, so you can always see what it used to think and when it changed its mind.
None of this is a diagnosis or an assessment. Voci is an educational tool. It does not measure your child against other children, it is not a developmental screening, and it cannot tell you whether your child needs professional support. If you are worried about your child's speech or development, talk to a professional, not to an app.
6. The microphone
Voci does not record your child.
The microphone is off by default. It can only be turned on by an adult, on the parent's screen, after passing the adult check. Your browser asks you for permission right there, when you turn it on. Some browsers, such as Safari on iPhone, forget that permission and may ask again when a story next listens. If nobody allows it, nothing is heard and a tap counts instead. With the microphone off, the whole experience works: when your child taps to say something, the tap itself counts as the attempt.
When the microphone is on, here is exactly what happens. The browser opens the microphone and Voci measures how loud the room is, many times a second, for up to three seconds. It is checking whether a voice happened. It is not listening to what was said, and it could not tell you if it wanted to. The only thing it computes is a loudness number, and there is no path from that number back to a word.
- Nothing is recorded. There is no recording, no buffer kept, no file.
- Nothing is stored. There is no audio anywhere in Voci's database, and no
column that could hold any.
- Nothing leaves your device. No speech service, no transcription service,
no third party is involved at any point. The microphone is closed as soon as the three seconds end.
- What is saved is: *your child attempted something, and the sound lasted this
many milliseconds.*
Voci also speaks lines out loud using the voice built into your device or browser. Voci sends that feature the words of a phrase or story line and the language it is in. It sends nothing about your child. Depending on your device, your browser or operating system may perform that speech on the device or through its own vendor's service. That is a property of your device, not of Voci, and Voci has no access to it either way.
7. Why Voci is allowed to do this
| What | Why we are allowed |
|---|---|
| Your account, your child's profile, the language model, the recommendations, the history | Performance of our contract with you (Article 6(1)(b)). This is the service you asked for; there is no version of Voci that works without it. |
| Which of your languages you describe as part of who you are (a heritage language) | Your explicit consent (Article 9(2)(a), with Article 6(1)(a)). Asked with its own unticked box, and you can withdraw it at any time (section 11). |
| Records about grandparents, childminders and other people you name | Legitimate interests (Article 6(1)(f)). A language plan that ignores who is actually in the house is useless. We hold only a name, a relationship and what language they use. You can remove any of them at any time. |
| The adult check, and limiting repeated attempts at it | Legitimate interests (Article 6(1)(f)). The interest is keeping a small child out of destructive actions. |
| Responding to a request about your data | A legal obligation (Article 6(1)(c)). |
| The email telling you when your free days end | Performance of our contract with you (Article 6(1)(b)). It tells you when part of the service you use will change. |
| The email before a yearly subscription renews | A legal obligation (Article 6(1)(c)). French consumer law requires it (Code de la consommation, article L215-1). |
| The label of the Voci link you followed, and the date | Legitimate interests (Article 6(1)(f)). The interest is knowing which of our own videos and posts bring families to Voci. It is one short label, kept for 90 days, and you can object (section 11). |
Three things that are not consent, and Voci does not treat them as consent:
- Passing the adult check proves an adult is holding the phone. It is a
safety control. It is not your consent to any processing.
- Allowing the microphone is a permission your device asks for. It lets Voci
use a sensor. It is not consent to process anything else.
- Accepting the Terms forms a contract. It is not blanket agreement to
everything in this policy.
8. Who else sees it
Our database and authentication provider runs the service and stores everything described above. It processes this data only on our instructions, under a written agreement.
If you sign in with Google. You can use your Google account instead of a password. If you do, Google learns that you use Voci and when you sign in. We receive your email address and the account number Google uses to identify you. Google's sign-in sends us two more things we never asked for: the name on your Google account, and a link to its profile picture. Voci uses neither. The name on a child's page is the one you typed in yourself, and there is no photograph of a grown-up anywhere in Voci. We are working on asking Google for less. Google is not working for us here, so its own privacy policy covers what it does with what it learns. Signing in with an email address and a password instead avoids all of this.
Our hosting provider runs the application itself. Voci builds its pages on a server rather than in your browser, so when you open your child's page, our hosting provider assembles that page, including their name, before it reaches you. Nothing is stored there. Our hosting provider also keeps ordinary technical records of requests, which include your IP address, for at most one day. It processes all of this only on our instructions, under a written agreement.
Where your child's data is stored: Germany. The database is in the eu-central-1 region, in Frankfurt, inside the European Economic Area.
**Where it is processed is a second question, and here is the plain answer. Voci builds its pages on a server in Frankfurt** too. We pin that deliberately, in the code rather than in a settings page, so it cannot drift. Your child's name is read and rendered inside the European Economic Area.
