Privacy

Privacy policy

For the Tollo app for Android and this website. Last updated: 14 November 2026.

1. Who we are

Tollo is made and run by an independent developer. In this policy, "we" and "us" mean that developer, and "the app" means the Tollo app for Android.

Almost everything the app does happens on your child's device and never reaches us. For the small amount of information that does reach us (see What goes online, if you turn it on), we are the data controller. You can reach us at immidogen@gmail.com.

2. What stays on the device

The app keeps the following on the device it is installed on. None of it is sent to us or to anyone else.

• Your settings. The daily limit, which challenges are switched on and how each one is set up.
• The apps you choose to limit, and how long they have been used. To let you choose, the app reads the list of apps installed on the device. It keeps only the ones you pick.
• An activity history. Which challenges were completed, when, and the result, such as "20 squats completed" or a quiz score.
• Maths practice. Each question asked, the answer given, whether it was right, how long it took, how it was entered, and whether the rough-work pad was used. This is what the Insights screen is built from.
• Flashcard progress. For each card, how many times it has been seen, answered correctly and missed. Also any cards and topics you write yourself.
• About your child. Their birth month and year, school system and school year, if you enter them. The app uses these to pitch questions at the right level. It never asks for a name or a photo.
• Your parent PIN and recovery code. These are stored only in scrambled (hashed) form. The app can check them but cannot read them back.
• A record of changes to monitoring. When a permission the app needs is turned off or back on, when a parent unlocks the device to turn one back on, and when monitoring wasn't running, so the parent dashboard can tell you. Each entry is kept until you dismiss it, then deleted a month later.
• Your recovery email address, if you add one. See section 5.

3. Camera, microphone and steps

Camera

The squat challenge uses the camera to count squats. The picture is analysed on the device, moment by moment, to find the position of the body. No photo or video is saved, and nothing from the camera is sent to us or anyone else.

The camera is also used if you scan a QR code while resetting your PIN by email. The code is read on the device.

Microphone

When your child says a times table or a flashcard answer out loud, the app listens using Android's built-in speech recognition. The app itself never records or stores sound. It only receives the recognized words as text.

The speech recognition is provided by the speech service on your device, which on most devices is Google's. Depending on the device and its settings, that service may work entirely on the device or may send the sound to its provider to be recognized. That processing is covered by the provider's own privacy policy, not this one. If you would rather not use it, turn off the times-table challenge and the "Say it" option for flashcards, and the microphone is never used.

Step counting

The walking challenge reads step counts from Health Connect, if you give permission, or from the device's own step sensor. The app reads steps only while the walking challenge or its setup screen is showing. Because the challenge appears over another app, Android treats this as reading "in the background", which is why the app asks for that permission too.

The app uses the count only to see whether the goal has been reached. It does not keep a step history: the activity history records only that the goal was met.

4. Permissions

These are the permissions the app can ask for, and what each one is for. The camera, microphone and step permissions are requested only if you switch on a challenge that needs them.

Permission	Why the app needs it
Usage access	To see which app is open and how long the apps you chose have been used, so it knows when the limit is reached.
Display over other apps	To show the lock screen and its challenges on top of the app your child is using.
See installed apps	To show you the list of apps so you can choose which ones count.
Notifications	To show that the app is running, and the heads-up before time runs out.
Run in the background (foreground service)	To keep watching the limit while your child uses other apps, and to run the camera, microphone and step challenges on the lock screen.
Camera	To count squats, and to scan a QR code when you reset your PIN by email.
Microphone	To hear times tables and flashcard answers said out loud.
Physical activity	To read the device's step sensor for the walking challenge.
Health Connect: read steps, and read in the background	To read step counts from Health Connect for the walking challenge while it is showing over another app.
Start when the device turns on	To start monitoring again after the device restarts, if you had left it on.
Internet	Used only for the optional online features in section 5.

5. What goes online, if you turn it on

Until a parent adds a recovery email, the app does not contact our services at all. Both features below are optional, are switched off to begin with, and sit behind the parent PIN.

