Privacy Policy

How we handle children's data in the Sorozano app

Last updated: August 15, 2026

1. Who we are

Sorozano is an educational app for mental math and the soroban, designed for children, their parents, and their coaches.
Data controller: Sorozano.
Contact: support@sorozano.com.
This policy is deliberately written in plain language, since most readers are parents, not specialists.

We show no ads, and we don't use any ad network.
We never sell anyone's data, and never share it for marketing purposes.
We don't collect location data, and we don't request access to the camera, microphone, or contacts.
Children never upload personal photos.
The app requests only two permissions: internet access and sending notifications.
All data is stored within the European Union.
We use Google Analytics to measure visits to our website and understand how it's used. This data includes general information such as country, device type, and traffic source, and does not include any data that identifies the child or the parent.

When creating an account:
Name, email address, and password.
When signing up with a Google account: the name and email address registered on that account.
When completing the profile:
The in-app username.
Gender, date of birth, and country.
A WhatsApp number — from adults only (parents and coaches). We never ask a child for any phone number.
While using the app:
Learning progress, exercise results, and tournament results.
Points, stars, and gems.
A learning-interaction log: when a child paused, retried, or finished an exercise — with no free text and no personal data inside it.
A notification token and a random device identifier.
To clarify: the device identifier is a random number we generate ourselves — it reveals neither the device type nor its owner, and its only purpose is limiting an account to a single device.

A child's real name is never shown to any other child in the app, under any circumstances.
On leaderboards, in friends lists, tournaments, challenges, and notifications, what's shown is the username the child chose themselves, or an automatic anonymous name if they haven't chosen one.
The real name is visible only to: the child themselves, their linked parent, their linked coach, and the academy's administration.

The linked parent: their child's full data and progress.
The linked coach: their students' data and progress.
Other children: only the username, avatar, points, and country.
Google (via Firebase and Google Analytics): the technical infrastructure provider for storage, authentication, and notifications, and for measuring visits to our website.
No other third party has access. We never sell, rent, or share data for commercial purposes.

In Google data centers within the European Union (Belgium and the Netherlands), protected by Google's Firebase.

The app is designed for children, and we handle their data with particular care.
Registration in the app is only possible with an access code issued by the partner academy and handed to the parent. A child cannot register on their own without this code.
Through this mechanism, parental consent is a precondition for registration, since the academy is the one that communicates with the parent and hands over the code. The parent can then link their account to their child's account and review or delete their data at any time.

A parent may, at any time, review their child's data, correct it, delete the account and all its data, withdraw consent and stop using the app, or request a copy of the data.
To exercise these rights: support@sorozano.com — we respond within 7 business days.

The account can be deleted from within the app or by contacting us. Full details are on the Account deletion page.
In short: a 30-day recovery window, followed by permanent erasure of everything. We retain only the subscription record for accounting purposes, which contains neither the child's data nor their progress.

We retain data for as long as the account exists. Upon deletion, it is erased as described above. Unused accounts remain in place until their owner requests deletion.

Fully encrypted connections.
Strict access rules that prevent any account from reading another account's data.
Sensitive operations run on the server, not on the device.
Passwords are encrypted, and we never have access to them.
No system is ever completely secure, but we commit to doing our best, and we notify anyone affected immediately in the event of any breach.

We may update it whenever the app changes. We notify users of material changes within the app itself. The date of the last update is shown at the top of this page.