In plain language: Yalla, Karim! is designed for children aged 4–8. We collect only what is strictly necessary to run the app. Your child's voice is processed entirely on your device — it is never recorded, transmitted, or stored anywhere outside the phone or tablet. We do not show ads, and we do not share personal information with advertisers or data brokers.
Yalla, Karim! is developed by Dr.-Ing. Manuel Katanacho, operating as a sole proprietorship under the trade name “AI Software Services” (“we,” “us,” “our”). We are the data controller responsible for your information under the EU General Data Protection Regulation (GDPR). Our contact details are in Section 13.
This policy covers our mobile app “Yalla, Karim!” (package ID:
de.aisoftwareservices.karim) available on the Apple App Store and Google Play. It explains
what information we collect, why we collect it, and the rights you have as a parent or guardian.
When a parent or guardian creates an account to sync progress across devices, we collect:
Account creation is optional. Children can use the app and complete free lessons without an account. An account is only required to sync starred lessons and progress across multiple devices.
When an account is active, we store the child's lesson and vocabulary progress (e.g., which lessons have been completed, which words have been practised). This is associated with the pseudonymous account UUID, not with any personally identifiable information about the child.
If you purchase a premium subscription, our subscription-management provider RevenueCat records that a subscription is active for your account. We use this to unlock premium lessons. The purchase transaction details (payment method, card number, billing address) are handled entirely by the Apple App Store (StoreKit) or Google Play billing systems and are never accessible to us.
When a parent completes the in-app parental consent screen, we record that consent was given (including the version of the privacy policy accepted and the date). This is linked to the parent's account UUID and is required by COPPA and GDPR-K.
Your child's voice is processed on your device only. When your child speaks into the app, the audio is analysed by a speech-recognition model running entirely on-device. The audio is immediately discarded after processing — it is never transmitted, stored, or shared with anyone, including us. This is a core design principle of Yalla, Karim!, and it cannot be changed remotely.
We also do not collect:
We do not use any of this information for advertising, profiling, or sale to third parties.
For users in the EU/EEA, we rely on the following legal bases:
We use a small number of third-party companies to operate the service. These companies act as Service Providers — they process data on our behalf and under our instructions only, and they are not permitted to use the data for their own purposes.
We use Supabase to store parent accounts, lesson progress, and consent records. Data is stored on servers in the European Union and Supabase provides a GDPR Data Processing Agreement. Data transferred to Supabase is used only to provide the app's sync functionality — it is not shared with or sold to other parties.
We use RevenueCat to manage in-app subscriptions. RevenueCat receives your account's purchase history (whether a subscription is active and its status) to allow us to unlock premium content. RevenueCat does not receive your email address, advertising identifiers, or your child's information.
No other third-party services receive personal information from the app.
We keep personal data only as long as it is needed to provide the service:
Yalla, Karim! is directed at children under the age of 13. In compliance with the Children's Online Privacy Protection Act (COPPA) and the EU's GDPR-K, we require verifiable parental consent before an account can be created or any personal information is collected.
How we obtain consent:
Children who do not have an account can use the app's free lessons without any personal information being collected.
Parents can delete the account and all associated data directly from within the app:
This action permanently deletes your email address, account UUID, lesson progress, consent record, and all other data from our database. It cannot be undone.
You may also request access to, correction of, or deletion of your data by emailing us at privacy@yallakarim.com. We will respond within 30 days.
If you are in the EU or EEA, you have the right to access, rectification, erasure (“right to be forgotten”), restriction of processing, data portability, and the right to object to processing. To exercise any of these rights, contact us at privacy@yallakarim.com.
You also have the right to lodge a complaint with your national data protection supervisory authority.
We take reasonable technical and organisational measures to protect your data:
No security measure is perfect. In the unlikely event of a data breach affecting personal information, we will notify affected users as required by applicable law.
We do not knowingly collect personal information from children under 13 without verifiable parental consent. Specifically:
If you believe we have inadvertently collected information from a child without proper parental consent, please contact us immediately at privacy@yallakarim.com and we will delete it promptly.
We may update this policy from time to time. When we do, we will update the “Effective Date” below. For significant changes, we will provide a prominent notice in the app or by email.
If you have questions about this privacy policy, want to exercise your data rights, or need to report a concern about your child's data, please contact the data controller:
We aim to respond to all privacy enquiries within 30 days.