CantoKids 私隱政策 / Privacy Policy
最後更新 / Last updated: 2026-11-05
CantoKids 私隱政策
CantoKids 以裝置內儲存為主，無須建立網上帳戶。以下說明本機資料、家長匯出，以及語音辨識、內容下載和更新可能涉及嘅網絡連線。
1. 裝置內嘅資料
App 會喺裝置內儲存你輸入嘅顯示名稱、所選頭像嘅本機位置、語言與設定、學習進度、練習結果、每日任務同獎勵紀錄。顯示名稱可以用暱稱，毋須填寫真名。
家長 PIN、復原碼驗證資料、已產生嘅學習報告，以及最近嘅 App 錯誤紀錄亦會儲存喺本機。呢啲資料唔會由 App 自動同步到 CantoKids 帳戶或學習資料伺服器。裝置嘅系統備份可能包含 App 資料，取決於你嘅系統及備份設定。
2. 相機、相簿與頭像
當你使用認字、認物或更換頭像時，App 先會要求相關系統權限或開啟系統相片選擇器。認字及認物使用裝置內嘅 Google ML Kit／Apple Vision；App 唔會將識別用相片上傳到 CantoKids 伺服器。
揀選嘅頭像同相片暫存檔可能留喺裝置嘅 App 儲存空間。App 可保留辨識得到嘅字詞作學習用途；唔應假設所有相片檔案都會喺辨識完成嗰刻立即刪除。
3. 麥克風與語音辨識
讀字練習經系統語音辨識服務處理聲音。App 會先檢查有冇可用嘅廣東話離線模型；可用時要求裝置內辨識，否則可使用系統提供嘅網上辨識。聲音因此可能交由 Apple（iOS）或你裝置嘅語音服務供應商處理，受其政策及系統設定規管。
App 使用辨識文字核對讀音，並記錄練習結果；呢項功能唔會由 CantoKids 建立錄音庫。你可以唔使用讀字辨識，並喺系統設定撤回麥克風或語音辨識權限，其餘學習功能仍可使用。
4. 家長備份、匯入與分享
家長通過家長專區驗證後，可以匯出學習備份，再經系統分享或檔案功能自行選擇儲存位置及接收者。備份係未加密嘅 JSON 學習資料檔；請妥善保管，唔好公開分享。備份唔包含顯示名稱、頭像、家長 PIN、復原碼、App 設定或已產生嘅報告。
如果你將檔案放喺雲端硬碟、電郵或其他 App，該服務會按自身政策處理。CantoKids 唔會自行選擇接收者。匯入需由家長預覽並確認；刪除 App 唔會刪除你已匯出或分享出去嘅副本。
5. 學習報告與人工智能
學習摘要由裝置內嘅練習資料計算。相容 iPhone 上嘅 AI 家長報告使用 Apple Foundation Models 裝置內模型；App 唔會將報告輸入傳去 CantoKids 嘅雲端 AI 服務。功能可用性取決於裝置、系統、語言同 Apple Intelligence 設定。報告係學習參考，唔係專業評估。
6. 網絡連線與服務供應商
部分內容及筆順資料隨 App 提供；部分語音包由 GitHub Pages 下載並快取。App 亦會連接 Expo 更新服務。下載內容、更新及使用網上語音辨識時，相關服務會接收連線所需嘅 IP 位址、請求資料及技術資訊。因此，本 App 唔係所有功能都完全離線。
Expo 更新請求會傳送隨機產生、持續用於同一次 App 安裝嘅識別碼，以及作業系統、App 專案、版本、執行環境及更新請求資訊，並可能附上先前更新啟動失敗嘅錯誤摘要，用作提供更新及排查更新問題。呢個假名識別碼唔係廣告識別碼；App 唔會喺更新請求加入小朋友嘅顯示名稱或學習進度。
Google ML Kit 預設會向 Google 傳送裝置型號與系統資料、App 識別碼與版本、每次安裝嘅識別碼、效能數據、API 設定（例如圖片格式與解像度）、功能使用事件及錯誤碼，作診斷、使用分析、維護及改善服務。ML Kit 嘅輸入相片、文字同辨識結果喺裝置內處理，唔會由 ML Kit 傳送到 Google 伺服器；技術及使用數據仍可能經網絡傳送。
目前 App 無廣告、無跨 App 廣告追蹤、無社交聊天。App 本機學習資料唔會作廣告銷售。上述服務供應商嘅技術資料處理，以及系統或商店本身嘅診斷與備份，受相關供應商嘅政策及適用設定規管。
7. 家長選擇與刪除資料
家長可以更改顯示名稱、頭像及權限，喺家長專區重設學習進度、匯出備份，並設定復原碼。PIN 係防止小朋友誤操作嘅本機閘口，唔係備份加密。復原碼應由家長保管；開發者無法代你取回本機 PIN 或學習資料。
重設進度會清除相關學習紀錄，唔等於刪除全部設定。移除 App 可移除其本機儲存，但系統備份、已匯出檔案或你寄出嘅電郵要另外處理。請先確認所需備份，再刪除 App。
8. 兒童使用與聯絡支援
CantoKids 為兒童學習而設，請家長協助設定權限、保管 PIN、決定是否使用網上語音辨識及分享資料。毋須提供小朋友真名、地址或聯絡資料先可以學習。
如你主動電郵支援，我哋會收到你嘅電郵地址同寄出嘅內容，用作回覆及處理問題。請只提供必要嘅 App 版本、裝置型號及問題描述，避免寄送兒童錄音、相片、真名、PIN 或完整備份。聯絡：qosmio77@gmail.com。
9. 政策更新
本政策會隨功能或資料處理方式變動更新，更新日期列於頁首。你可以喺 App 設定內離線閱讀本政策嘅完整繁體中文及英文版本。
CantoKids Privacy Policy
CantoKids primarily stores data on your device and does not require an online account. This policy explains local data, parent-controlled exports, and network connections used for speech recognition, content downloads and updates.
