OralStarX Privacy Policy

Who we are and what this covers

OralStarX is an oral-practice app for primary and secondary school learners in Singapore. It is made and run by KidsX, a company based in Singapore. This policy explains what personal data the app collects, what we do with it, who else processes it and what you can ask of us.

It covers the OralStarX app on iOS, Android and the web, and the servers behind it. The corporate website at kidsx.space has its own, shorter privacy policy. We follow Singapore’s Personal Data Protection Act (PDPA).

Who the account holder is

OralStarX is parent-managed. The account holder is always the learner’s parent or legal guardian, and must be an adult. A learner never has a login of their own. The parent creates the learner’s profile, starts each practice session, records the learner’s voice and reads the results.

By creating an account you confirm that you are the learner’s parent or legal guardian, that you provide the learner’s details and recordings on their behalf, and that you consent to this policy for them. We rely on that confirmation; we do not run a separate age or identity check.

What we collect

Account. Your name, email address and password. The password is stored in a scrambled form that cannot be turned back into the password. We also store your country and, if you choose to add them in your profile, your date of birth, gender and mobile number. Each account gets a referral code, and we record which referral code, if any, you signed up with. We keep a record of the consents you gave at sign-up, with the version of this policy and the time. To prove that you control your email address we send short-lived verification codes; we store those codes in the same scrambled form.

Learner profile. The learner’s nickname, school level (Primary 3 to Secondary 4), school year, language preferences and levels, and an optional profile photo. We do not ask for the learner’s legal name, date of birth or school name.

Practice recordings and results. The learner’s voice recordings from each practice attempt, the transcript of what was said, the detected language, and the scores and feedback produced from them: an overall score, six skill scores, speech measurements such as speaking rate, pauses and pronunciation accuracy, strengths, weaknesses, corrected examples, recommendations, coaching notes and a training plan.

Purchases. Your credit balance and every credit transaction: free credits, purchased packages, redemption codes and credits used. For each purchase we keep the package, amount, currency, any discount code, the payment status and a transaction reference from the payment provider. Card and bank details never reach us; you enter them on Stripe’s, Apple’s or Google’s pages.

Support and feedback. Anything you send through the in-app feedback form, including up to two images you attach, comments you leave on a report, our replies and whether our reply email was delivered.

Device and technical. The app keeps one session token on your device so you stay signed in; on the web it lives in your browser’s local storage. We set no cookies of our own. On iOS and Android the app also keeps a copy of each recording on your device. Our servers see your IP address while you use the service, use it briefly in memory to limit abusive traffic, and do not store it. The app contains no analytics, crash-reporting or advertising trackers.

How we use it

We use this data to:

• create and run your account and verify your email address
• turn recordings into transcripts, scores, feedback and progress reports for the learner
• manage credits, packages and purchases
• answer your feedback and support requests
• protect the service, for example by limiting abusive traffic and telling people apart from bots on the feedback form
• improve the quality of the practice content and scoring

We do not use your data or the learner’s data for advertising, we do not build advertising profiles, and we do not sell personal data to anyone.

Automated assessment

Scores are produced automatically. A speech-recognition service turns each recording into a transcript and measures pronunciation. AI language-model services then read the transcript, together with the practice question and the learner’s level, and produce the scores, strengths, weaknesses and suggestions you see in the report.

These results support practice and learning only. They are not official school or examination results, and they can be wrong. Authorised KidsX staff may review recordings and results to check quality or to help you with a support request.

Everything the learner says during an attempt is transcribed and scored. Please encourage the learner not to say their full name, address, phone number, school name or identity number while practising. Our system flags such details when it notices them, but only after the transcript has already been produced.

Who we share it with

We share data only with the service providers we need to run OralStarX, and only the data each one needs:

• Speech recognition: Microsoft Azure. Receives the learner’s audio to produce the transcript and pronunciation assessment.
• AI scoring: large-language-model services. Receive the transcript of the learner’s speech as text, with the practice question and level. They do not receive a name, email address or account identifier. Their servers may be outside Singapore, including in China and the United States. We will give you the current list of these providers on request.
• Payments on the web: Stripe. Receives your email address, the package and amount, and any discount code. Card details are entered on Stripe’s own checkout page.
• In-app purchases: Apple App Store and Google Play. Process the payment under their own terms. We receive a transaction reference.
• Email delivery. An email-sending service receives your email address, name and the message we send: verification codes, password resets, purchase confirmations and replies to your feedback.
• Bot protection: Google reCAPTCHA. Used on the feedback form only, and loaded only when that form opens. Google then sees your IP address and browser details under its own privacy policy, and may set its own cookies. We receive only a pass or fail result.
• Country lookup. When you fill in your profile, an IP-to-country lookup service receives your IP address once so we can pre-fill the country field. We do not store the IP address.
• Hosting: DigitalOcean. Provides the servers where the app’s data lives, in Singapore.
• KidsX staff. Authorised staff can access recordings, transcripts and reports to run and support the service.