Recovery email

You can add an email address so that you can reset the parent PIN if you forget it. If you do:

• Your email address is sent to Firebase Authentication, a Google service, which emails you a sign-in link and keeps a small account for you: the email address, an ID for the account, and when it was created and last used. Google also keeps security logs for a limited time, which can include IP addresses.
• We use the address only to prove it is you when you reset the PIN and, if you turn on automatic sharing below, to keep what you send under your account so you can withdraw it. We never use it for marketing.
• Sign-in links work once and expire after an hour. If you open one on a different device, a page on this website shows it as a QR code for the app to scan. The code is drawn in your browser.

To remove it, open the parent area, choose Recovery email from the menu, then Remove recovery email. This deletes the account and anything shared under it.

Help improve recitation

Speech recognition finds some accents and some numbers harder than others. If you switch on Help improve recitation, the app keeps the words the speech recognizer heard during times-table challenges, so that you can share them with us.

• What is kept: the recognized words as text, which table and line was being said, whether the app accepted it, and your child's school system and school year. Never sound, and nothing else about your child.
• Where: on the device, for 30 days. Nothing is sent unless you send it.
• Sharing by hand: "Preview and share" shows you every line before you send it, using whichever app you choose.
• Sharing automatically: if you have a recovery email, you can choose "Send automatically once a day". The same text is then uploaded to our database (Cloud Firestore, a Google service, in London, UK) and stored under your account, where only you and we can read it.
• What we use it for: only to make the app better at understanding what children say. We do not use it to identify anyone, and we do not pass it on.

The speech recognizer writes down whatever it hears. If your child says a name or anything else personal while the challenge is listening, those words can appear in the text. This is why the preview shows you every line.

Turning the switch off deletes what is kept on the device and anything that was sent automatically.

Checking the app is genuine

When the app uses either online feature, Firebase App Check and Google Play Integrity confirm to our services that the request comes from a genuine copy of the app on a real device. Google handles this check, and it does not involve any information about your child.

6. Things you choose to share

• Save progress to a file. This creates a file holding your settings, the history, maths and flashcard progress and your own cards, so you can move to a new device or reinstall. It does not contain your PIN or recovery code. The file goes wherever you save or send it, so treat it as you would any personal document.
• Recitation text shared by hand, as described above. If you send it to us, we use it only to improve the app.
• Emails you send us. We keep them for as long as needed to deal with your question.

7. Android backup

If backup is switched on in the device's Android settings, Android may include the app's settings and history in the device's own backup, which is stored with your Google account under Google's terms. We cannot see or reach that backup. Your PIN and recovery code are left out of it.

8. What we don't do

• No advertising, and no advertising or analytics software in the app.
• No selling or renting of information, and no sharing it for other people's marketing.
• No profiling of your child, and no automated decisions about them beyond choosing the next question.
• No location, contacts or photos are read, and no files other than a progress file you choose to restore.
• The app sees which app is open and for how long. It never sees what is inside other apps: no messages, no browsing history, no screen contents.
• No account, name or photo for your child.

9. Other companies involved

The only company that handles information for us is Google, through these services:

• Firebase Authentication: the recovery email account.
• Cloud Firestore (London, UK): recitation text sent automatically, and early-access sign-ups from this website.
• Firebase App Check and Play Integrity: checking the app is genuine.
• Firebase Hosting and Google Fonts: serving this website.

Google acts on our instructions for the Firebase services and may process information in countries outside your own, including the United States, under its own data protection terms and safeguards. Separately, your device's speech service and Android backup are provided to you directly by their providers, as described above.

10. How long things are kept

• On the device: until you clear the app's data or uninstall it.
• Recitation text on the device: 30 days, then it is deleted automatically.
• Recitation text you sent automatically: until you turn sharing off, remove your recovery email, or ask us to delete it.
• Your recovery email account: until you remove it or ask us to delete it.
• An early-access sign-up: until we have told you Tollo is ready and for at most 12 months after that, or until you ask us to remove it, whichever comes first.

