Privacy Policy — Learning Time

Effective date: 2026-06-01 (TestFlight beta launch)
Last updated: 2026-07-27
Availability: Learning Time is offered in Hong Kong, Indonesia, and select Southeast Asian markets (Singapore, Malaysia, Thailand, Philippines, Vietnam) via the Apple App Store and Google Play. It is not currently available in the European Economic Area, United Kingdom, or United States.

TL;DR — What you need to know in 60 seconds

Learning Time is a mobile app that helps parents track their child's early development. We take your privacy and your child's privacy seriously.

• We collect: your email, your child's name and date of birth, the observations and milestones you record, and how you use the app.
• We do NOT: sell your personal information, show advertising, share your data with data brokers, or track you across other companies' apps and websites.
• We store data in Singapore (on Supabase). Our AI narratives are generated by Alibaba Cloud International's Qwen model (Singapore region).
• You can: access your data, export it, correct it, or delete it and your entire account from the app at any time.
• Children under 13: Learning Time is a tool for parents, not for children. Your child does not have an account and does not interact directly with the app. You control all data about your child.
• Questions? Email privacy@learningtime.com.hk.

1. Who we are

Learning Time ("Learning Time", "we", "our", "us") is operated by:

Learning Time Digital Limited 5/F, 88 Lockhart Road, Wan Chai, Hong Kong Hong Kong Business Registration No. 79301879-000-12-25-4

We are the data controller (or, depending on the jurisdiction, "data fiduciary" or "personal data user") of the personal data described in this Privacy Policy.

Privacy Contact: privacy@learningtime.com.hk
Postal address for privacy requests: 5/F, 88 Lockhart Road, Wan Chai, Hong Kong (marked "Privacy Request")

Learning Time is not currently offered in the European Economic Area or United Kingdom. If you access the Service from the EEA/UK despite our market restrictions, you still have the rights described in Section 12.7, but no EU/UK representative is appointed. We will appoint a representative under Article 27 GDPR before expanding availability to those markets.

2. Scope of this Policy

This Privacy Policy describes how we collect, use, store, share, and protect personal data when you:

• Download, install, or use the Learning Time mobile application on iOS or Android;
• Create or manage a Learning Time account;
• Interact with our customer support or marketing communications;
• Visit the Learning Time website at https://www.learningtime.com.hk.

It does not apply to third-party services you reach from our app (for example, if you click a link to an external article). Those services have their own privacy policies and we encourage you to read them.

3. Personal data we collect

3.1 Information you provide directly

3.2 Information collected automatically when you use the app

We do NOT collect:

• Your precise GPS location;
• Your contacts, photos library (beyond the single profile photo you explicitly pick), microphone, or camera without your explicit permission;
• Your advertising identifier (IDFA on iOS) — our Apple Privacy Manifest declares NSPrivacyTracking = false and we do not participate in the App Tracking Transparency framework;
• Biometric data;
• Health data from Apple Health or Google Fit;
• Data from third-party social media accounts beyond the single identifier returned by Sign in with Apple or Google.

3.3 Information we do NOT knowingly collect from children

Learning Time is designed for parents and adult caregivers, not for children. Children under the age of consent (see Section 8) do not create accounts, do not sign in, and do not interact directly with the app. All information about a child is provided by the child's parent or legal guardian and is subject to the child's parent's control.

We do not knowingly collect personal data directly from a child. If we learn that we have inadvertently collected data directly from a child, we will delete it promptly — please contact us at privacy@learningtime.com.hk.

4. How we use your personal data

We use personal data only for the purposes listed below, and only where we have a valid legal basis to do so (see Section 4.2).

