This is a translation of the privacy policy, which is written in Spanish. If a translation does not match the Spanish text, the Spanish text prevails.
Who is responsible for your data
FonoBeat is a product of MANDP SUPPLY LLC, a company incorporated in New Mexico, USA with its address at 4300 Ridgecrest Dr SE Ste L 1200, Rio Rancho, NM 87124, United States. It is the entity responsible for processing the data described here, and you can send any request about that data by writing to contact@fonobeat.com or calling +1 786-297-0650. Requests are handled by the FonoBeat team at that address.
Validity: this version of the policy applies from November 6, 2026 until we publish another one; each version carries its date at the top. The databases it describes exist for as long as the service runs, and each piece of data is kept for the time stated in its section.
The principle: collect the minimum
FonoBeat works with as little data as possible. The app doesn't ask for data it doesn't need to work, there is no advertising inside it, and we don't hand data over to third parties for their own use. If a piece of data doesn't improve your child's practice or your view of their progress, we don't want it.
Children: what we do, in practice
FonoBeat is designed for children aged 3 to 12 using it with their family. These are the product decisions behind that, and each one can be checked in the code:
- The person who signs up is always the adult. A child profile is not an identity you can sign in with: it has no credentials or email, and it hangs off the adult's account. The adult declares that they are an adult and authorizes the use as the minor's legal representative.
- For the child, we store their nickname, their age and their practice progress, plus app settings such as the avatar they choose or the language they practise. There is no field for their legal name, date of birth, ID document, email, phone number or location.
- No camera and no contacts. The app doesn't ask for them because it doesn't use them. The only image it can receive is the screenshot an adult chooses from their gallery, if they want to, when reporting a problem (explained below).
- Parental controls. Purchases, settings and external links are behind a gate for grown-ups. The child's area is only for singing and practising.
We don't display a COPPA certification seal because we don't have one: what there is, is the list above, which is what really decides what gets collected.
How long a child profile's data is kept: the nickname, age and progress are kept for as long as the profile exists, and are deleted when the adult deletes the profile or the account. And we do not make use of the app conditional on giving us more data than is described here.
The voice: it leaves the phone so it can be assessed, and it is not stored
There are two different promises here and it's worth not confusing them, because we can only make one of the two.
When your child does a pronunciation exercise, the audio of the attempt leaves the phone so it can be assessed: it travels encrypted to our server, which passes it to Microsoft Azure Speech, a speech recognition service from an external provider. Azure compares it with the reference on the spot and returns the result. The audio does not remain on any server: ours doesn’t write it to disk or to any table (it lives only in the memory of that request), and Azure processes it on the spot and does not keep it. What is stored is the result (how each phrase went, the Challenge stars, the progress), not the sound.
And voice practice starts switched off. A profile is created with it disabled, and an adult turns it on after the parental gate; the server checks again before assessing anything.
A third party, stated plainly: because the assessment is done by Microsoft Azure Speech, your child’s voice leaves our systems and passes through that provider. What remains true is that it is not stored. Before, the assessment was done by a system of our own, and we announced the change on this page before it happened.
What data FonoBeat handles
- From the adult: email and sign-in credentials. Purpose: to authenticate the account and communicate with you.
- From the child profile: nickname, age and practice progress. Purpose: to greet them, match the content to their stage and show you their progress.
- From the subscription: the status of the plan (active, expired). Purpose: to know which content you have access to. Payment is processed by the App Store or Google Play, and your card details don't go through our servers.
In addition, depending on what you use, there is data from usage analytics, notifications, invitations between families and the screenshot you attach to a report. Each one has its own section below.
Who processes data on our behalf. The main providers are Supabase, which hosts the database and the accounts; Apple and Google, which charge subscriptions in their stores; PostHog, which receives the app’s usage analytics on servers in the European Union; and Microsoft Azure Speech, which assesses the audio of the attempt on the spot and does not keep it. Each section of this policy also names the provider involved in that function. We will give you the full list of providers, with what each one does, if you ask at contact@fonobeat.com.
Where and why. Because MANDP SUPPLY LLC is a US company, your data is processed there and in the countries where its providers operate. We process it because it is needed to provide the service you sign up for (account, profiles, subscription and service notices), because you give us your consent (waiting list, screenshot when reporting a problem, promotions) or because of our legitimate interest in measuring and improving the app with the pseudonymous analytics explained below.
App usage analytics
To know which features are used and whether families come back, the app records usage events, and we analyse them in aggregate: we look at them as a whole, not person by person. They are stored in our own database and also in PostHog (PostHog Inc.), an analytics tool that processes them on our behalf on servers in the European Union.
