Privacy Policy

Last updated: May 29, 2026

1. About this Privacy Policy

This Privacy Policy describes how Kalyaki collects, uses, stores, and protects information when you and your child use the Kalyaki mobile application or visit https://kalyaki.com (together, “the service”).

The service is operated by Egor Sharapov, a Sole Professional licensed by the Dubai Development Authority (Sole Professional License No. 107100), registered at Building 16, Ground Floor, Dubai Internet City, Dubai, United Arab Emirates. For purposes of applicable data-protection laws, Egor Sharapov is the data controller of the personal data described in this Policy.

This Policy is incorporated into the Terms of Service at https://kalyaki.com/terms.

2. In brief

Plain-language summary, for parents in a hurry:

• We collect the drawings your child creates in Kalyaki, plus the first name you type when setting up the profile, your child’s age, and an anonymous profile identifier — used only to train and improve our drawing-recognition AI.
• We do not collect emails, phone numbers, location, contacts, payment information, advertising IDs, or other personal data.
• We do not show advertising, profile your child, share data with advertisers, or sell data. The mobile app contains no third-party analytics or trackers. The marketing site https://kalyaki.com uses one cookieless analytics service (PostHog) to count anonymous pageviews and App Store badge clicks per ad campaign — no cookies, no cross-session tracking, no personal data. Section 3 explains exactly what the website collects.
• Drawings uploaded to our servers are kept indefinitely for AI training and are not automatically deleted when you delete your local profile in the app. Email hello@kalyaki.com to request server-side deletion.

The detailed sections below explain each of these points and your rights.

3. What information we collect

From the mobile app

For each drawing your child completes, the app uploads to our servers:

• The drawing itself, rendered as a 256 × 256 pixel PNG image (white strokes on a black background, with kid colors discarded for the training pipeline).
• The first name typed by the parent or guardian when setting up the child’s profile in the app’s Profile Wizard.
• The child’s age, recorded as an integer between 3 and 8 inclusive.
• An anonymous “profile identifier” — a random UUID generated on the device when the profile is created. The identifier is not linked to any external account, email address, or login.

No other information about the drawing session is uploaded.

When you make an in-app purchase, our purchase-processing partner Adapty receives the transaction details from Apple and shares with us:

• the anonymous Apple transaction identifier;
• the product purchased (for example, “Creator Pack”);
• the transaction date and timestamp;
• the profile identifier (the same anonymous UUID described above), so that the entitlement is granted to the right profile.

Apple processes the actual payment; we do not receive your payment-card number, billing address, CVV, or any other payment information.

When you redeem a class code (issued to schools and educators who license Kalyaki for classroom use), the app sends the entered code together with the profile identifier to our server. Our server validates the code, consumes it, and grants the corresponding entitlements to that profile. We retain a redemption record that includes the redeemed code, the profile identifier, and the date and time of redemption. Where a class code is linked to a particular school or educator account, that affiliation is stored alongside the redemption record so that we can report classroom activation counts back to that school or educator. We do not share children’s first names, ages, drawings, or learning progress with schools or educators.

From the website (kalyaki.com)

When you visit the site, our infrastructure provider records standard server logs: your IP address, the page or asset requested, a timestamp, and your browser’s user-agent string. These logs are used only for security, troubleshooting, and basic operational diagnostics.

The site does not set any first-party cookies.

The site uses one third-party analytics service, PostHog, to measure ad-campaign effectiveness. Each pageview and each click on the App Store download badge is recorded together with: the URL visited, the referring page, any UTM campaign parameters present in the URL, your browser’s user-agent string, and an approximate location derived from your IP address. The site does not embed any other third-party trackers, analytics pixels, marketing tags, or social media SDKs.

PostHog is configured in cookieless mode: it does not set cookies, does not write to your browser’s local storage, and does not create a persistent visitor identifier. Each visit is treated as anonymous and cannot be linked to your other visits or to any other website. PostHog receives this data at us.i.posthog.com, operated by PostHog Inc. in the United States. You can opt out at any time by using a browser-level analytics blocker or by enabling your browser’s Do Not Track setting.

