Effective date: August 23, 2026 · Version: 1.1
Contact: [email protected]
Karotto is a coding-learning app for children aged 7–12. This policy explains what information the app handles, why it is needed, and how a parent can remove it.
Karotto (”we”, “us”, “the app”) is the developer and operator of the Karotto mobile application. We are the party responsible for the information described here.
The child’s display name, age, and chosen avatar
Learning progress kept locally (lesson stars, skipped lessons, playtime, created “game” projects, sticker album)
b) Stored on our server, tied to a random Firebase anonymous ID. We use progress and paywall interaction data as first-party analytics to improve lessons and app reliability. It is not used for advertising, behavioral profiling, or tracking across other companies’ apps or websites:
c) Optional sign-in
Karotto can be used without an account. A parent may optionally sign in — behind a parental gate — so learning progress and Premium can be restored on another device. The iOS app offers Sign in with Apple; the Android app offers Sign in with Google.
When a parent signs in, Google Firebase Authentication stores the linked account identifier and may receive the email address and account name provided by Apple or Google. An Apple email may be a Private Relay address. We use this only to identify the account and restore progress; never for marketing, sale, advertising, or cross-app tracking.
Children are never asked to sign in or to enter any personal information.
d) Purchases:
Payments are processed by Apple App Store on iOS or Google Play on Android. We never receive card or bank details. We receive only the product and purchase token or receipt needed to verify and unlock Premium.
e) In-app hints: When the child taps the in-app hint button, the app sends the current lesson ID, the lesson type, the attempt number, and the child's current in-lesson answer (the block sequence or grid position they placed) to our server, so the server can return the right hint. This is processed by fixed, rule-based logic on our own server. It is not sent to any third party, is not used for analytics or profiling, and is not stored.