The events carry no names, nicknames, emails, voice or text written or shown on screen. They do carry an internal, opaque identifier for the account and another for the app installation and, for what the child does, the internal identifier of their profile, never their nickname. They also carry the app version, the phone's operating system, the type of screen (never what it shows) and whether it belongs to the children's area or the adults' area. They are used to count active users and how many come back, to see which content works and to spot where sign-up and purchase get stuck. That is why this analytics is pseudonymous, not anonymous: those identifiers don't say who you are, but we could link them to your account. The country, when it appears, comes from the time zone and language set on the phone, not from its location.
PostHog does not receive screen recordings, IP-based location or advertising identifiers: IP-based location is turned off and the IP is discarded. In PostHog the adult appears only as an opaque identifier, with no name or email, and the child never appears as a person.
This analytics is not sold, not shared with anyone else and not used for advertising or to build behavioural profiles. In our database it is kept while the account exists and deleted together with it. In PostHog it is kept for up to 12 months; if you delete the account or ask at contact@fonobeat.com, we delete it there too. Legal basis: our legitimate interest in measuring and improving the app (internal operations).
Notifications for the adult
FonoBeat's notifications are for the adult and only arrive if you give the phone's system notification permission. These are the kinds:
- Weekly family summary. The phone itself schedules it, without going through our servers.
- New song alerts. At most one a week, on Saturday at 3:00 PM the phone's local time (if the phone hasn't told us its time zone, at that time in UTC), when there are new songs for your family. They are turned off in Settings, with the «New song alerts» switch.
- FonoBeat news and reminders. New features, news and the occasional reminder. They come switched on, and you can turn them off whenever you want in Settings, with the «FonoBeat news and reminders» switch. They are separate from promotions.
- Promotions and offers. Only if you turn them on yourself: they come switched off. We store the date you gave that consent, and you can withdraw it whenever you want, also in Settings. If another account signs in on the phone, they switch off again.
To send all of them except the weekly summary, we store, for each phone: the notification token (an identifier the system provides so notifications can be delivered to it), the platform (Android or iOS), the app language, the time zone and those preferences, plus a record of which notifications it has received, so they are not repeated. News and offers may be targeted by app language or by whether you have a free or paid plan. No data about the child is stored, and the text of the notifications doesn't include any either. The token is deleted when you sign out or when the app detects that you withdrew the permission, and a token that stops working is deactivated and not used again.
Delivery goes through Expo, the notification delivery service the app uses, and on Android also through Firebase Cloud Messaging, from Google. They act as delivery providers: they receive the token and the text of the notification in order to get it to your phone.
Invitations between families
From the grown-ups' space you can invite another family with your code. Everything happens between adult accounts:
- Each account has a random code of 6 characters. It isn't derived from your email or your name, and it contains no personal data.
- When another family redeems it, we record which account invited which.
- The invited family receives some welcome AI Voice Challenges when redeeming the code. The family that invited receives its reward, also in AI Voice Challenges, when the invited family does its first AI Voice Challenge, with a cap on rewarded families per month.
- To prevent abuse, we may review accounts and block them in the invitation programme: their code is no longer accepted and they receive no rewards. If we block one, we only store a reason from a closed list and, at most, a short internal note that we write without personal data.
Invitations store no data from child profiles: to know that the invited family has done its first Challenge, we only look at which account that Challenge belongs to.
Screenshot when reporting a problem
In the grown-ups' space, when using «Report a problem» you can attach, if you want, a single image chosen from your gallery. To send it you have to tick a consent box, because a screenshot can show app data, such as a profile's nickname.
We use it only to resolve that report. It is stored in private storage at Supabase, our database provider, which only the FonoBeat team can access: nobody can see it from the app, not even the person who sent it. The team opens it through a private link that expires after 7 days and arrives by email through our email provider, Resend. It is kept for up to 12 months and then deleted automatically. If an image is uploaded but the report is never created, it is deleted within 24 hours.
App crash diagnostics
We use a diagnostics provider, Sentry (Functional Software Inc., USA), to detect and fix app crashes. When the app crashes, it receives technical data about the crash (device model and operating system, app version, the screen and the preceding steps) and a reconstruction of the screen where it happened, with all text and images hidden. To see where the app gets stuck even when it doesn't crash, it also receives that reconstruction, just as hidden, for a small share of sessions, plus performance data, such as how long each screen takes to load.
Sentry does not receive names, email addresses, audio, location or advertising identifiers, does not know which family or profile a crash belongs to, and is not used for advertising or to build profiles. Legal basis: the operation and security of the service (internal operations).
