Privacy Policy

Last updated: 23 July 2026

Hey Duggu is a parent-managed AI learning helper for children. A parent creates the account, gives consent for the child profile, and controls data choices from the parent dashboard.

Data we process

• Parent account data: Firebase parent user id and phone-authentication account metadata.
• Child profile: nickname, age, age band, grade, board, language preferences, safety tier, and learning goals.
• Conversation metadata: session id, turn id, mode, input source, safety verdicts, learning hints, feedback, alerts, timestamps, model metadata, and latency.
• Conversation text: securely processed to prepare and check an answer. Everyday question and answer text is stored only if the parent turns transcript saving on. A restricted copy of a serious safety event may be kept for safety or legal review.
• Voice: used only when the child taps the microphone. Speech is turned into text by your device's own built-in speech recognition service — on most Android phones this is Google's — and your device may send the audio to that service to transcribe it, under that provider's terms. Hey Duggu receives only the resulting text: the app does not record, store or transmit the audio itself.
• Reports and safety alerts: report ids, turn ids, reason codes, status, alert lifecycle, and privacy-safe notification text.
• Device/network data needed to run the service: Firebase Cloud Messaging token/topic behavior, crash/runtime logs where configured, and standard server request logs.

Why we use data

• Provide the learning conversation and safety screening.
• Keep the parent dashboard and safety alerts working.
• Maintain child-appropriate, age-tier behavior.
• Protect the service from abuse and debug operational failures.
• Use optional product analytics or eligible reviewed and redacted interactions only where the parent has opted in.

Browser cookies and phone verification

Hey Duggu uses only the browser storage and cookies needed to sign a parent in, remember the selected learner for the current learning session, protect Parent Zone, prevent misuse and keep private pages secure. These are necessary for the service and are not used for advertising.

Phone sign-in uses Firebase Authentication and Google reCAPTCHA. reCAPTCHA checks whether a sign-in request is likely to come from a real person and may process device, browser, network and interaction information or set its own security cookies under Google’s terms. We use this check only for account security and abuse prevention.

Hey Duggu does not use advertising cookies or cross-site tracking cookies. Optional product analytics starts off and is used only when the parent chooses it.

Notifications

If the parent allows notifications, Hey Duggu and Firebase Cloud Messaging process a device notification token and limited delivery or topic information. We use this to send parent account, service and child-safety updates to the correct device. Notification text is designed to avoid exposing a child’s conversation on the lock screen.

A notification token identifies an app installation for message delivery; it is not used for advertising. Parents can stop notifications in the app or device settings. The token is removed or replaced when it is no longer valid, the parent signs out where supported, or the related account or learner data is deleted, subject to necessary security and legal records.

Children and parental consent

Hey Duggu is intended for children only through a parent-managed account. For India, everyone under 18 is treated as a child. Consent for a child profile is given by the parent or lawful guardian who controls the account.

Phone OTP is used to sign the parent in; it is not parental consent by itself. Safety checks and AI processing are required to provide the service. Optional choices—such as personalisation, transcript saving, product analytics and AI improvement—start off and can be changed in Parent Zone.

Sharing and processors

Service providers that help run Hey Duggu include Google and Firebase for sign-in, secure storage, notifications and security, your device's built-in speech recognition service for converting speech to text, and a third-party AI service provider that prepares learning answers. We send only the question, the age setting and the learning context needed for an answer, after applying available safety and redaction checks. The AI answer service processes this in India and does not use your child's data to train its models. Some infrastructure providers may process limited technical or account data under their own terms and appropriate safeguards. We never use your child's data for advertising.

Hey Duggu does not sell children's data, does not run targeted advertising to children, and does not use child data for behavioral ads.

Retention

• Voice audio: never recorded or stored by Hey Duggu. Transcription is performed by your device's speech recognition service, and any handling of the audio there is governed by that provider's own policy.
• Transcript text: off by default. If enabled, it is kept until the parent turns saving off or deletes the learner, subject to safety and legal exceptions.
• Session and turn metadata: kept while needed for parent summaries, safety, service support and security, then deleted or anonymised.
• Safety alerts and AI reports: kept until the review and any required follow-up are complete. A longer restricted hold may apply where child-safety or other law requires it.
• Consent records: kept while the account is active and afterwards only where needed to record the parent’s choices or meet a legal duty.
• Server and security logs: deleted when no longer needed for security, incident review or a legal duty.

Parent rights

Parents can access or download eligible child data, ask for a correction, withdraw optional consent, and delete a learner profile. These controls are available in Parent Zone. You can also request deletion from the web. Withdrawing consent is as easy as giving it.

Security

Hey Duggu uses authenticated services, protected validation, privacy-safe notification text and parent PIN gates. Private access keys are never included in the child or parent experience.