Skoul COPPA Compliance Statement

Last Updated: October 4, 2026

Introduction

HIGHTHEM is committed to protecting the privacy and safety of children who use Skoul, an educational app for children aged 6 to 12, on iPhone, iPad and Android. This document outlines our compliance with the Children's Online Privacy Protection Act (COPPA), a United States federal law designed to protect the privacy of children under 13 years of age.

Company Information:
HIGHTHEM
SIREN: 848274338
France

Contact: privacy@skoul.fr

What is COPPA?

The Children's Online Privacy Protection Act (COPPA) is a U.S. federal law enacted in 1998 and enforced by the Federal Trade Commission (FTC). COPPA applies to operators of commercial websites and online services (including mobile apps) directed to children under 13 years of age, and to operators with actual knowledge that they are collecting personal information from children under 13.

COPPA Requirements

COPPA requires operators to:

1. Post a clear and comprehensive privacy policy
2. Provide direct notice to parents and obtain verifiable parental consent before collecting personal information from children
3. Give parents the choice to consent to the collection and internal use of their child's information, but prohibit the operator from disclosing that information to third parties
4. Provide parents access to their child's personal information and allow them to request deletion
5. Give parents the opportunity to prevent further use or collection of personal information
6. Maintain the confidentiality, security, and integrity of information collected from children
7. Retain personal information only as long as necessary to fulfill the purpose for which it was collected, and delete it using reasonable measures

How Skoul Complies with COPPA

1. Age Screening and Parental Consent

Age Collection:

• During onboarding, we ask for the child's age (6 to 12 years)
• The app is designed exclusively for children aged 6 to 12, so we treat every user as a child
• Age is used to choose age-appropriate exercises

Parental Consent Mechanism:

• A parent sets up the app and gives consent during onboarding
• At the end of onboarding, the child hands the phone back to a grown-up, who confirms with a grown-up check (Face ID, Touch ID, fingerprint or the device passcode); passing it records the parent's consent
• Setup cannot be completed without this consent
• The full Privacy Policy is available in the app and at https://skoul.fr/privacy

What Parents Are Told:

• What the app uses about the child (first name, age, country, optional class, notebook cover, optional avatar photo)
• What we do NOT collect from the child (email, phone, precise location)
• That the profile, answers and progress are stored on the device
• That only age, country and language are sent with AI requests and homework photos; never the child's name, class or avatar
• What leaves the phone, and the switches that control it, in the Parents area (privacy settings)
• That parents can delete all data at any time
• Contact information for privacy inquiries

2. Data Minimization

Information Stored on the Device Only:

• First name: used to greet the child. Never sent.
• Age (6 to 12): used to choose age-appropriate exercises. Sent with AI requests and homework photos.
• Country: used for the language and examples of exercises (money, measurements). Sent with AI requests and homework photos.
• Class (optional) and notebook cover: shown on the notebook. Never sent.
• Avatar photo (optional): stored on the phone only. Never sent.
• Practice data: answers, the mistake box, accuracy, time spent and progress. Never sent.
• Voice and drawings for read-aloud and tracing: recognised on the phone; nothing is recorded or sent.

Information We Do NOT Collect From the Child:

• Email addresses
• Phone numbers
• Precise geolocation data
• Social Security Numbers or other government IDs
• Physical addresses (we only use the country)
• Voice recordings or biometric data (Face ID, Touch ID and fingerprints stay with the phone's system)
• Contacts or the photo library (except the optional avatar and, with Skoul+, the homework photos the child chooses to take; see section 4)
• Video recordings of the child
• Social media profiles
• Advertising identifiers (no IDFA, no Android advertising ID) or any identifier used for tracking across apps or websites

Why We Use This Information:

• First name, class, cover and avatar: personalization, on the device only
• Age: age-appropriate content
• Country and language: content localization
• Practice data: tracks progress and adapts difficulty and the mistake box (1, 3, 7, 14 and 30 days), on the device only

3. Local-First Data Storage

On the Device:

• All profile information and progress is stored only on the device (SwiftData on iPhone and iPad, an app database on Android)
• We do NOT maintain user accounts, cloud sync, or databases containing children's profiles or progress
• No login credentials are required
• On Android, Skoul's data is excluded from device backups
• Each device operates independently

Data Sent for AI Features: For AI practice and homework help, we send only minimal, non-nominative data:

• Age (number only, e.g., "8")
• Country code (ISO code, e.g., "US")
• Language (English, French, Spanish or German)
• Exercise difficulty
• Subject
• For homework help only, the photo of the exercise

Maths drills, the mistake box and most reading and writing drills are generated on the device and send nothing.

