Privacy policy

Summary

DooDoo دودو (“we”, “us”) is an English learning app for school students. It offers lessons, vocabulary cards, reading stories with narration, grammar lessons, quizzes, a custom quiz builder, challenges, leaderboards, badges, invite codes, notifications, and an optional paid subscription (DooDoo Pro). The free version shows ads.

This policy describes what we collect, why we use it, who we share it with, and the choices you have. It is written in plain language but is not legal advice.

Who we are

DooDoo دودو operates the DooDoo mobile application (com.buniasoft.doodoo) on Android and iOS. For privacy questions or requests, contact us at doodoo.crp@gmail.com.

Information we collect

Depending on how you use the app, we or our service providers process:

• Account data — your email address and password if you sign up with email, or the authentication data Google or Apple share with us if you use Google or Apple sign-in.
• Profile data — display name, profile photo if you upload one, the avatar frame you choose, birth date, gender, academic year (grade), and app language. You can also add, if you choose, a phone number, your governorate, and your school. Your account also has a personal invite code.
• Learning activity — lessons, units, stories, and grammar lessons started or completed; quiz and challenge answers and scores; custom quizzes you build; hearts, streaks, learning power, badges, reading position, and other progress needed to run the app.
• Leaderboards and challenges — your rank and learning power for the current weekly and monthly period, and your challenge entries and results.
• Invites and promo codes — the invite or promo code you redeem, who invited whom, and the free Premium days earned from them.
• Purchases — your subscription plan, status, start and end dates, the payment provider used, amounts, and transaction or order IDs. We do not receive or store your full card number or wallet PIN. Payments are processed by Apple, Google, or Paymob (see below).
• Device and technical data — device type, operating system and app version, device time zone (so your streak follows your local day), notification token, and crash and diagnostic reports.
• IP address and country — when you open the Premium page, your IP address is used to work out your country so we can show the right payment options and prices (for example, local payment methods in Egypt). We keep the resulting country, not a location history.
• Fraud and abuse prevention data — to allow one welcome offer per device, the app sends a device identifier (Android ID on Android, or a random ID kept in secure storage on iOS). We store only a one-way hash of it. The app may also send a Google Play Integrity token (Android) or an Apple DeviceCheck token (iOS) to confirm the request comes from a genuine copy of the app on a real device. On Android, if you install the app from an invite link, the Google Play install referrer is read to fill in the invite code.
• Usage and advertising measurement data — screens viewed and in-app events such as sign-up, lesson completion, starting a checkout, and purchase (see “Analytics and advertising measurement”).
• Support and communications — the subject, message, and optional reply email you send through in-app support, or anything you email us; plus your in-app notifications and whether you have read them.

Pronunciation and some reading features use text-to-speech on your device, processed by your operating system’s speech engine. Recorded narration for stories and vocabulary is downloaded from our servers and may be cached on your device.

Some data stays only on your device: theme and language preferences, cached lessons and narration audio, reading position, which tips you have seen, and when you were last asked to rate the app.

The app does not access your contacts, precise location, microphone, or camera roll, except for a photo you pick yourself for your profile.

How we use information

• Provide lessons, cards, stories, quizzes, challenges, leaderboards, badges, and other features.
• Create and secure your account, keep you signed in, and prevent cheating, fraud, and abuse.
• Show content for your academic year and keep your progress in sync across devices.
• Process subscriptions, keep Premium active on your account, and handle refunds and billing questions.
• Run invite and promo code rewards, including limiting welcome offers to one per device.
• Moderate display names and profile photos so other students are not shown offensive content.
• Send in-app and push notifications you opt in to (challenges, leaderboard changes, invites, badges, reminders, and announcements).
• Show ads in the free version and grant hearts after you watch a rewarded ad.
• Understand how the app is used, measure our marketing, and fix crashes and bugs.
• Answer support requests and meet legal obligations.

What other users can see

Other users can see your display name, profile photo, avatar frame, badges, and leaderboard rank and learning power, for example on leaderboards and in challenges. Your email, phone number, birth date, gender, governorate, school, and payment information are not shown to other users.

Content moderation

When you set or change your display name or upload a new profile photo, they are checked for offensive content against our own list of blocked terms and by the OpenAI Moderation API. OpenAI receives only the name and the photo for this check. If something is flagged, it is rejected or removed, and the event is recorded on your account. Repeated violations can temporarily lock profile edits. Accounts that seriously or repeatedly break the rules may be suspended.

Payments

• App Store and Google Play subscriptions are billed by Apple or Google. We use RevenueCat to confirm and manage these subscriptions. RevenueCat receives your DooDoo account ID and purchase receipts, not your card details.
• Paymob (Android users in Egypt) processes card, mobile-wallet, and payment-kiosk payments. The checkout runs on Paymob’s secure payment page inside the app. We send Paymob your display name and account email with each order. Paymob collects the payment details you enter, and we only receive the result and transaction ID.