We do not share data with advertisers or data brokers. We may disclose data where the law requires it.

Where your data is stored and international transfers

Our servers and database run on DigitalOcean in Singapore. Recordings, learner photos and all account data are stored there.

Audio is processed by Microsoft Azure’s speech service in its Southeast Asia (Singapore) region, so recordings do not leave Singapore. Transcripts, but not audio, go to the language-model services described above, whose servers may be outside Singapore, including in China and the United States. We send those services only the transcript text, with no name, email address or account identifier, and they process it under their own terms. We keep the current list of these processors available on request. The payment, store and email providers also process data on their own infrastructure.

How long we keep it

• Voice recordings. Kept on our servers for up to 90 days, then deleted. The scoring service’s copy is deleted on the same schedule. On iOS and Android, the copy saved on your own device stays there until you uninstall the app; the app never deletes it.
• Transcripts, scores and reports. Kept until you delete your account.
• Account, learner profile, photo, purchases, credits and feedback. Kept until you delete your account.
• Email verification codes. Expire within minutes of being sent.
• Consent record. After you delete your account we keep only a record that consent was given, with the policy version and time, and nothing that identifies you.
• Backups. After deletion, copies of your data may remain in our backups for up to 30 days before those backups are overwritten. Backups are used only to restore the service after a failure.

Sharing features you control

Report share links. You can create a share link for a report. Anyone who has the link can open that report without signing in. It shows the learner’s nickname, the practice title, level, scores, strengths, areas to improve, corrected examples and the coaching notes for each answer. It does not include the recording or the transcript. A share link stays valid until you delete your account or ask us to withdraw it. Share it only with people you trust.

Invite links. Your referral code opens an invite page that shows the learner’s nickname (or your name, if no learner profile exists yet) to whoever opens it.

Your rights under the PDPA

You can ask us to:

• access the personal data we hold about you and the learner, and tell you how we have used or disclosed it
• correct it. You can change your own profile and the learner’s profile in the app at any time
• withdraw consent. Because the service cannot work without recordings and scoring, withdrawing consent means we delete the account
• delete your account and data, as described below

Email admin@kidsx.space from the address registered on your account. We respond within 30 days. If we need more time or cannot meet a request, we will tell you why.

Deleting your account

In the app, open Account, choose Delete account and learner data, confirm, and enter the code we email to your registered address. The account is deleted as soon as you confirm. You can also email us from your registered address and we will delete the account within 30 days. Our data deletion page walks through both routes.

Deleting the account deletes your parent profile including your email address, the learner’s profile and photo, all recordings, transcripts, reports, credits and purchase records held by us, and it stops any report share links from working. We keep only a record that consent was given (policy version and time, no identity), a short-lived reminder that tells the scoring service to delete its copy of the recordings, and whatever Stripe, Apple or Google keep under their own terms. Copies of your data may remain in our backups for up to 30 days before those backups are overwritten. Recordings saved on your iOS or Android device remain there until you uninstall the app.

Security

All traffic between the app and our servers uses HTTPS. Passwords and verification codes are stored in a scrambled form that cannot be turned back into the original, never in plain text. Recordings are stored under random file names that carry no name or account identifier, with file permissions restricted to the service. Only authorised KidsX staff can access recordings and reports. No system is perfectly secure, so we cannot promise that data will never be lost or accessed without permission, but we work to reduce that risk.

Children’s privacy

OralStarX is designed for children to practise with, but it is built so that a child never holds an account. Only a parent or legal guardian may register, and the parent provides and controls everything we hold about the learner: the nickname, school level, optional photo and voice recordings. We never knowingly let a child open an account. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

The version and date at the top of this page tell you which edition you are reading. If we make a material change, we will tell you by email to your registered address before it takes effect, and update the version and date on this page. Smaller changes are published here with a new version date.

Contact

Questions about this policy or about your data? Email admin@kidsx.space. Our Data Protection Officer can be contacted at admin@kidsx.space.