4.1 Purposes

4.2 Legal bases (relevant under GDPR, UU PDP, and similar regimes)

We rely on one or more of the following legal bases, depending on the purpose and your jurisdiction:

• Contract — we need the data to deliver the Learning Time service you signed up for (e.g., storing your child's profile so we can show their progress).
• Consent — for push notifications and personalised communications, and (in Indonesia) for analytics and AI-generated narratives. In Indonesia, where UU PDP Article 20(a) requires explicit opt-in, analytics and AI narratives are only activated after you affirmatively tap "I agree" during signup. Outside Indonesia, analytics are enabled by default to help us improve the Service; you can opt out at any time in Settings → Privacy. You can withdraw any consent at any time (see Section 9).
• Legitimate interest — for service security, fraud prevention, and product improvement, where our interests are not overridden by your rights.
• Legal obligation — to respond to valid regulatory, tax, or law-enforcement requests.

For users in Indonesia, we rely on your explicit consent (Article 20 of UU PDP) to process personal data at signup. You give this consent by tapping "I agree" during account creation after reading this Policy.

5. Third parties that process data on our behalf

We use the following vendors as data processors. Each is bound by a written data-processing agreement that restricts how they can use your data. We do not sell or rent your data to any of these vendors, and they may not use it for their own marketing.

When a vendor is outside your country, we rely on one or more of the following lawful transfer mechanisms: Standard Contractual Clauses, adequacy decisions (e.g., the EU–UK adequacy decision), explicit consent from you, or the necessity of the contract between you and us.

We do not share your personal data with advertisers, data brokers, or any party outside this list except (a) with your explicit consent, (b) if required by a valid law-enforcement or regulatory request, or (c) in connection with a merger, acquisition, or sale of assets, in which case we will notify you and the acquirer will be bound by this Policy.

6. International data transfers

Your personal data is stored primarily in Singapore (Supabase region ap-southeast-1). If you are located outside Singapore, using Learning Time involves an international transfer of your personal data.

We apply the following safeguards:

• Contractual safeguards — we sign Standard Contractual Clauses (SCCs) with each processor that stores data outside your jurisdiction.
• Technical safeguards — encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
• Organisational safeguards — Row-Level Security ensures that each user can only read their own data; our service-role credentials are restricted to the backend and are never exposed to client devices.
• Data minimisation — for AI-generated narratives we send only the developmental signals needed to personalise the narrative (first name, age in months, gender, observations, milestones), and only with your ai_narratives consent. Date of birth, photos, last names, email, and other identifying or contact information stay on our servers.

Users in the European Economic Area and United Kingdom: we rely on the European Commission's Standard Contractual Clauses (2021/914) as our primary transfer mechanism, supplemented by transfer impact assessments.

7. How long we keep your data

We keep personal data for only as long as we need it.

You can delete your account at any time from Settings → Account → Delete account. Deletion is irreversible. After deletion, we retain only the minimum data required by law (e.g., tax records for subscription purchases) and any anonymised aggregates that cannot be re-identified.

8. Children's data (special section — please read)

Learning Time is a tool for parents, not a service directed to children. Children do not create accounts and do not directly use the app in a way that generates personal data about themselves independently of the parent.

Nevertheless, because the app stores information about a child (the child's name, date of birth, developmental observations, and optional photo), we treat that information with extra care:

• Parental consent. By creating a Learning Time account and adding a child profile, you confirm that you are the child's parent or legal guardian and that you consent to the processing of your child's personal data as described in this Policy. If you add more than one child profile, this confirmation applies separately to each child.
• No direct marketing to children. We never send marketing to children, show advertising inside the app, or use child data to profile the child for any third-party purpose.
• No tracking across apps or websites. We do not track your child's data across other apps or websites — we do not use the Apple advertising identifier (IDFA) or equivalent.
• Limited AI processing. When we generate an AI narrative about your child's progress, we send the minimum signals needed to personalise it: first name (or nickname), age in months, gender, recent observations, and milestone progress. This processing is performed only with your explicit ai_narratives consent, recorded during onboarding and revocable from Settings. We do not send date of birth, photos, last names, contact information, or payment data.
• Parental rights. You may access, correct, export, or delete your child's data at any time from Settings, or by writing to privacy@learningtime.com.hk.
• Age of digital consent. The age at which a minor may provide their own consent varies by jurisdiction (e.g., 13 in the United States under COPPA, 13–16 under GDPR, 13 in Singapore under the PDPA, 13 in Indonesia under the draft implementing regulations of UU PDP, 18 in Hong Kong as a practical matter). Because Learning Time is used by the parent, we require the user who creates the account to confirm they are 18 years of age or older and the child's parent or legal guardian.