For refunds and cancellations, see our Refund policy.

Analytics and advertising measurement

• Firebase Analytics records screen views and in-app events (for example sign-in method, lessons, quizzes, and Premium screens) linked to your account ID.
• Firebase Crashlytics collects crash reports and diagnostics (device model, OS version, app state at the time of a crash) linked to your account ID.
• Meta (Facebook) App Events and the TikTok Business SDK receive app installs, launches, and a small set of events (such as sign-up, first lesson, checkout started, and purchase with price and currency) so we can measure our ads on those platforms. We do not send them your name, email, phone number, or account ID. They may use your device’s advertising ID where your settings allow.

On iOS, the app asks for permission through App Tracking Transparency before your advertising identifier (IDFA) can be used. You can change this at any time in Settings → Privacy & Security → Tracking. On Android, you can reset or delete your advertising ID in your device’s Google settings.

Advertising

The free version shows ads from Google AdMob: banner, interstitial, rewarded, and app-open ads. Google may collect device and advertising identifiers to serve and measure ads, according to its own policies and your device settings. When you watch a rewarded ad for hearts, Google sends our server a signed confirmation that includes your account ID, so the reward can be added to your account. DooDoo Pro subscribers do not see ads.

Service providers

We share data only with providers that help us run the app. Their own privacy policies also apply:

• Supabase — authentication, database, file storage, and server functions. Privacy policy
• Google Firebase — push notifications (Cloud Messaging), Analytics, and Crashlytics. Privacy information
• Google — Google Sign-In, AdMob ads, and Play Integrity. Privacy policy
• Apple — Sign in with Apple, App Store payments, and DeviceCheck. Privacy policy
• RevenueCat — App Store and Google Play subscription management. Privacy policy
• Paymob — payment processing in Egypt. Privacy policy
• IPinfo — working out your country from your IP address for payment options. Privacy policy
• OpenAI — moderation of display names and profile photos. Privacy policy
• Meta — App Events for ad measurement. Privacy policy
• TikTok — Business SDK for ad measurement. Privacy policy

We do not sell your personal information. We may also disclose information when required by law, or to protect the rights and safety of our users and the service.

Photos

If you upload a profile picture, it is compressed on your device and stored in Supabase Storage, so it can be shown in the app and on leaderboards. The app only opens your photo library when you choose to pick a profile image. You can change or remove the photo from your profile.

Retention and deletion

We keep your account data while your account exists. Some technical records are deleted automatically: read notifications after 180 days, rewarded-ad and subscription webhook logs after 90 days, and failed code attempts and rate-limit counters after a few days.

You can delete your account from Profile → Delete Account in the app. Deletion is scheduled for 30 days later, and signing in again before then cancels the request. When deletion completes, your account, profile, photo, progress, streaks, badges, invite history, notifications, support messages, and subscription records are permanently removed from our systems. Apple, Google, Paymob, and RevenueCat keep their own transaction records as required by law.

Deleting your account does not cancel an App Store or Google Play subscription. Cancel it in your store account first. See the Refund policy.

If you cannot open the app, email doodoo.crp@gmail.com from your account’s email address to request deletion.

Security

Data is encrypted in transit. Sign-in tokens are kept in your device’s secure storage, and database access is restricted so each user can read only their own private data. Payment callbacks are verified with signatures. No method of transmission or storage is 100% secure, so please use a strong password and protect your device.

Students and children

DooDoo is built for middle- and secondary-school students, so many of our users are under 18. For this reason we collect only what the app needs, and we never send students’ names, emails, phone numbers, or account IDs to advertising-measurement partners. Users under 13, or under the minimum age of digital consent where they live, should use DooDoo only with a parent’s or guardian’s permission. Parents or guardians can contact us to review or delete their child’s data. If you believe a child is using DooDoo without the consent your region requires, email us and we will delete the account.

International users

Our service providers may process your information in countries other than your own. Where required, we rely on appropriate safeguards for these transfers.

Your rights and choices

• View and edit your profile in the app at any time. Optional fields (phone, governorate, school) can be left empty.
• Turn push notifications on or off in your device settings.
• Limit ad tracking in your device settings (App Tracking Transparency on iOS, advertising ID on Android).
• Delete your account in the app, as described above.
• Depending on where you live, you may also have the right to access, correct, export, or delete your data, or to object to or restrict certain processing. Email doodoo.crp@gmail.com from your account’s email address.

Changes to this policy

We may update this policy as the app changes. We will update the “Last updated” date at the top of this page and, for important changes, let you know in the app.

Contact

DooDoo دودو
Email: doodoo.crp@gmail.com
Phone: +20 102 843 6882