App: Teacher's App (Aplikacja Nauczyciela)
Developer & data controller: Maciej Bernacki
Contact:
bernacki.dev@gmail.com
Last updated: September 15, 2026
This Privacy Policy explains what data Teacher's App handles, what never leaves your device, what is sent to external services and why, and how long anything is kept. The app is a planning and storytelling assistant for adults who look after young children: early-childhood teachers planning for their groups, and parents who use its parent mode (presented as Parent App) to plan for their own children at home. This policy covers both.
The app has no user accounts. We do not collect your name, e-mail address, or any profile of you. The app's guiding design rule is that children's personal data never leaves your device: children's names, dates, notes, and any other identifying details are removed or replaced with neutral labels on the device itself before any request is sent to any service. Song lyrics you write or edit in the app are a deliberate exception: they are sent as written (§3.9).
To see whether the app actually helps people get started, our server keeps a small record of how each installation is used — on which days it was used and how far it got through the first steps — tied only to a random identifier of the installation (§3.10).
Not collecting your name does not mean you are invisible to advertising services. The free tier shows ads served by Google AdMob, and when you buy a subscription or a token package the app sends one measurement event to Meta so we can tell which advertising actually works. Both are described in full in §6, both are covered by a single consent question where European rules require one, and declining changes nothing about how the app works for you.
The following data is stored only on your device, in the app's local database and private storage. It is never uploaded automatically. The only ways any of it can leave the device are the actions you take yourself: generating content, which sends the anonymised descriptions explained in §3.1, exporting or sharing a file, submitting a content report (§3.8), or creating a song from lyrics you wrote yourself (§3.9).
Voice dictation, where offered, uses Android's built-in speech recognition. Only the recognized text is used; the app never records, stores, or transmits audio to our servers.
Uninstalling the app deletes all of this local data.
The app's AI features run through a proxy server operated by the developer on Google Cloud Run in the European Union (region europe-central2, Warsaw). The app never talks to AI providers directly. Every request to the proxy carries: an anonymous device identifier (a random UUID created on installation — it identifies the installation, not you), the app version, for some requests a Google Play Integrity token used to block abuse, and — in current versions of the app — the first-run progress markers described in §3.10. The proxy's logs record technical metadata only — such as request type, outcome, timing, the anonymous device identifier and, for day-plan requests, which country's education system you selected — never the content of your requests.
To generate content, the app sends your lesson parameters and — where you have provided them — descriptions of pupils' educational or developmental needs. These descriptions are what the AI personalises activities against, and they can concern matters such as neurodivergence or behaviour, so please describe only what is needed. Before anything is sent, the app removes names and identifying details on-device and replaces each child with a neutral label (such as "Child A"); responses are checked on-device and rejected if they contain a real name. The descriptions are processed to generate your content and are not stored on our server. Generated stories are written with fictional character names only.
In parent mode the app goes further: it never puts a child's own name into a request itself. Each child you pick is described only by an approximate age worked out from the year of birth you entered and by the likes, dislikes and needs you noted, and your children's names are removed on the device from anything else you type before it is sent — except song lyrics and song titles you write or edit yourself, which are sent as written (§3.9). As in teacher mode, these descriptions are not stored on our server.
When you request narration, the story text — which contains only fictional names — and your chosen voice are sent through the proxy to ElevenLabs, a speech-synthesis provider based in the United States (see §4 on data transfer). The finished audio is downloaded to your device.
When you request an illustration, a name-free description of the story is used to generate an image, which is stored in Google Cloud Storage so your device can download it. The image is served from an unguessable link that is not published anywhere by the app, but anyone who has the exact link could open it — do not treat illustration links as private if you share them.
Payments are handled exclusively by Google Play Billing — we never receive your card details, name, or address. After a purchase, the app sends the purchase token issued by Google Play to the proxy, which verifies it with Google and stores in Google Cloud Firestore (EU region): the anonymous device identifier, the purchase token, the product purchased (subscription tier and plan, or a one-time token package), its expiry, and verification timestamps. Google Play also notifies our server directly about subscription state changes (for example a cancellation), so entitlements stay correct.
For the advertising measurement described in §6.2, the server additionally computes a one-way, salted hash of the order number Google Play issued, and returns it to the app. It lets Meta count one purchase once; it cannot be turned back into the order number, and neither the order number itself nor the purchase token is ever sent to an advertising service.
To operate free-tier limits and token economies fairly across reinstalls, the server keeps per-device counters keyed to the anonymous device identifier: how many free generations have been used, how many rewarded ads have been credited, current story/audio token balances, and when each of these records was created.
If you watch a rewarded ad to earn an extra generation, Google AdMob calls our server with a signed confirmation containing the ad event and the anonymous device identifier, which the server verifies and uses to credit the reward.