From the device

The mobile app does not collect, access, or transmit:

• advertising identifiers (such as Apple’s IDFA or Google’s AAID);
• location information;
• contacts, calendars, microphone recordings, or photo library content;
• device fingerprints or other technical identifiers used for cross-app tracking;
• email addresses, phone numbers, or other contact information;
• your payment-card number, billing address, or other payment details (purchases are processed by Apple; we receive only the purchase confirmation described in “From the mobile app” above).

4. How we use this information

• Drawings + profile metadata are used to train and improve the on-device drawing-recognition models that power Kalyaki’s Learn and Play modes. The data feeds AI model training pipelines; it does not influence the app’s behavior on your specific device, and it does not personalize advertising or content shown to your child.
• Purchase records and class-code redemption records are used to grant access to the word packs you have unlocked, to restore those entitlements when you set up Kalyaki on a new device, and to handle refund and support requests. For class codes issued to schools or educators, we also use the redemption records to report classroom activation counts to the purchasing school or educator (without disclosing children’s names, ages, drawings, or learning progress).
• Website server logs are used to keep the site running, detect abuse, and diagnose technical problems.

We do not use any of this data for behavioral profiling, advertising, marketing to children, or sale to third parties.

5. Service providers (subprocessors)

We rely on the following service providers to operate the service. Each is bound by its own privacy and security commitments and processes data only on Kalyaki’s instructions.

• Cloudflare, Inc. — hosts kalyaki.com (Cloudflare Pages) and operates the upload-proxy endpoint that receives drawings from the mobile app (Cloudflare Workers). Cloudflare may process technical request data such as IP addresses and request headers.
• Amazon Web Services, Inc. (AWS S3) — stores the uploaded drawings and the accompanying profile metadata.
• Adapty Tech Inc. — purchase orchestration. Adapty receives in-app purchase records from Apple (the anonymous Apple transaction identifier, the product purchased, the transaction timestamp, and the device’s profile identifier), forwards them to us so we can grant the corresponding entitlements, and stores them for purchase-history and refund-handling purposes. Apple processes the actual payment; Adapty does not receive payment-card information. Adapty’s own privacy policy is available at https://adapty.io/privacy/.
• PostHog Inc. — website analytics for the marketing site kalyaki.com only (not used in the mobile app). PostHog receives the anonymous pageview and App Store badge click events described in Section 3, together with the URL visited, the referring page, any UTM parameters, your browser’s user-agent string, and an approximate location derived from your IP address. PostHog is configured to operate without cookies or persistent identifiers; each visit is anonymous. PostHog’s own privacy policy is available at https://posthog.com/privacy.

The mobile app does not use any third-party analytics providers, advertising networks, marketing-automation tools, or crash-reporting SDKs. The marketing site’s only third-party analytics provider is PostHog, configured as described above and in Section 3; we do not use Google Analytics, Mixpanel, Amplitude, Firebase Analytics, advertising networks, marketing-automation tools, or session-recording SDKs anywhere.

6. Where data is stored & international transfers

Drawings and metadata are stored in Cloudflare and AWS regions that may include locations outside the United Arab Emirates, typically in the United States or the European Union. Where personal data is transferred across borders, we rely on the standard contractual safeguards and certifications offered by our service providers.

All data is encrypted in transit (HTTPS) and at rest (using the default encryption provided by AWS S3 and Cloudflare).

7. Retention & deletion

Uploaded drawings and profile metadata are retained on our servers indefinitely for AI model training, unless you request earlier deletion.

Purchase records (the anonymous Apple transaction identifier, the product purchased, the transaction timestamp, and the associated profile identifier) are retained for as long as Apple and applicable tax, audit, and refund regulations require — typically several years — and as needed to honor your purchases on new devices. Purchase records do not contain payment-card details.

Class-code redemption records (the redeemed code, the profile identifier, the date and time of redemption, and any associated school or educator affiliation) are retained for as long as the underlying classroom license is active and for a reasonable period thereafter to handle support and audit requests.

In-app “Delete Account” (Settings → Delete Account) wipes the local profile and all on-device database records — drawings stored in the device’s gallery, profile name and age, learning progress, badges, and the profile identifier. This local wipe does not delete server-side records, because once the local profile is removed, the device no longer holds the link between the profile UUID and the child’s real first name; we cannot re-associate the server-side data to a real person without your help.