This website's waiting list
It is the only thing on this site that collects personal data, and only if you type it in. When you sign up you give us your email address, the language pair you're interested in and whether you're writing as a family or as a school; on the schools page, also the name of the school and your role, if you want to add them. That's all that is sent. We don't ask you for data about your child: not their name, not their age, not their voice.
Purpose: to let you know when your language pair has lessons, and to count how many people ask for each pair to decide what we produce first (that count is aggregated and doesn't contain your address). There is no newsletter and we don't hand over the list.
The data is stored at Supabase, which is our database provider and acts on our behalf. When you tick the consent box we also store the exact text you were shown when you accepted: without it, a «yes» doesn't say what you said yes to.
Retention: until we have told you about the launch of your pair, until we decide not to produce it, or until you ask us to delete it, whichever comes first.
Your rights, and how to exercise them
You can ask us to access the data we hold about you, correct it, erase it, withdraw your consent where you have given it, and object to a specific processing. The same applies to the data in your children's profiles, which you manage.
There is a single channel: write to contact@fonobeat.com from the address you signed up with, saying what you want. That address is what lets us check that the request is yours; if you no longer have access to it, write to us anyway and we'll sort it out with you.
Procedure and deadlines: we acknowledge receipt and confirm by email when it is done. A query (finding out what data we hold about you) is answered within 10 business days at most, and a complaint (correcting, deleting, withdrawing consent or objecting) within 15 business days at most. If we need more time, we will tell you before the deadline expires, with the reason and the new date, within the extension the law allows. If we cannot fulfil the request, we will tell you why within that same period. To delete the whole account there is a separate page explaining what is deleted and what is not: delete your account.
If you are not satisfied, you can turn to the data protection authority: in Colombia, the Superintendencia de Industria y Comercio (SIC), after first filing the complaint with us; if you live in another country, that country's data protection authority.
Advertising and tracking
FonoBeat doesn't show advertising or integrate advertising or behavioural tracking SDKs, and neither does this website. The app's usage analytics is pseudonymous, processed by us and by PostHog on our behalf, and is explained above.
Cookies and local storage
This site does not set cookies: neither its own nor third-party ones, neither for advertising nor for tracking. That is why it does not ask your permission for cookies: it has none to ask about.
What your browser does keep, in its own storage, is these three things:
- The language you choose by hand in the language selector, to open the site in that language next time. If you do not choose one, nothing is stored.
- Your theme preference (light or dark), if you change it.
- How you got here, if you arrived through an NFC card or through a coded link from a source, a community or a campaign, only while the tab stays open, so we know where visits come from. It is the code of the card or link, not information about you; if you sign up, it is saved with your registration and with your contact in our contact management system. It is deleted when you close the tab.
The first two never leave your browser and are deleted by clearing the site data. None of the three identifies anyone.
Visit measurement. To know how many people visit the site we use Cloudflare Web Analytics and no other third-party tool. It sets no cookies, builds no identifier for you and does not follow you across sites: it counts page views in aggregate. The basis is our legitimate interest in knowing whether the site works, and it is not used for advertising.
Coded link measurement. If you arrive through a coded link, we record in our own database, hosted on Supabase, which code brought the visit, the first page, the language and four facts: that you arrived, that you opened the waiting list, that you signed up and that you tapped a store button. Each visit carries a random number that exists only in that tab and that we delete from our database after 90 days. We do not store your IP address or your browser, and if you arrive without a code we record nothing. The basis is our legitimate interest in knowing which links work, and it is not used for advertising.
Schools
In FonoBeat for Schools, each school sees only its own licensed students, with the same principles: minimal data, no advertising and no storing of voice. The school’s leadership can also see the progress of each student at the school, read-only, and every view it makes is logged: you can see it in the app.
How your child joins a class. If their school uses FonoBeat, you request the place from the app with the class code the teacher gives you, and the teacher approves the request. Until it is approved, you can withdraw it.
- The name: the school does not receive the name of the profile in the app. It sees the one you type when you request the place or, if the teacher already had your child on the class list, the one the teacher entered.
- The age: it is optional. The teacher sees it only if you type it or if it was already on their list.
- The practice: the school sees it only from the moment the teacher approves the link. What your child practised before that date remains your family’s alone.
The school’s views are logged. Every time the school’s leadership opens the school list, a class list or a student’s page, the view is recorded. For teachers, today it is recorded when they open their class list, and not yet on every screen of their dashboard: we are extending it. In the app you can see how many views by the school there were in the last 30 days.
Contact
Privacy questions: contact@fonobeat.com.