- Who we are
- What stays on your device
- What we process when you choose to
- Encrypted backup
- AI: practice questions, play ideas and scene colours
- Purchases
- What we never do
- Service providers
- Children's privacy
- Reports you share
- Keeping and deleting information
- Your rights
- Security
- Changes and contact
1. Who we are
TendiPlay is an app for iPhone, iPad and Android phones and tablets made by Twologpi ("we", "us"), the same team behind IEP VoiceTracker. This policy covers the TendiPlay app and these TendiPlay web pages. For any privacy question, email [email protected].
2. What stays on your device
When you add a child, TendiPlay keeps the following on your device:
- the nickname you choose, your child's age in years if you enter it (it sets the starting level for the study worlds), and the goals, levels, play-time limits and sensory settings you set;
- each turn your child plays: what was shown, what was chosen, how much help was given and how long the first tap took;
- notes and observations you add yourself.
We only ask for a nickname and, for the study worlds, an age in years. We never ask for a child's full name, date of birth, school, diagnosis, photo, voice or location, and the app doesn't use the camera, microphone, contacts or location services.
These records are encrypted with AES-256-GCM using a key held in your device's secure key store (the iOS keychain, or the Android Keystore), and they are left out of ordinary device backups. We never receive them unless you turn on backup, and even then only in encrypted form.
The parent PIN is stored on the device as a salted one-way hash, never as the PIN itself. Face ID, Touch ID, fingerprint or face unlock and your device passcode are handled by your device's operating system (Apple or Google). We never receive biometric data.
Smart variety (iPhone and iPad only). If you switch it on, and your device supports Apple Intelligence, the app uses Apple's on-device model to choose the next activity. That happens entirely on your device. Nothing is sent to us or anyone else.
3. What we process when you choose to
You can play every starter game without an account and without an internet connection. Sign-in, backup, play ideas and scene colours are for grown-ups only: they sit behind the parent gate and only start when a parent uses them. Two things go online without a grown-up asking: a subscription check with RevenueCat when the app opens (section 6), which carries no information about you or your child, and TendiPlay Family's practice questions (section 5), which a parent can turn off for each child.
| Information | When | Why |
|---|---|---|
| Your sign-in identifier and email address: from Sign in with Apple on iPhone and iPad (or an Apple private relay address, if you choose to hide your email), or from Sign in with Google on Android | Only if a parent signs in under Grown-ups, then Account | To give that parent backup and let them delete their account |
| An anonymous device identifier: a random Firebase ID with no name, email or child information | When a parent asks for a play idea or scene colours without signing in, or when Family practice questions are fetched | So the daily request limit can apply. It is not linked to a person, and is replaced by the parent's account if they later sign in |
| An encrypted copy of the records described in section 2 | Only if a parent turns on Backup | So you can restore after reinstalling or on a new device |
| The game and interest a parent picks from a fixed list (for example "Picnic Builders" and "trains") | Only when a parent asks for a play idea or scene colours | To create that suggestion |
| The study game, an age group (3 to 5, 6 to 8, 9 to 12 or 13 to 16) and a level | With TendiPlay Family, when the study worlds run low on practice questions, unless a parent has turned AI questions off | To write new questions at the right level |
| Proof of your Family subscription. On iPhone and iPad, Apple's signed record of the subscription (the plan, its purchase and expiry dates, the price and currency, the App Store country and Apple's transaction numbers; no name, email or Apple ID). On Android, the random RevenueCat customer ID, which our server uses to ask RevenueCat whether Family is active | With each request for practice questions | So our server can confirm the subscription is active before any questions are written |
| A random RevenueCat customer ID (not linked to your name, email, Apple ID, Google Account or child), your App Store or Google Play purchase and subscription records for TendiPlay, and basic technical details such as the app version, device model, operating system version and store country | When the app opens or a grown-up views, buys or restores a plan, including when no plan has been bought | So RevenueCat can tell the app whether TendiPlay Family is active and process purchases and restores (section 6) |
| A device check token, from Apple App Attest on iPhone and iPad or Google Play Integrity on Android, through Firebase App Check | With each request to our servers | To confirm requests come from the genuine TendiPlay app |
| A daily count of requests, stored against a one-way hash of your account or anonymous identifier, and for practice questions also a one-way hash of the subscription's transaction number | With play ideas, scene colours, practice questions and backups | To prevent abuse. Each count is set to expire after about 48 hours |
Where the law asks for a legal basis, we rely on providing the service you asked for (your account, backup and suggestions) and on our legitimate interest in keeping the service secure (device checks and request counts).