Although Learning Time is not submitted to the Apple App Store's "Kids Category", we follow the spirit of its requirements: no third-party advertising, no third-party analytics that profile children, no links or purchases outside the app (except the Apple / Google subscription flow), and no collection of behavioural data from children themselves.

United States users: although Learning Time is not targeted at users in the United States, if you access the app from the US and you are a parent providing data about a child under 13, we handle that data consistently with the Children's Online Privacy Protection Act (COPPA) principles described above. Please also see Section 12.

9. Your rights

Subject to applicable law and verification of your identity, you have the following rights over your personal data:

We respond to verified requests within 30 days (or sooner where required by local law). We will ask you to verify your identity — typically by confirming ownership of your account email — before acting on a request.

We do not make decisions about you based solely on automated processing that produces legal or similarly significant effects. The AI-generated narratives in the app are informational only and do not determine eligibility for any service or benefit.

10. Security

We protect your data with:

• Encryption in transit — all network traffic uses TLS 1.2 or higher.
• Encryption at rest — databases use AES-256 disk encryption; passwords are stored as salted hashes using a modern KDF (bcrypt / argon2) and are never recoverable.
• Row-Level Security — our database enforces at the row level that you can only read and write your own data and your child's data.
• Least-privilege access — administrative access is limited to named engineers with multi-factor authentication; service-role credentials are held only on our servers, never shipped in the mobile app.
• Continuous monitoring — we monitor for anomalous activity and run automated secret-scanning on every code change.
• Incident response — in the event of a personal-data breach that is likely to result in a risk to you, we will notify the relevant regulator within 72 hours of becoming aware of it (or the time limit required by your local law) and will notify affected users without undue delay.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at privacy@learningtime.com.hk.

11. Cookies and similar technologies

The Learning Time mobile app does not use cookies.

Our website at https://www.learningtime.com.hk uses strictly necessary cookies and, only after you accept, the analytics cookies set by Microsoft Clarity (_clck, _clsk, and CLID), which we use to understand how visitors move through the site. No analytics script is loaded and no analytics cookie is set until you accept: declining from the banner shown on your first visit leaves the site with neither. Full details are available in our Cookie Policy at https://www.learningtime.com.hk/pages/cookie-policy.

12. Country- and region-specific disclosures

12.1 Indonesia 🇮🇩

For users in Indonesia, we comply with Law No. 27 of 2022 concerning Personal Data Protection ("UU PDP") and its implementing regulations.

• Data controller (pengendali data pribadi): Learning Time Digital Limited (Hong Kong Business Registration No. 79301879-000-12-25-4).
• Legal basis: your explicit consent (Article 20(a) of UU PDP), the contract between you and us (Article 20(b)), and legitimate interest (Article 20(f)).
• Language: an official Bahasa Indonesia translation of this Policy is available at https://www.learningtime.com.hk/id/pages/privacy-policy-1. In the event of any conflict between versions, the Indonesian version prevails for users in Indonesia.
• Cross-border transfers: your data may be transferred outside Indonesia (primarily to Singapore). We rely on your consent, the adequacy of the destination country's data-protection law, and our written data-processing agreements as permitted by Article 56 of UU PDP.
• Regulator: you may lodge a complaint with the Indonesian data protection authority (currently the Ministry of Communication and Informatics — Direktorat Jenderal Aplikasi Informatika; to be replaced by the independent Lembaga Pelindungan Data Pribadi once established).

12.2 Hong Kong SAR 🇭🇰

For users in Hong Kong, we comply with the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") and the six Data Protection Principles (DPPs).

