Privacy Policy

Last updated: October 31, 2026

Beta draft. Mazalchik is in a free beta, and this policy is a working draft that is still being reviewed. It describes what the service actually does today. If anything changes in a meaningful way, we'll update this page and email account holders before it takes effect.

Mazalchik ("Mazalchik", "we", "us") is operated by Mazalchik. We make a product for children, so we collect as little as we can, we never show ads, and we never sell or share personal information. This policy explains what we collect, why, and the choices you have. It is written with the U.S. Children's Online Privacy Protection Act (COPPA) in mind.

The short version

Only a parent or legal guardian (18+) can create an account. Children can't sign up on their own.
For each child, we keep only a nickname, an emoji avatar, their instrument, an optional age range, and their progress in the app.
No ads, no third-party trackers or analytics, no social plugins, no chat, no links out of the kids' area, no in-app purchases.
You can download all of your family's data, or delete your account and everything in it, at any time from the Parent dashboard.

What we collect

About you, the parent (account holder)

Your email address and a password. Passwords are stored only as a one-way hash, so we can never see them.
Your first name, if you give it, and how you heard about us, if you tell us.
Your choice about update emails, and a record that you agreed to these terms when you signed up.
Where your first visit came from: a referral code in the link (for example a teacher's ?ref= code) and the anonymous visit ID described below, which we link to your account when you sign up.
When the account was created and when it was last used.

About your children (entered by you)

A nickname or first name (we suggest a nickname), an emoji avatar, the instrument they play, and optionally an age range (for example "6–7").
We don't ask for, and don't want, a child's full name, photo, voice recording, birthday, school, location, email or phone number. The app doesn't use the camera or microphone to collect anything.

Created while your children use the app

Reading progress: which stories they opened, which page they reached, and which stories they finished.
Music progress: which pieces they played, how they rated each one (easy, OK or hard), their level on each instrument, and the stars they earned.
Active time: minutes spent reading and minutes spent playing music, per day. We only count time when the app is open and being used.
Story ratings: at the end of a story a child can give it a smiley rating and, if they want, type a short comment (up to 300 characters). This box is optional, and we ask children not to type personal details there. You can see and delete everything in the Parent dashboard.

Messages you send us

What you write in the contact or teacher forms, feedback in the Parent dashboard and answers to short surveys, plus any name, email or phone number you choose to include.
Password reset requests.

Visits to our public pages

To count visits to our website pages (home, FAQ, sign-up and similar, not the kids' app), your browser stores a random visit ID in local storage. With each page view we record that ID, the page, the referral code from the link if there was one, and the name of the website that sent you (for example "google.com", not the full address). We don't use cookies or any outside service for this.
Like any website, our server sees your IP address when you connect. We use it only to block abuse such as repeated password guessing: it is kept in a short-lived rate-limit record that is deleted automatically within 24 hours, and it is never linked to your account or your children. Our hosting provider may keep standard server logs for security.

How we use it

To run the service: save each child's place and progress, and pick music at the right level for them.
To show you, the parent, your children's reading and music activity in the Parent dashboard.
To improve the stories and music, mostly using totals across all families (for example, the page where children tend to stop reading a story).
To contact you about your account, and to send story updates only if you asked for them.
To keep the service secure and prevent abuse.

We collect from children only what's needed for them to use the app. A child never has to give more information to take part in anything.

What we don't do

We don't sell, rent or share personal information with anyone for their own marketing, and we don't do targeted or behavioral advertising.
We don't show ads, and we don't use third-party analytics, advertising SDKs, tracking pixels or social media plugins.
We don't make public any information about children. There is no chat, no messaging between users, no public profiles and no leaderboards with other families.

Who else handles data

We use a small number of service providers only to run Mazalchik, and only under agreements that let them use the data for that purpose:

Hosting: the server and database where your account and progress are stored.
Web hosting and email: our hosting provider (Hostwinds, USA) stores the site and its database and sends password reset emails from our own domain. It processes data only to run the service for us.

We may also disclose information if the law requires it, or to protect the safety of a child or the security of the service.

Children's privacy (COPPA)

Mazalchik is meant to be used by children with a parent's account. Accounts can only be created by an adult who confirms that they are the child's parent or legal guardian and agrees to this policy. That agreement is your consent to the collection described above.
Children's profiles are created by the parent inside the parent's account. The Parent dashboard is protected by a short "grown-ups only" question in the kids' app.
As a parent you can at any time: review your children's information (Parent dashboard, or a full download), correct it, delete a child's profile or your whole account, and refuse further collection by deleting the profile or stopping use of the app.
If we learn that a child created an account without a parent, we'll delete it.

Cookies and local storage

We use one cookie: a necessary sign-in cookie that keeps you logged in (for up to 60 days, or until you log out). Your browser also keeps a few small settings in local storage, such as which child is reading right now, plus the anonymous visit ID and referral code described above. There are no advertising or third-party cookies.

Where data is kept, and for how long

Data is stored on a secured, backed-up server. We keep it for as long as your account is open. When you delete your account, your account, your children's profiles, their progress and your feedback are deleted right away from the live database. Daily backups are deleted automatically, so deleted data is gone from backups within 14 days. Anonymous page-view counts that aren't linked to an account may be kept for statistics.

Your choices and rights

Download: Parent dashboard → My account → download all of your family's data as a file.
Correct: edit your account and each child's details at any time.
Delete: Parent dashboard → My account → delete account, or ask us and we'll do it.
Unsubscribe: turn off update emails in your account settings, or use the link in any update email.

Depending on where you live (for example California, Colorado, Connecticut, Virginia and other U.S. states), you may have additional rights to know, access, correct or delete personal information. We honor these requests for every family, wherever you live, and we won't treat you differently for making one. We don't sell or "share" personal information as those laws define it.

Security

Connections to Mazalchik are encrypted (HTTPS), passwords are hashed, sign-in attempts are rate-limited, and only the people who run the service can access the data. No system is perfect; if a security incident affects your information, we'll tell you promptly.

Changes to this policy

We'll post any changes here and update the date at the top. If a change is material, especially anything about children's information, we'll email account holders before it takes effect and ask for consent where the law requires it.

Contact us about privacy

For privacy questions or requests (including a parent's request to review or delete a child's information), email hello@mazalchik.com. Operator: Mazalchik. We'll reply within 7 days.