4. Encrypted backup
Backup is off until a parent turns it on. When it is on, the app compresses and encrypts all of your records on your device with AES-256-GCM before uploading them. On iPhone and iPad the key stays in your iCloud Keychain; on Android it stays on the device, protected by the Android Keystore. It is never sent to us. We store only the encrypted data, so we cannot read your child's nickname, goals, notes or progress, and neither can anyone who gains access to our servers.
The app also shows a recovery code, so you can restore on a device that doesn't have your key, such as a new Android device or one without your iCloud Keychain. Backups made on iPhone or iPad and on Android use different formats and can't be restored across the two. Keep it somewhere safe. Because we never hold your key, we cannot recover the code or your backup for you.
You can delete your backup at any time under Grown-ups, then Backup. Deleting your account deletes your backup too.
5. AI: practice questions, play ideas and scene colours
Practice questions. With TendiPlay Family, the five study worlds (Word Studio, Spelling Studio, Number Lab, Direction Quest and Memory Path) mix in short stories, word problems, riddles and themed sequences written by an AI model. The app fetches them in the background and keeps them on your device. Each request contains only the study game, an age group and a level, with proof of the subscription (section 3) so our server can confirm Family is active. It never includes your child's nickname, age in years, goals, answers or any record of play, and the record of how your child plays never leaves the device.
Children do see these questions, so they are tightly controlled. The AI may only name pictures from the app's own built-in vocabulary; the app draws every picture and works out every answer itself. Each question is checked against child-safety rules on our server and again on the device, and anything that fails is thrown away. If questions can't be fetched, or a parent turns them off (Grown-ups, then the child's settings, then AI-written practice questions), the app uses its built-in questions instead.
Play ideas and scene colours. TendiPlay Family can also suggest screen-free play ideas and scene colours themed on something your child loves. The request contains only the game and the interest you picked from a fixed list. It never includes your account identifier, your child's nickname, goals, notes or any record of play. These suggestions appear only in the parent area, for the parent who asked.
We send requests with provider-side storage turned off where the provider supports it. We do not use your information, or your child's, to train AI models, and because the request carries nothing about you or your child, there is nothing personal for a provider to keep.
6. Purchases
TendiPlay Family is sold through the App Store on iPhone and iPad, and through Google Play on Android. Apple or Google handles payment, billing, renewals and refunds, and we never see your card or billing details. We use RevenueCat to manage subscriptions: when the app opens, and when a grown-up views, buys or restores a plan, it shares your App Store or Google Play purchase and subscription records for TendiPlay with RevenueCat under a random RevenueCat customer ID, and RevenueCat tells the app whether Family is active. Apple and Google also notify RevenueCat of renewals, cancellations and refunds. RevenueCat never receives your name, email, Apple ID, Google Account, or anything about your child. On iPhone and iPad the app also checks with Apple on the device, so Family keeps working if RevenueCat can't be reached. For AI practice questions, our server confirms the subscription before writing questions: on iPhone and iPad by checking Apple's signature and expiry date on the signed record, and on Android by asking RevenueCat about the random customer ID (section 5). We keep only a one-way hash of the transaction number or customer ID, in a daily count that expires after about 48 hours.
7. What we never do
- We don't show ads, and we don't include advertising, analytics, attribution or session-recording tools.
- We don't track you or your child across other apps or websites.
- We don't sell or rent personal information, or share it for advertising.
- We don't build profiles of children, or use a child's play to decide what to sell you.