1. Data on your device
The app stores the display name you enter, the local reference to your chosen avatar, language and other settings, learning progress, practice results, daily tasks and reward records. You may use a nickname; a real name is not required.
The Parent Area PIN, recovery-code verification data, generated learning reports and recent app error logs are also stored locally. The app does not automatically sync these records to a CantoKids account or learning-data server. Operating-system backups may include app data, depending on your device and backup settings.
2. Camera, photos and avatars
The app requests system permissions or opens the system photo picker when you use word/object recognition or change an avatar. Recognition uses on-device Google ML Kit / Apple Vision. The app does not upload recognition photos to a CantoKids server.
Selected avatar images and temporary image files may remain in app storage on your device. Recognised words may be kept for learning. Do not assume that every image file is deleted immediately when recognition finishes.
3. Microphone and speech recognition
Reading practice uses the operating system speech-recognition service. The app checks for an available Cantonese offline model and requests on-device recognition when available; otherwise it may use online system recognition. Audio may therefore be processed by Apple on iOS or by your device speech-service provider under that provider’s policies and your system settings.
The app uses recognised text to check pronunciation and records practice results. This feature does not create a CantoKids audio-recording library. You can skip speech recognition and revoke microphone or speech-recognition permissions in system settings while continuing to use other learning features.
4. Parent backups, imports and sharing
After Parent Area authentication, a parent can export a learning backup and choose its destination or recipients using system sharing or file tools. The backup is an unencrypted JSON learning-data file. Store it securely and do not share it publicly. It excludes the display name, avatar, Parent Area PIN, recovery code, app settings and generated reports.
If you save a file to cloud storage, email or another app, that service handles it under its own policies. CantoKids does not choose a recipient for you. Import requires a parent to preview and confirm the data. Deleting CantoKids does not delete copies you already exported or shared.
5. Learning reports and AI
Learning summaries are calculated from practice data on your device. AI parent reports on compatible iPhones use the on-device Apple Foundation Models framework. The app does not send report inputs to a CantoKids cloud AI service. Availability depends on the device, operating system, language and Apple Intelligence settings. Reports are learning guidance, not a professional assessment.
6. Network connections and service providers
Some content and stroke-order data are bundled with the app. Some audio packs are downloaded from GitHub Pages and cached. The app also connects to Expo’s update service. Content downloads, updates and online speech recognition expose the IP address, request details and technical information needed for the connection to the relevant service. Not every feature works fully offline.
Expo update requests send a randomly generated identifier that persists for the app installation, together with operating-system, app-project, version, runtime and update-request information. Requests may also include a summary of a previous fatal update-launch error to deliver updates and troubleshoot update failures. This pseudonymous installation identifier is not an advertising identifier. The app does not add a child’s display name or learning progress to update requests.
By default, Google ML Kit sends Google device-model and system information, app identifiers and versions, per-installation identifiers, performance measurements, API configuration (such as image format and resolution), feature-use events and error codes for diagnostics, usage analytics, maintenance and service improvement. ML Kit processes input photos, text and recognition results on the device and does not send those inputs or outputs to Google servers. Technical and usage metrics may still be transmitted over the network.
The current app has no ads, cross-app advertising tracking or social chat. Local learning data is not sold for advertising. The service providers’ technical-data processing, and operating-system or app-store diagnostics and backups, are governed by the relevant providers’ policies and applicable settings.
7. Parent choices and deletion
Parents can change the display name, avatar and permissions, reset learning progress or export a backup in the Parent Area, and set a recovery code. The PIN helps prevent accidental child access; it does not encrypt exported backups. Keep the recovery code privately. The developer cannot recover your local PIN or learning records for you.
Resetting progress clears the relevant learning records, not every setting. Removing the app can remove its local storage, but system backups, exported files and emails you sent must be managed separately. Check that you have any backup you need before deleting the app.
8. Children and contacting support
CantoKids is designed for children’s learning. Parents should help manage permissions and the PIN, decide whether to use online speech recognition, and control sharing. A child’s real name, address or contact details are not required to learn.
If you email support, we receive your email address and the content you send to respond and handle the issue. Include only necessary information such as the app version, device model and problem description. Avoid sending children’s recordings, photos, real names, PINs or complete backups. Contact: qosmio77@gmail.com.
9. Policy updates
This policy will be updated when features or data handling change. The update date appears at the top. The full Traditional Chinese and English policy is also available offline in the app settings.