If you install the app through someone's referral link, the Google Play install referrer carries their referral code; the app reads only that code from it — plus, for installs from the Parent App store listing, a marker that pre-selects parent mode, which stays on your device. Crediting a referral links the new installation's anonymous device identifier to the inviter's anonymous device identifier on our server. Neither identifier can be resolved to a person — no names, contacts, accounts, or Play profile data are collected. Referral requests additionally use Play Integrity checks and per-device caps to prevent farming.
The app includes a "Report this content" option on AI-generated content. Submitting a report uploads: the content type and report category you chose, your optional comment, the reported content itself, language and voice metadata, the app version, and the anonymous device identifier. Reports are the one case where app content is uploaded for a human (not an AI) to review. Privacy protections still apply on the way out: reported stories contain only fictional names by design; in a reported day plan, pupils' real names are replaced with neutral tags on your device before upload; reporting an illustration sends its existing link rather than re-uploading the image. Reports are reviewed by the developer and used for content moderation, as required by Google Play's AI-generated content policy.
When you create a song, its lyrics are prepared as text first. You can have the AI write them from your topic and choices — treated like §3.1, with needs-descriptions anonymised on-device — or you can write or edit the lyrics yourself. Lyrics you write or edit yourself are deliberately not anonymised: they are your own text and are sent exactly as you wrote them — to the AI service that arranges them into a song structure, and, if you request cover art, to the image service (which receives the song's title and lyrics). The editor reminds you of this where you type; please do not include personal details you would not want processed. The finished lyrics are then sent to ElevenLabs (United States, §4) to compose the audio, which is downloaded to your device and kept only there — the server stores neither your lyrics nor the composed audio. Cover images are stored like story illustrations (§3.3).
To understand whether people who install the app manage to get started and keep using it, the server keeps one small record per installation, keyed to the anonymous device identifier. It holds when the app first contacted our server, when it most recently did (updated at most about once a day), the app version at those two points, and the list of days on which the app contacted our server.
Current versions of the app also send first-run progress markers with their requests, and the record keeps them too. A marker is a number meaning that the installation reached one step of getting started: for example, that the welcome screen was shown (and whether it could pre-select your country from your device's region setting), that you chose teacher or parent mode, that a first class or child was saved, that the pupil-profile step was opened, completed or skipped, that a day-plan screen was opened, that Generate was tapped, that a plan was saved, that the introduction was finished, or that the print or share dialog was opened for a plan. One marker only notes that the installation is older than this feature. Markers carry no content, no names and nothing you typed.
We use this record only to measure how installations get started and come back — mostly as totals across all installations and, to investigate a problem, by looking at an individual installation's record together with its usage counters (§3.5) and subscription status (§3.4). It is not used for advertising and is not passed to advertising partners.
The app can send occasional reminders — for example, a nudge on Sunday evening to plan the week ahead. They stay off unless you turn them on: the app offers them after you have generated a plan, and it asks Google for a notification token only if you accept and Android allows notifications. The app then sends our server that token — an identifier issued by Google Firebase Cloud Messaging that lets a message reach this installation — together with the anonymous device identifier, the app's interface language, your time zone's offset from UTC (so a reminder arrives at the right local time) and the app version. The server also records when this registration began and when the app last renewed it (about once a day while you use the app), and when a reminder was last sent to the installation, so the same reminder is not sent twice.
Reminders are delivered through Google Firebase Cloud Messaging, which receives the token and the reminder's text. The text is the same for everyone using the app in your language and never contains your name, a child's name or anything from your plans. You can switch reminders off at any time in Android's notification settings for the app.
The app relies on the following external services:
| Service | Purpose | What it receives | Location |
|---|---|---|---|
| Google Gemini (2.5 Flash) | AI text and image generation | Anonymized, name-free prompts (§3.1); song lyrics you write yourself, as written (§3.9) | Google — via our EU proxy; may be processed outside the EEA |
| ElevenLabs, Inc. | Story narration (text-to-speech) and song composition (music) | Name-free story text and voice choice (§3.2); song lyrics and style settings (§3.9) | United States |
| Google AdMob | Advertising in the free tier | Device identifiers, app and ad interactions, performance data (§6.1) | Per Google's policy |
| Meta Platforms Ireland Limited | Advertising measurement | One event per subscription start or token purchase — contents itemised in §6.2 | Ireland; may be processed in the United States under Meta's own transfer safeguards |
| Google Play Billing | Payments | Handled by Google; we see tokens only (§3.4) | Per Google's policy |
| Google Play Integrity | Abuse protection | Device/installation integrity signals | Per Google's policy |
| Google Firebase Cloud Messaging | Delivering reminder notifications, if you turn them on | The notification token and the reminder's text (§3.11) | Per Google's policy |
| Google Cloud (Run, Firestore, Storage, Logging) | Server hosting, storage, logs | The server-side data described in §3 | EU — europe-central2 (Warsaw) |
AdMob and Meta are not our processors. They also use what they receive for their own advertising purposes, as independent controllers. We cannot access, correct or delete the copies they hold; requests about those go to Google or to Meta directly (§8).