8. Service providers
We use a small number of providers to run the optional online features. Each receives only what it needs.
- Apple (iPhone and iPad): App Store purchases and subscriptions, Sign in with Apple, iCloud Keychain, App Attest and on-device Apple Intelligence. Apple's privacy policy applies to those services.
- Google (Android): Google Play purchases and subscriptions, Sign in with Google and Play Integrity. Google's privacy policy applies to those services.
- RevenueCat (hosted in the United States): manages TendiPlay Family subscriptions, receiving the random customer ID, App Store or Google Play purchase and subscription records and technical details described in sections 3 and 6. RevenueCat's privacy policy applies to how it handles them.
- Google Firebase (Authentication, App Check, Cloud Functions and Cloud Firestore, hosted in the United States): runs parent accounts, stores encrypted backups, checks subscription records and passes AI requests to the AI provider.
- OpenRouter and the AI model provider it routes to: receive only what section 5 describes (a game and an interest, or a study game, an age group and a level) to write a play idea, choose colours or write practice questions. They never receive your subscription proof or any identifier.
Our servers are in the United States. If you live elsewhere, information you choose to send us is processed there, with protections provided by our providers' data processing terms.
We may disclose information if the law requires it, to protect the safety of a person, or as part of a sale or reorganisation of our business, in which case this policy would continue to apply to it.
9. Children's privacy
TendiPlay is made for parents and carers to use with children aged about 3 to 16. Children do not create accounts, and they cannot reach purchases, settings, links or sign-in, all of which sit behind the parent gate. We do not knowingly collect personal information from children, and nothing a child does in a game is sent to us.
Only two kinds of child-related information can leave the device. One is the encrypted backup a parent chooses to turn on, which we cannot read. The other, with Family, is the age group and level used to fetch practice questions (section 5), which identify no one and which a parent can turn off. A parent can review, export or delete a child's records in the app at any time, and can delete the backup and the account. To ask us anything about a child's information, email [email protected].
10. Reports you share
You can export a PDF report, a spreadsheet or a weekly summary to share with a teacher or therapist. These files leave the app only when you choose to share them, and they may contain your child's nickname, goals and your notes. The app removes its own temporary copy once you are done sharing. We can't recall or delete copies you have already sent, so share them only with people you trust.
11. Keeping and deleting information
- Records on your device stay until you delete them. Under Grown-ups, then Settings, you can choose a period (30 days to a year) and remove a child's older records, delete a single child, or erase all children and progress.
- Backups stay until you delete them or your account.
- Your account can be deleted under Grown-ups, then Account. This deletes the account, any backup, and all children's profiles and progress on that device. It does not cancel a subscription, which you manage with Apple or Google Play. You can also ask us to delete your account and backup without the app: see Delete your account.
- Request counts are set to expire after about 48 hours.
- Subscription records at RevenueCat are kept while needed to manage your subscription and meet legal and accounting duties. Because the RevenueCat ID is random, we can only find your record from your purchase: to have it deleted, email [email protected] with the order ID from your App Store or Google Play receipt, and we will delete your RevenueCat customer record.
Our providers may keep short-lived system logs for security and reliability under their own retention schedules.
12. Your rights
Depending on where you live, including under the GDPR, UK GDPR, US state privacy laws and India's DPDP Act, you may have the right to access, correct, delete or move your information, to object to or restrict how it is used, and to withdraw consent. Most of this you can do directly in the app. For anything else, email [email protected] and we will respond within 30 days. We will never treat you differently for exercising your rights. You can also complain to your local data protection authority.
13. Security
We encrypt records on the device and in transit, use App Check to block requests that don't come from the genuine app, and use server rules that stop the app from reading stored data directly. No system is perfectly secure, so we design TendiPlay to keep the most sensitive information on your device, or encrypted with a key only you hold. If we ever learn of a breach that affects you, we will tell you as the law requires.
14. Changes and contact
If we make a change to this policy that matters, we will update this page and, where appropriate, tell you in the app before the change takes effect. Questions, requests or concerns: [email protected].