11. Deleting your data

You do not need to ask us. Everything can be deleted from the app:

• Recitation text on the device: in the parent area, under "Help improve the app", tap Delete.
• Recitation text you sent automatically: turn off "Send automatically once a day". Turning off "Help improve recitation" altogether deletes both.
• Your recovery email account, and everything stored under it: parent area, menu, Recovery email, then Remove recovery email.
• Everything on the device: clear the app's storage in Android settings, or uninstall the app.
• An early-access sign-up: email us from that address and we will remove it.

Deleting what is stored online needs an internet connection at the time. If you have already uninstalled the app, are unsure whether a deletion went through, or would simply rather we did it, email immidogen@gmail.com from your recovery email address. We will delete your account and everything stored under it, and confirm, within 30 days.

12. Security

• What is on the device sits in the app's private storage, which other apps cannot read.
• The parent PIN and recovery code are stored only as hashes, and repeated wrong attempts are locked out for a time.
• Anything sent online travels over an encrypted connection.
• Online records are private to the parent who created them (signed in with a verified email, from a genuine copy of the app) and to us.

No system is perfectly secure. If we learn of a breach that affects you, we will tell you and the relevant authorities as the law requires.

13. Children

Tollo is set up and managed by a parent or guardian, on a device their child uses. Children use the lock screen and its challenges. They cannot reach the parent area without the PIN.

We do not knowingly collect personal information from children. The child has no account, and we never ask for their name, photo, voice recording or contact details. The two online features can be turned on only by the parent, behind the PIN, using the parent's own email address, and by turning one on the parent gives consent for it.

If you think we hold information about a child that we should not, email us and we will delete it.

14. Your rights

Wherever you live, you can ask us what we hold about you, ask us to correct or delete it, and withdraw your consent to the optional features at any time by turning them off. We reply within 30 days and never charge for this.

• United Kingdom and European Economic Area. Under the UK GDPR and the EU GDPR, we rely on your consent for the two optional online features and for early-access sign-ups, and you can withdraw it at any time. You have the right to access, correct, erase, restrict and receive a copy of your information, and to object to how it is used. You can also complain to your data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk).
• India. Under the Digital Personal Data Protection Act 2023, you can ask for a summary of your information, ask for it to be corrected or erased, withdraw consent, raise a grievance with us at the address below, and after that complain to the Data Protection Board of India. We do not track children or direct advertising at them.
• United States. Under the Children's Online Privacy Protection Act, a parent can review any information we hold that relates to their child, have it deleted, and refuse any further collection. We do not sell personal information or share it for advertising, as those terms are used in US state privacy laws such as California's.

15. This website

• This site has no cookies and no analytics.
• Like any website, the company that hosts it (Google, through Firebase Hosting) keeps standard server logs, which include IP addresses, for a limited time.
• The fonts are loaded from Google Fonts, so your browser asks Google for them when a page opens.
• The site's only form is "Get early access", described below.

Early access sign-ups

If you enter your email address under "Get early access" and tick the box:

• What is kept: your email address, that you ticked the box, and when you signed up. Nothing else, and no cookie is set.
• Where: in our database (Cloud Firestore, a Google service, in London, UK). It can't be read back through the website; only we can see it, in the Firebase console.
• What we use it for: only to email you when Tollo is ready for families. We don't use it for anything else, and we don't pass it on.
• No email is sent when you sign up. The page simply says thank you.
• How long: until we have told you Tollo is ready and for at most 12 months after that, or until you ask us to remove it.
• To be removed: email immidogen@gmail.com from that address.

16. Changes to this policy

If the app changes in a way that affects your privacy, we will update this page and the date at the top before the change reaches you. For anything significant, such as a new kind of information leaving the device, the app will also ask you first.

17. Contact

Questions, requests or complaints about privacy: immidogen@gmail.com.