Neither of our two providers is a European company, and that is the part a region does not settle. Our hosting provider is Vercel Inc., incorporated in the United States. Our database provider is Supabase Pte. Ltd., incorporated in Singapore. Their staff, and the companies they in turn rely on, may be able to access data from outside Europe in the course of running the service. Both have signed up to the European Commission's Standard Contractual Clauses, which is the legal mechanism that permits this and binds them to protect the data as if it had never left.
The companies our providers rely on. We read both providers' published lists on 14 September 2026. Most of those companies are in the United States: large hosting companies such as Amazon Web Services and Google, and monitoring services that can see technical logs. The same Standard Contractual Clauses cover them. Both providers publish changes to their lists before they happen.
The emails Voci sends. Apart from the sign-in emails our authentication provider sends, Voci sends you two kinds of email and no others: one when your free days are about to end, and one before a yearly Voci Family subscription renews. Resend (Plus Five Five, Inc., incorporated in the United States) sends them. It receives your email address and the words of the email, and nothing about your child. The emails leave from Ireland, but Resend keeps its account records and sending logs in the United States for 30 days. That transfer is covered by the EU-US Data Privacy Framework, under which Resend is certified, and by the Standard Contractual Clauses in its agreement with us. The emails are plain text and carry no tracking. We read Resend's list of the companies it relies on, all in the United States, on 15 September 2026.
When you pay for Voci Family. Voci Family is sold by Paddle.com, our online reseller, which is the seller of your subscription rather than a provider working for us. When you subscribe, Paddle receives your email address and your payment details directly, and it handles them as its own business under its own privacy policy, including the payment records French law requires it to keep. The payment page, voci.family/pay, loads Paddle's payment form, so Paddle also sees the address your browser connects from while you are on that page. Voci sends Paddle nothing about your child, and never holds your card details. If you never subscribe, Paddle receives nothing about you at all.
If you write to us. An email you send to help@voci.family does not pass through Voci. It goes first through the forwarding service of the company our domain is registered with, Porkbun LLC, in the United States. It then arrives in a Gmail mailbox, which is provided by Google Ireland Limited. Both companies handle your email address and whatever you wrote. Neither has signed an agreement to work only on our instructions, so each handles your message under its own privacy policy. You never need to write to us to see, download or delete your data, because all of that is in Parent Space. If you do write, tell us only what we need to help you.
Those three providers, Google if you sign in with it, Paddle when you pay, the two companies that carry your email if you write to us, and nobody else. Specifically:
- No advertising network. Voci carries no advertising and will not.
- No analytics service and no advertising tracker. The one thing Voci measures,
it measures itself, and section 3 says what.
- No crash reporting or error monitoring service.
- No data broker. Nothing about your family is sold or licensed, ever.
- No social network. Voci has no sharing feature.
Fonts used in the interface are downloaded when Voci is built and served from Voci's own address, so your browser never contacts a font provider and no font provider ever sees your address.
9. Cookies
Voci uses eight small cookies and no tracking cookies of any kind. There is no cookie banner because there is nothing to ask you about. Every one of these is either necessary to run the service or records a choice you actively made, both of which are exempt from consent.
| Cookie | What it does | How long |
|---|---|---|
sb-…-auth-token | Keeps you signed in | Your session |
voci_gate | Remembers that an adult passed the check, and what for | Minutes |
voci_gate_tries | Slows down repeated wrong answers | Short |
voci_viewer | Remembers which grown-up is holding this phone | 1 year |
voci_mic | Remembers that you turned the microphone on | 1 year |
voci_ui | Remembers your interface language | 1 year |
voci_tz | Remembers your time zone, so each day is counted where you live | 1 year |
voci_child | Remembers that the phone was handed to your child, so Parent Space stays locked | Until an adult passes the check, at most 1 year |
Voci stores one other thing in your browser, and only when you ask for it. If you play the free story and then press the button to create an account, your three answers are kept in the browser's local storage so that Voci does not ask them again. They are removed the first time you open Voci's setup page on that device. There is no session storage, no database in the browser, no device identifier and no advertising identifier.
10. How long it is kept
Voci keeps your family's information for as long as your account exists. The history is the point: a reading from eleven months ago is what makes "your daughter's comprehension has moved twice since nursery started" a true sentence rather than a guess.
An account nobody uses is deleted, with a warning first. If nobody signs in to your account for 24 months, Voci emails you that it will be deleted in 60 days. If nobody signs in by then, the account is deleted exactly as if you had deleted it yourself. Signing in once is enough to stop it. An account with a Voci Family subscription still running is never deleted this way: the 24 months count from the end of the paid period.
The label of the link you followed is kept for 90 days. That is how long it takes to see whether a family stays: seven free days, some weeks to decide about subscribing, and the 14 days in which a refund can be asked for. After that the label and date are removed from your account. What remains is a total per label, with no person in it.
When you delete your account, everything above is destroyed immediately, in one operation, in the database. There is no grace period, no soft delete, no hidden copy.