• Data User: Learning Time Digital Limited (Hong Kong Business Registration No. 79301879-000-12-25-4), with registered office at 5/F, 88 Lockhart Road, Wan Chai, Hong Kong.
• Purpose of collection and classes of persons to whom data may be transferred: as described in Sections 4 and 5 of this Policy (satisfies DPP 1 and the PICS requirement).
• Access and correction: you may make a Data Access Request or Data Correction Request under sections 18 and 22 of the PDPO by writing to privacy@learningtime.com.hk. We may charge a reasonable fee as permitted by the Ordinance.
• Regulator: Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) — pcpd.org.hk.

12.3 Singapore 🇸🇬

For users in Singapore, we comply with the Personal Data Protection Act 2012 ("PDPA"). Consent, purpose-limitation, access, and correction obligations are honoured as described in Sections 4 and 9. Regulator: Personal Data Protection Commission (PDPC) — pdpc.gov.sg.

12.4 Malaysia 🇲🇾

For users in Malaysia, we comply with the Personal Data Protection Act 2010 (PDPA) and its 2024 amendments (including the cross-border transfer whitelist and the data-protection-officer requirement). Regulator: Jabatan Perlindungan Data Peribadi (JPDP) — pdp.gov.my.

12.5 Thailand 🇹🇭

For users in Thailand, we comply with the Personal Data Protection Act B.E. 2562 (2019). Sensitive-data categories (where applicable) are processed only with your explicit consent. Regulator: Personal Data Protection Committee (PDPC) — pdpc.or.th.

12.6 Philippines 🇵🇭

For users in the Philippines, we comply with the Data Privacy Act of 2012 (Republic Act No. 10173) and the implementing rules of the National Privacy Commission. Regulator: National Privacy Commission (NPC) — privacy.gov.ph.

12.7 European Economic Area and United Kingdom 🇪🇺 🇬🇧

Learning Time is not currently offered in the EEA or UK via the Apple App Store or Google Play. If you nevertheless access the Service from the EEA or UK, we comply with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the UK GDPR / Data Protection Act 2018. You have the additional rights described in Section 9 and you may lodge a complaint with your local data-protection authority. We will appoint an Article 27 representative before expanding availability to these markets.

12.8 California, United States 🇺🇸

If you are a California resident, the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) gives you additional rights:

• the right to know what personal information we collect, use, disclose, and sell or share;
• the right to delete personal information we have collected from you;
• the right to correct inaccurate personal information;
• the right to opt out of the sale or sharing of personal information — we do not sell or share personal information as those terms are defined under California law;
• the right to limit use and disclosure of sensitive personal information;
• the right to non-discrimination for exercising any of these rights.

You may exercise these rights by emailing privacy@learningtime.com.hk.

12.9 Other jurisdictions

If you are accessing Learning Time from a jurisdiction not specifically listed above, you retain all rights granted by this Policy and by applicable local law. Please contact us if you are unsure which rights apply to you.

13. Changes to this Policy

We may update this Privacy Policy from time to time — for example, when we add a new feature, change a vendor, or respond to new legal requirements. When we make a material change, we will:

• Update the "Last updated" date at the top of this Policy;
• Post the revised Policy in the app (Settings → Privacy) and on our website; and
• Where the change materially reduces your rights or expands how we use your data, notify you directly (in-app banner and/or email) and, where required by law, obtain your fresh consent before the change takes effect.

We keep an archive of past versions of this Policy; to request a previous version, email privacy@learningtime.com.hk.

14. Contact us

If you have any questions, complaints, or requests regarding this Privacy Policy or our handling of your personal data, please contact us:

Email: privacy@learningtime.com.hk
Postal address: 5/F, 88 Lockhart Road, Wan Chai, Hong Kong (mark envelope "Privacy Request")
Web: https://www.learningtime.com.hk/pages/contact-us
In-app: Settings → Help → Contact support

We aim to acknowledge your message within 3 business days and to provide a substantive response within 30 calendar days.

Version: v1 — 2026-04-23
Next review: before public launch (expected Aug 2026), and at least annually thereafter.