Some of these flows can be processed outside the EEA: ElevenLabs processes narration and song-composition requests — the story text or song lyrics — in the United States under its data-processing terms, which incorporate EU Standard Contractual Clauses; requests to Google Gemini travel through our EU proxy to Google's Gemini API, where Google may process them outside the EEA under its data-processing terms; and the purchase events described in §6.2 go to Meta Platforms Ireland, which may process them in the United States under its own transfer safeguards. Reminder notifications (§3.11) are delivered through Google Firebase Cloud Messaging, which may likewise process the token and the reminder's text outside the EEA. See also: Google Privacy Policy.
| Data | Retention |
|---|---|
| Content of AI requests (prompts, descriptions, lyrics) | Not stored — processed in transit only |
| Server logs (technical metadata, no request content) | 30 days |
| Purchase and entitlement records | For as long as the app is operated — required to keep paid features working and to prevent abuse |
| Purchase events sent to Meta (§6.2) | Held by Meta under its own terms, not ours. Withdrawing consent stops future events; it does not recall an event already sent, and we cannot delete Meta's copy for you |
| Usage counters and token balances | For as long as the app is operated |
| Install activity and first-run progress record (§3.10) | For as long as the app is operated |
| Notification token and reminder history (§3.11) | For as long as the app is operated, unless removed earlier — automatically when Google reports the token is no longer valid as a reminder is sent, or on request. Switching notifications off in Android stops reminders from appearing but does not by itself delete this record |
| Referral records | For as long as the app is operated (fraud prevention) |
| Content reports | Kept as the app's content-moderation record for as long as the app is operated |
| Story illustrations and song cover images (cloud copy) | Until replaced by a regenerated version, or on request |
| All local data on your device | Until you delete it or uninstall the app |
All server-side records are keyed to the anonymous device identifier only, and you can request their deletion at any time (§8). The Meta row above is the one item in this table that is not ours to delete.
Two things in the app involve advertising: the ads shown in the free tier, and a measurement event sent when you buy something. In the EEA, the UK and Switzerland both are governed by a single consent form, which the app shows on first launch. It asks whether ads may be personalized and, under the app's own purposes for storing or reading information on your device and for measuring how well advertising performs, whether our advertising partners — Meta among them — may receive the measurement described in §6.2. There is no second question and no separate toggle. You can reopen the form at any time in the app's Settings ("Ad privacy options"), or use Android's system settings. Declining costs you nothing: every feature, purchases included, works exactly the same.
Outside those countries the form is not shown, because the rules that require it do not apply there. Ads are then personalized and the purchase event described in §6.2 is sent when you buy. You can still limit ad personalization through Android's own settings, and if you would rather the purchase event were not sent, write to us (§11).
The free tier shows ads served by Google AdMob. AdMob may collect your device's advertising ID and other device identifiers, how the app and its ads are used (such as app launches, taps and video views), information about the app's performance, and approximate (country-level) location. Subscribers do not see ads. Details: Google Advertising Policy.
So that we can tell which advertising actually leads people to the app, it sends one event to Meta each time you start a subscription or buy a token package. Nothing else is ever sent: not a subscription renewal, not a change of plan, not restoring a purchase, not reinstalling, and nothing at all if you never buy anything. The event travels from your device to Meta directly — not through our server — and contains:
Meta additionally sees the internet address the event arrives from, which indicates approximate location. The event never carries your name, a pupil's name, or any content from a plan, story or song.
Where the consent form applies, no event is sent unless you agreed to those purposes and to Meta as a partner. Withdrawing that agreement stops future events, deletes the identifier above from your device, and discards any event that has not yet been uploaded — but it cannot recall an event already sent. For anything Meta already holds, contact Meta directly (§8). Meta's own policy: Meta Privacy Policy.
The app is a tool for adults — teachers and parents — and is not directed at children; we do not knowingly collect personal data from children. The information a teacher enters about pupils is the teacher's own professional record, and the information a parent enters in parent mode is about their own children. Either way it is stored only on that adult's device, and as described in §2 and §3, it is never transmitted anywhere in a form that identifies a child. If you write song lyrics yourself, they are sent as written (§3.9) — please avoid children's personal details there. Purchases are tied to the adult's own Google Play account.
Under the GDPR you have the rights of access, rectification, erasure, restriction, objection, and data portability, and the right to lodge a complaint with your supervisory authority (in Poland: UODO).
All traffic between the app, the proxy, and service providers uses HTTPS. Local data is protected by Android's app sandbox. Server-side data lives in the EU region; administrative access to it is restricted to the developer and secret-gated; logs never contain request content. No security measure is absolute, but the architecture is designed so that the most sensitive data — anything naming a child — never reaches a server in the first place (the deliberate exception: lyrics you write yourself, §3.9).
We may update this policy as the app evolves or the law requires. The current version is always available at this address, with the last-updated date shown above. Material changes will be reflected in the app or its store listing.
For privacy-related inquiries, please contact:
📧 bernacki.dev@gmail.com