Server-side deletion is available on request. Email hello@kalyaki.com with one of the following, and we will delete the records and confirm by email within 30 days:

• the profile_id (you can find it under Settings before deleting the profile), or
• the child’s first name, age at time of use, and the approximate dates the app was used.

8. Children’s privacy

Kalyaki is designed for children ages 3–8 used under the supervision of a parent or legal guardian. We treat children’s privacy as a priority.

• Parental consent. A parent or legal guardian must agree to the Terms of Service and this Privacy Policy before allowing a child to use Kalyaki. Acceptance happens implicitly when the parent installs the app and creates a profile for the child.
• Parental gate. The app uses a short reading-comprehension puzzle (a “parental gate”) to protect Settings, account deletion, profile edit mode, and any external link out of the app from being triggered by a young child without parental involvement.
• Minimum data. We collect only the information described in Section 3, and only what is needed to provide and improve the service.
• No behavioral profiling. We do not build behavioral profiles of children. We do not show advertising. We do not implement social features such as chat, friend lists, or user-generated content sharing. Drawings uploaded by one child are never shown to other children.
• No third-party tracking in the app. No third-party analytics, advertising, or tracking SDKs are present in the mobile app. The marketing site’s cookieless pageview analytics (Section 3) does not run in the app.
• In-app purchases. Paid word packs are offered behind Apple’s standard purchase flow, which requires the device’s Apple ID password (or Face ID / Touch ID) to complete. We recommend that parents also enable Screen Time → Content & Privacy Restrictions → “iTunes & App Store Purchases → Require Password” (or equivalent on other platforms) to prevent accidental purchases by a child.

If you believe we have collected information from a child without appropriate parental consent, please contact hello@kalyaki.com and we will investigate and delete the records.

9. Your rights

As the parent or legal guardian of a child whose data is processed by Kalyaki, you may exercise the following rights on behalf of your child:

• Access. Request a copy of the data associated with the profile.
• Deletion. Request server-side deletion of drawings and metadata. See “Retention & deletion” above.
• Correction. Request correction of inaccurate data, typically the recorded first name or age.
• Restriction / objection. Request that we stop using your child’s data to train our models. We will treat such a request as a deletion request.

Depending on your country of residence, you may have additional statutory rights — for example under the United Arab Emirates’ Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), the UK or EU General Data Protection Regulation (GDPR), or California’s Consumer Privacy Act (CCPA). We honor requests asserting these rights regardless of jurisdiction.

To exercise any of these rights, email hello@kalyaki.com. Please include the profile_id (visible in the app’s Settings before deletion) or, if the profile has already been deleted on the device, the child’s first name and the approximate dates of use, so that we can locate the relevant records. We aim to respond within 30 days.

10. Security

We protect data using these practices:

• In transit: all traffic to and from kalyaki.com and our upload endpoint uses HTTPS.
• At rest: drawings and metadata are stored with the default encryption provided by Amazon S3.
• Access control: access to the production data is limited to Egor Sharapov (the operator). Drawings are reviewed only as part of automated machine-learning training pipelines, not by humans.

No system can be guaranteed completely secure, but we work to apply reasonable, industry-standard practices for the scale of the service.

11. Changes to this Policy

The “Last updated” date at the top of this page tracks revisions. Material changes — such as the introduction of a new category of data we collect, a new subprocessor, or a change to our retention practice — will be highlighted in a notice on kalyaki.com and, where reasonable, in the app, at least 14 days before they take effect.

By continuing to use the service after the revised Policy takes effect, you accept the changes. If you do not accept the revised Policy, stop using the service and contact us to request deletion of your child’s records.

12. Contact

Questions about this Privacy Policy or your rights under it? Contact us:

• Operator / Data controller: Egor Sharapov (Sole Professional License No. 107100, Dubai Development Authority)
• Registered address: Building 16, Ground Floor, Dubai Internet City, Dubai, United Arab Emirates
• Email: hello@kalyaki.com

When emailing about a privacy request, please include “Privacy Request” in the subject line so we can route it quickly.