Data Used for Internal Operations: Every request to the Skoul API is recorded with the endpoint, the result, how long it took, the IP address, an app install identifier (Apple's identifier for vendor on iOS, the Android ID on Android), the app version, and the child's age, country and language. Never the content of the request. These records are used only to support the internal operations of the service (security, abuse prevention and troubleshooting), as COPPA permits, and are deleted after 30 days. They are never used to contact a child, build a profile or show advertising.

Data NEVER Transmitted:

• Child's first name or class
• Notebook cover or avatar photo
• Practice history, answers or scores
• Voice or drawings

4. Third-Party Services and Data Sharing

Services We Use:

Skoul API (Cloudflare):

• Purpose: AI practice, homework help, server drills, the Sunday report, contact messages and, if a parent turns them on, anonymous usage statistics
• Data sent: as described in this document for each feature; never the child's name
• Cloudflare's network processes each request in a data centre near the user; Cloudflare acts as our processor under its Data Processing Addendum, including the EU Standard Contractual Clauses
• Homework photos and AI prompts are never stored

AI Providers (OpenAI and Google Gemini, United States):

• Purpose: read homework photos and write AI practice. Skoul's server asks OpenAI first and Google Gemini if OpenAI is unavailable
• On Android only, if Skoul's server cannot be reached, the app may ask Google Gemini directly (Firebase AI Logic) for maths word problems and word lists, with the same non-nominative data; never homework photos. If no AI is reachable, the app uses exercises included in the app
• Data sent: the homework photo or the practice request, with age, country, language and difficulty
• Data NOT sent: the child's name, class, avatar or practice history
• Processed under their data processing terms and the EU Standard Contractual Clauses

Apple App Store and Google Play:

• Purpose: Skoul+ subscription billing, handled entirely by Apple or Google
• A grown-up check precedes any purchase
• We receive only the subscription status, never payment details

Homework Photos (Skoul+ homework help): With Skoul+, the child can photograph a school exercise. The photo is sent over an encrypted (TLS) connection to the Skoul API on Cloudflare, which asks OpenAI to read it, with Google Gemini as backup, together with the child's age, language and country. It is used only for the explain, check, lesson and quiz modes. Skoul does not keep the photo. A copy stays on the device in the homework history until Delete everything is used or the app is uninstalled. A parent can stop photos from leaving the phone in the Parents area (privacy settings); homework help is then unavailable. Our instructions to the AI forbid transcribing any personal data. Parents should make sure the photo shows only the exercise.

Crash Reports (Firebase Crashlytics, off unless a parent turns them on): When the app closes unexpectedly, a technical report (device model, operating system and app version, stack trace and a Firebase installation identifier; no name, age, answers or photos) can be sent to Firebase Crashlytics (Google). This is off by default; a parent can turn it on or off in the Parents area (privacy settings).

Anonymous Usage Statistics (first party, off unless a parent turns them on): The app can send Skoul's own server anonymous daily counts of actions from a fixed list (for example "exercise completed – addition: 3"), with the platform, app version and app language. No name, age, country, answers, photos, device identifier or advertising identifier is sent. The counts are kept only as daily totals that cannot be linked to a child, a device or a family, for up to 25 months, and are never used to contact a child, build a profile or show advertising, and are never shared. This is off by default; a parent can turn it on or off in the Parents area (privacy settings). The app works the same either way.

Parent Email (optional, from the parent, never from the child): A parent can give an email address for the Sunday report (Skoul+), confirmed with a 6-digit code. We store it with the app install identifier and the report language until the parent unsubscribes or uses "Delete everything". On Android, a parent PIN recovery code is sent to that same email. Emails are sent with Resend, and every email has a one-click unsubscribe link.

No Other Third Parties:

• We do NOT use any third-party analytics (Firebase Analytics is not included in the app) or advertising services
• We do NOT use social media integrations
• We do NOT sell or share children's data with data brokers, marketers, or advertisers
• We do NOT allow third-party advertising networks to track children

5. Parental Rights and Controls

Right to Review:

• Everything about the child is on the device, where a parent can see it
• The Parents area shows reports and progress, and can export a copy of everything on the phone (JSON and PDF)
• For what we hold on our servers (server logs, a parent's email), contact privacy@skoul.fr

Right to Request Deletion:

• Homework history: erased with Delete everything or by uninstalling; we hold no copy of the photos
• Delete everything: in the Parents area (privacy settings)
  • Removes the profile, progress, homework history, settings and parent PIN from the device
  • Deletes the Sunday report subscription from our server
  • Requires a grown-up check and cannot be undone
• Uninstall the app: removes everything stored on the device
• Server records: server logs are deleted automatically after 30 days; to delete them sooner, contact privacy@skoul.fr

Right to Refuse Further Collection:

• Parents can stop homework photos from leaving the phone, and keep crash reports and usage statistics off, in the Parents area (privacy settings)
• Parents can unsubscribe from emails with the link in every email
• Parents can stop using the app at any time; uninstalling it prevents any further collection
• No penalties or consequences for refusal (some choices make features unavailable, for example homework help)

Right to Consent Withdrawal:

• Parents can withdraw consent by using "Delete everything" or uninstalling the app
• All data on the device is permanently deleted
• Remaining server logs are deleted automatically after 30 days

How to Exercise These Rights:

1. In-App: Use the Parents area (protected by a grown-up check)
2. Email: Contact privacy@skoul.fr
3. Response Time: We respond within 30 days to all legitimate requests

6. Data Security

Technical Measures:

• Encryption at rest: data on the device is protected by the operating system's encryption
• Encryption in transit: all network traffic uses HTTPS (TLS)
• App key and rate limiting: every request to our server carries an app key; requests are rate-limited
• Sandboxing: app data is isolated from other apps by the operating system
• Parent PIN: never stored in clear (stored hashed); the Parents area requires a grown-up check
• No remote access: no HIGHTHEM employee can access data stored on the device

Organizational Measures:

• Privacy-by-design approach in all development
• Regular security reviews of code and infrastructure
• Incident response procedures for security concerns
• Limited access to systems (principle of least privilege)

Device Security Recommendations:

• Use a strong device passcode or biometric lock
• Keep the device updated to the latest version
• Download Skoul only from the App Store or Google Play
• Supervise children's device usage

7. Data Retention and Deletion

Retention Policy:

• Local data: retained on the device until the parent deletes it or uninstalls the app
• Server logs (IP address, install identifier, app version, age, country, language, endpoint and result): 30 days
• AI usage records (provider, model, size of the request and response, cost; no content): 30 days
• Daily totals without any identifier: up to 25 months
• Parent email for the Sunday report: until the parent unsubscribes or uses "Delete everything"
• Homework photos and AI prompts: never stored

Automatic Deletion:

• Uninstalling the app permanently deletes all data stored on the device
• Server logs and AI usage records are deleted automatically after 30 days

No Data Resurrection:

• We cannot restore deleted data
• No cloud sync or cloud backup of children's profiles or progress
• Each device is independent

8. No Conditioning on Data Collection

COPPA Prohibition: COPPA prohibits conditioning a child's participation in an activity on the child disclosing more personal information than is reasonably necessary.

Our Practice:

• We collect only the minimum information necessary for app functionality
• Optional details (class, avatar) are truly optional and do not affect core functionality
• Children can use all educational features with minimal data
• No premium feature requires additional personal data from the child
• The core app is free (Today's page, the Maths, Reading and Writing notebooks and the mistake box, with 7 AI practices and 5 homework exercises in total). The optional Skoul+ subscription (€4.99/month, or €29.99/year with a 7-day free trial) is purchased by the parent through the App Store or Google Play behind a grown-up check; no learning feature is conditioned on giving more personal data than necessary

9. Safe Harbor and Compliance Certifications

FTC Compliance:

• Skoul is built to follow the FTC's COPPA guidance
• We monitor FTC updates and adjust practices accordingly
• Regular compliance reviews help ensure ongoing adherence

No COPPA Safe Harbor:

• We are not currently members of an FTC-approved COPPA Safe Harbor program
• We voluntarily comply with COPPA requirements regardless

10. Transparency and Notice

Privacy Policy Availability:

• Available in the app (Parents area) and at https://skoul.fr/privacy
• This statement is available at https://skoul.fr/coppa
• Available via email: privacy@skoul.fr
• Clear, readable language appropriate for parents

Changes to Privacy Practices:

• Material changes to data collection or use may require renewed parental consent
• Parents will be notified through the app
• Parents can refuse by using "Delete everything" or uninstalling the app

11. International Users

COPPA Application:

• COPPA applies to operators subject to U.S. jurisdiction
• HIGHTHEM, based in France, voluntarily complies with COPPA for U.S. users
• We apply COPPA standards globally as a best practice

Additional Protections:

• EU users receive GDPR protections (often stricter than COPPA)
• Age thresholds vary by jurisdiction (13-16 years)
• We comply with the strictest applicable standard

Parental Verification Methods

Current Method: Grown-up Check

Implementation:

• Sensitive actions (settings, purchases, deleting data, privacy choices) require a grown-up: Face ID, Touch ID, fingerprint or the device passcode, or a Skoul parent PIN (stored hashed)
• The same check confirms the parent's consent at the end of onboarding
• Prevents children from changing settings, buying or deleting data on their own

Acknowledged Limitation:

• This method confirms that the device owner is present but does not verify a parent's identity as some COPPA verifiable parental consent methods do
• Given our local-first architecture and minimal data collection, we rely on:
  • Consent confirmed by the grown-up check during onboarding
  • Parental supervision (recommended for 6-12 year-old users)
  • Easy access to the Parents area for privacy choices and data deletion

Why This Works for Skoul:

• Children's profiles and progress stay on the device (no accounts, no cloud sync)
• No data sharing with third parties for marketing
• Minimal data transmission (age, country and language with AI requests and homework photos; technical records kept 30 days)
• Optional processing (crash reports, usage statistics) is off unless a parent turns it on
• Parents have immediate access to all data and deletion controls
• No email or payment information collected from the child

Accountability and Audits

Internal Reviews:

• Regular privacy and security reviews
• COPPA compliance checks before each major release
• Developer training on child privacy requirements

External Resources:

• FTC COPPA guidelines: https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-six-step-compliance-plan-your-business
• COPPA FAQs: https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions

Reporting Violations: If you believe Skoul is not complying with COPPA, you may:

1. Contact us immediately: privacy@skoul.fr
2. File a complaint with the FTC: https://www.ftc.gov

We take all compliance concerns seriously and will investigate promptly.

COPPA Compliance Checklist

✅ Privacy Policy: Comprehensive privacy policy posted at https://skoul.fr/privacy and in the app
✅ Parental Notice: Clear notice of what stays on the phone and what leaves it
✅ Parental Consent: Confirmed by a grown-up check before setup is completed
✅ Parental Access: Parents can view and export all data from the Parents area
✅ Parental Deletion: "Delete everything" in the Parents area, or uninstallation
✅ Parental Control: Parents can refuse or withdraw consent and turn optional features on or off
✅ Data Minimization: Collect only necessary information
✅ No Third-Party Sharing: No sharing of children's data for marketing
✅ No Ads: No advertising SDK, no ads shown to children
✅ Data Security: Operating system encryption on the device, HTTPS (TLS) in transit
✅ Data Retention: Device storage; server logs deleted after 30 days; homework photos never stored
✅ No Conditioning: Core features available with minimal data
✅ Transparency: Clear communication of data practices

Summary for Parents

What You Need to Know:

1. Your Consent Required: A parent sets up the app and confirms consent with a grown-up check during onboarding
2. Minimal Data Collection: We use only first name, age, country, an optional class, the notebook cover and an optional avatar
3. Local-Only Storage: Your child's profile, answers and progress stay on your device; no accounts, no cloud sync
4. No Name Sharing: Your child's name, class and avatar are never sent to our servers or third parties
5. Safe AI Features: Only age, country, language and difficulty are sent for AI practice; homework photos (Skoul+) are read by OpenAI (Google Gemini as backup) and not kept by us
6. No Ads: No advertising SDK, no ads, no third-party analytics, no tracking of your child; crash reports and usage statistics are off unless you turn them on
7. Easy Deletion: "Delete everything" in the Parents area, or uninstall the app; server logs are deleted after 30 days
8. Your Control: Review, export or delete data, and choose what leaves the phone, in the Parents area
9. Free Core & Safe: Skoul+ is optional, bought by the parent via the App Store or Google Play behind a grown-up check; no hidden data collection
10. Responsive Support: Contact us anytime at privacy@skoul.fr

Questions?
We're here to help. Email us at privacy@skoul.fr and we'll respond within 30 days.

Contact Information

Data Controller:
HIGHTHEM
SIREN: 848274338
France

Privacy Inquiries: privacy@skoul.fr

FTC (COPPA Enforcement):
Federal Trade Commission
Consumer Response Center
600 Pennsylvania Avenue NW
Washington, DC 20580
https://www.ftc.gov

Version History

• Version 1.0 - November 7, 2025 - Initial publication
• Version 2.0 - September 10, 2026 - Advertising SDK removed; homework photo processing added
• Version 2.1 - September 19, 2026 - Anonymous first-party usage statistics
• Version 2.2 - October 4, 2026 - Aligned with the app and the Privacy Policy: Android and iPhone/iPad; homework photos read by OpenAI with Google Gemini as backup, and can be turned off by a parent; Android-only direct Google Gemini fallback for AI practice; Apple Intelligence removed; server logs with install identifier and IP address (30 days); crash reports and usage statistics off unless a parent turns them on; optional parent email for the Sunday report; Google Play billing; grown-up check replaces the maths parental gate; "Delete everything" in the Parents area; certificate pinning and specific encryption claims removed

HIGHTHEM is committed to protecting children's privacy and maintaining COPPA compliance. We regularly review and update our practices to ensure the safety and security of all Skoul users.