A note about backups, because most policies get this backwards. Many services warn you that a copy of your data may sit in a backup for weeks after you delete it. We are not going to tell you that, because on the plan Voci currently runs there is no automatic backup system at all. So when you delete, it is gone, completely and at once, with no copy anywhere to outlive it.
That is good for your privacy and it is a real risk to your family's work, and we would rather you knew both halves. Before Voci is opened to families beyond the developer's own, proper backups will be in place. When they are, this section will name exactly how long a copy can persist after deletion. It will not be changed quietly.
When you delete a single child's profile, everything about that child is destroyed. Your account, your other children, and the people you have described are untouched, because a grandmother is not a fact about one grandchild.
One category of record survives that deletion, and we would rather name it here than let you discover it: the record of what the adults said. If you have been learning a language alongside your child, Voci keeps a log of the phrases you told us you used. Each entry holds the date, the phrase, the part of the day, and which adult said it. That is a record about you, not about your child, and a parent who has been speaking Spanish has been speaking Spanish whether or not a particular profile still exists. So when you delete a child's profile we remove the link to that child from those rows and keep the rest. They no longer name her, refer to her, or can be reached from her.
If you want those gone too, deleting your account removes them along with everything else.
Payments are the one exception to deleting your account. If you subscribed to Voci Family, Voci keeps the log of what Paddle told it about your subscription: Paddle's reference numbers, the dates, and whether it was active, cancelled or refunded. That log holds no name, no email address and nothing about your child, and once your account is deleted nothing in Voci links it to your family. It is kept for 5 years, the time within which a dispute about a contract can still be brought in France, and then deleted. Paddle, as the seller, keeps its own invoices and payment records for as long as the law requires it to.
11. Your rights
You can exercise all of these yourself, or by writing to help@voci.family.
| Right | How |
|---|---|
| See your data (Art. 15) | Parent Space → Your data → Download my data. You get a single file containing everything, including everything Voci concluded. |
| Correct it (Art. 16) | Edit anything directly. To correct something that already changed the model, use Life Events. Voci undoes what it did by inverting the recorded change, and keeps a record of the correction. |
| Delete it (Art. 17) | Parent Space → Your data → Delete your child's profile, or Delete my account. Immediate. See section 10. |
| Withdraw consent (Art. 7(3)) | Parent Space → Your data → Withdraw my consent. Each heritage language becomes a language you speak at home, in its history too. |
| Take it elsewhere (Art. 20) | The same export. It is structured JSON, machine-readable, and it includes the derived history. An export that gave you only what you typed would be technically a copy and practically useless. |
| Restrict processing (Art. 18) | No self-service control exists for this. Write to us. We would rather say so than pretend a button exists. |
| Object (Art. 21) | Applies to what we hold under legitimate interests: the records about other people, and the label of the link you followed. Write to us and we will remove them. |
| Complain | You can complain to the CNIL (Commission Nationale de l'Informatique et des Libertés), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr. You do not have to contact us first, though we would like the chance. |
Providing your child's first name and age is necessary to use Voci, because the service cannot work without them. Everything else, including the microphone, the notes, and how much detail you give about your household, is optional and Voci works without it.
12. Personalisation
Voci's recommendations are generated automatically from the model described in section 5. That is personalisation, and it is the product.
It is not a decision that produces legal effects for you or your child, and it is not a decision of similar significance: nothing is granted, withheld, priced or refused on the basis of it. The output is a suggestion of what to do this week.
You can always see why: every recommendation carries the facts that produced it, and every change in the underlying reading carries an explanation in words. You can correct any input, and Voci will recompute.
13. Children
Voci is designed to be used by an adult on a child's behalf. Your child has no account and cannot reach any control, any setting, or any of their own information.
There is a separate short explanation written for children, What Voci remembers about you, meant to be read aloud by a parent, together.
14. If something goes wrong
If your family's information is exposed by a security breach, we are required to report it to the CNIL within 72 hours, and where the risk to you is high we must tell you directly. We will.
What that message will contain: what happened, in plain words; exactly which of your child's information was involved; what we have done about it; and what you can do, including the fact that you can export and delete everything yourself, immediately.
What it will not contain is a softened word for what happened. If it was a breach, it will say breach.
Two things are worth knowing in advance, because they limit what a breach could ever involve. There is no audio of your child anywhere in Voci, so it cannot be part of one. And no company beyond the ones in section 8 receives anything about your family. Your child's record is held by our two providers and by nobody else. Resend holds your email address. Paddle holds the payment details of a parent who subscribes. If you write to us, the two companies that carry that email hold what you wrote. No other company's breach could expose your data.
We keep a written breach procedure and a record of any breach, whether or not it was notifiable. Both are available to the CNIL on request, and we will describe ours to you if you ask at help@voci.family.
15. Changes
The version and effective date are at the top of this document. Material changes will be announced in the app before they take effect.
Changing this document does not by itself require you to agree to anything again. If a change ever introduces processing that genuinely needs your consent, we will ask for that separately and specifically, and Voci will not do the thing until you say yes.