Privacy policy

1. What this policy covers

Pepito Curioso is an app for learning by teaching: you pick a topic, explain it out loud to Pepito — an AI student who knows almost nothing — and his questions show you what you have not mastered yet.

This policy covers the iOS and Android app and this website. It does not cover third-party services you may reach from here, such as the app stores, which have their own policies.

If you are using the app as a minor, this policy is written for your parent or guardian too: the section on children is the important one, and it is worth reading together.

2. Who is responsible for your data

The data controller is Cachalot Lab, the developer of Pepito Curioso.

For anything to do with your data, write to our privacy mailbox. We answer every request, including the ones asking us to delete everything.

• privacidad@pepitocurioso.com

3. What we collect

We collect what the app needs to work and what tells us whether it is teaching well. It breaks down like this:

• Account data: the identifier you sign in with and, if you give them to us, a name or nickname and an email address. The nickname can be made up.
• Session content: the topic you picked, your explanation, Pepito’s questions and how the session went.
• Voice: the recording of what you say while explaining, and its transcript. It has its own section below.
• Progress and game state: topics mastered, brains, energy, streak and achievements.
• App usage: which screens are opened, how long a session lasts and what breaks, so we can fix bugs and improve the product.
• Device: model, operating system, language and an install identifier. We do not collect your precise location.
• Purchases: whether you subscribe to Tutor Pro and since when. Payment details never pass through us.

We never ask for your postal address, phone number or school details, and the app has no chat with other people: the only conversation is with Pepito.

4. Voice recordings

Voice is at the heart of the app, so it deserves its own section. The microphone only turns on while you hold the explain button: there is no background listening and no wake word.

• The recording is sent to our servers to be turned into text. That text is what Pepito reasons about and asks questions from.
• Once transcribed, the audio recording is deleted. We keep the transcript because it is what makes up your session history and your progress.
• We do not use your voice to identify you biometrically or to build a profile of how you speak.
• We do not train AI models on your recordings or your transcripts.
• You can delete an individual session from the app; its transcript goes with it.

You can also use the app by typing instead of speaking. In that case no audio is recorded and everything else works the same.

5. How AI is involved

Pepito’s questions and the assessment of your explanations are generated by a language model. To do that we send the topic and the text of your explanation to a model provider acting as our processor, under contract and only to provide that service to us.

• We send the session content, not your name or your email address.
• The provider may not use that content for its own purposes or to train its models.
• No decision with legal or similarly significant effects on you is made automatically: what the model does is ask questions and score an explanation inside a game.

6. What we use the data for

• Running the service: understanding your explanation, generating Pepito’s questions and saving your progress. Legal basis: performance of the contract you accept by using the app.
• Keeping the app standing: detecting failures, preventing abuse and protecting accounts. Legal basis: our legitimate interest in a working, secure service.
• Improving the product: understanding which parts get used and which get abandoned, using aggregated data. Legal basis: legitimate interest, and consent where the law requires it.
• Managing the Tutor Pro subscription and purchase status. Legal basis: performance of the contract.
• Showing rewarded ads to people who choose to watch them. Legal basis: consent.
• Answering your support messages and your rights requests. Legal basis: compliance with a legal obligation.

We do not use your data for personalised advertising and we do not sell it to anyone. We do not share it with data brokers either.

7. Children

Pepito Curioso is built for students, and that includes children and teenagers. So the app has limits that do not depend on anyone’s good intentions:

• There is no chat, no messaging, no public profile and no way for a stranger to contact a child. The only conversation is with Pepito.
• We do not show personalised or behavioural advertising to users who are minors. Rewarded ads, when they appear, are contextual.
• We do not ask for more personal data than the app needs, and the nickname can be made up.
• We do not profile children for commercial purposes.

Below the age set by the law of each country, an account requires the consent of a parent or guardian. If we find an account created without that consent, we suspend it and delete its data.

If you are a parent or guardian and want to see, correct or delete your child’s data, write to us and we will do it: you do not have to close the account to have the session history erased.

8. Advertising

Ads in the app are always opt-in: they appear when you choose to watch a thirty-second one to recharge a unit of energy. A session is never interrupted by advertising.

Ads are served by an external ad network, which receives technical device data to show the ad and count that it was watched. We flag users who are minors to the network, so they only receive contextual advertising.

The Tutor Pro subscription removes ads entirely.

9. Purchases and subscription

Tutor Pro is bought inside the app and billed by the store you downloaded it from: Apple’s App Store or Google Play. They process the payment.

• We never see or store your card number or your bank details.
• From the store we only receive confirmation that the subscription is active and until when.
• Invoices and refunds are handled by the store, under its own terms.

10. Who we share data with

We do not sell personal data. We share it only with the people needed to make the app work:

• Hosting and infrastructure providers, which store the data on our behalf.
• The speech transcription provider and the language model provider, for the process described above.
• The product analytics provider, with usage data.
• The ad network, only for rewarded ads.
• The app stores, for subscription status.
• Authorities or courts, where a rule requires it and after checking that the request is valid.

All of them act as processors, under a signed contract, and are required to use the data only to provide their service to us.

11. How long we keep things

• Audio recordings are deleted as soon as they are transcribed.
• Transcripts and session history are kept while the account is open, because they are your progress.
• Account data is deleted when you close the account, with a short grace period in case it was a mistake or an issue needs resolving.
• Technical and security logs are kept for a limited time and then removed.
• Billing records are kept for as long as tax rules require.

12. Security

Data travels encrypted between the app and our servers, and is stored encrypted at rest. Internal access is limited to the people who need it for their work and is logged.

No system is infallible. If a breach affecting your data happened, we would tell you and notify the supervisory authority within the deadlines the law sets.

13. Your rights

You can exercise these rights at any time, free of charge and without having to justify yourself:

• Access: find out what data we hold about you and ask for a copy.
• Rectification: correct anything that is wrong.
• Erasure: ask us to delete your data, including closing the account from the app itself.
• Restriction and objection: ask us to stop processing certain data.
• Portability: take your history away in a machine-readable format.
• Withdraw consent where processing relies on it, without affecting what was done before.

To exercise them, write to our privacy mailbox. We reply within the legal deadlines. If you think we got it wrong, you can complain to the data protection authority in your country.

14. International transfers

Some of our providers are outside the country you use the app from. Where that means moving data out of your region, we do it with the safeguards the applicable rules require, such as standard contractual clauses or an adequacy decision.

15. Changes to this policy

If we change anything, we update the date at the top. When the change matters — a new use of the data, for instance — we will say so inside the app before it takes effect, and ask for your consent if that is required.

16. Contact

Write to us with any question about this policy, to exercise your rights, or if you are a parent or guardian who wants to review a child’s data.

• privacidad@pepitocurioso.com