Privacy Policy

1. Overview

LitKeep ("we," "us," or "our") is operated by Loro Universe LLC, a Wyoming limited liability company. LitKeep is an AI-powered reading coach for K-8 students. This Privacy Policy describes how we collect, use, disclose, and protect personal information from users of our service, including children under the age of 13.

We comply with the U.S. Children's Online Privacy Protection Act ("COPPA"), the California Consumer Privacy Act ("CCPA/CPRA"), and the Korean Personal Information Protection Act ("PIPA").

2. Information We Collect

2.1 Parent/Guardian Accounts

• Account Data: Email address, display name, birth year (for age verification).
• Payment Data: Processed by Stripe (web) and Apple (iOS). We store subscription status, plan type, and transaction IDs. We never store credit card numbers.
• Analytics: Page views and performance metrics via Google Analytics and Vercel Speed Insights. Google Analytics is NOT loaded for child accounts.

2.2 Child Accounts (Under 13)

We collect the following information from children only with verifiable parental consent:

• Profile Data: First name, grade level, preferred language.
• Reading Activity: Book titles, reading logs, book review text, AI chat conversations.
• AI-Generated Data: Feedback scores, skill assessments, vocabulary analysis, reading recommendations.

We do NOT collect from children: last names, physical addresses, phone numbers, Social Security numbers, photos (except optional handwriting scans for OCR), precise geolocation, or any data beyond what is necessary for the educational service.

Google Analytics is completely disabled for child accounts. No tracking cookies, advertising identifiers, or behavioral analytics are collected from children.

3. Children's Privacy (COPPA Compliance)

LitKeep is designed for use by children under the supervision of their parents or legal guardians. We take children's privacy seriously and comply with COPPA as follows:

3.1 Parental Consent

A child account can only be created when a parent or legal guardian (a) creates their own account with age verification, (b) explicitly consents to the collection and use of their child's personal information, and (c) generates an invite code that the child uses to sign up. The consent timestamp is recorded in our database.

3.2 Parental Rights

Parents and legal guardians have the right to:

• Review their child's personal information via the parent dashboard.
• Delete their child's account and all associated data at any time via Settings > Profile > Delete Account.
• Refuse further collection by deleting the child's account or contacting us at help@lorouniverse.com.
• Withdraw consent at any time. Upon withdrawal, we will delete the child's personal information without delay.

3.3 No Advertising or Behavioral Tracking of Children

We do not serve advertisements to children. We do not use children's data for behavioral advertising, profiling, or marketing purposes. Google Analytics and similar tracking tools are completely disabled for child accounts.

3.4 Data Minimization

We collect only the minimum information necessary to provide the educational reading service. We do not condition a child's participation on disclosing more information than is reasonably necessary.

4. How We Use Information

• Provide AI-powered reading feedback, skill assessments, and book recommendations.
• Generate progress reports and growth analytics for parents.
• Process subscription payments (parents only).
• Send transactional notifications (e.g., review completed, badge earned).
• Monitor service performance and fix errors (via Sentry, error logging only).
• Analyze aggregate usage patterns to improve the service (parent accounts only, via Google Analytics).

5. Third-Party Service Providers

We share personal information with the following third-party service providers, solely for the purposes described below:

We do not sell, rent, or trade personal information to any third party. We do not share data with advertisers.

6. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the CCPA/CPRA:

• Right to Know: You may request the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information. Use Settings > Profile > Delete Account, or email us.
• Right to Correct: You may request correction of inaccurate personal information via Settings.
• Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out is necessary.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Categories of Personal Information Collected

To exercise these rights, contact us at help@lorouniverse.com. We will respond within 45 days.

7. Korean Users (PIPA Compliance)

• Children Under 14: We collect children's personal information only with the consent of their legal guardian (parent), in accordance with Article 22-2 of the Personal Information Protection Act. Consent is recorded with a timestamp.
• Data Retention: Personal information is deleted upon account deletion. Payment and transaction records are retained for 5 years, and customer dispute records for 3 years, as required by the Electronic Commerce Act (Article 6). Retained records are stored separately with no personal identifiers and are automatically purged after the retention period.
• International Transfer: Your data is transferred to and stored in the United States (Supabase servers). AI processing is performed by OpenAI (United States). By using LitKeep, you consent to this cross-border transfer.
• Data Protection Officer: Loro Universe LLC, help@lorouniverse.com.

8. Data Retention and Deletion

• Active accounts: data retained until account deletion.
• Upon account deletion: all personal information (name, email, reading data) is deleted immediately.
• Legal retention (post-deletion, stored separately without personal identifiers):
  • Payment/subscription records: 5 years (Electronic Commerce Act).
  • Usage/billing dispute records: 3 years.
  • Records are automatically purged after the retention period.

9. Data Security

We implement appropriate technical and organizational measures to protect personal information, including: encrypted data transmission (HTTPS/TLS), secure authentication via Supabase Auth, role-based access controls, rate limiting, SSRF and prompt injection protections, and admin access auditing. Passwords are never stored in plain text or logged.

10. Do Not Sell or Share My Personal Information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. Because we do not sell or share personal information, no opt-out mechanism is required. If this practice changes in the future, we will update this policy and provide an opt-out mechanism before any such sharing begins.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 30 days before they take effect. Continued use of the service after changes constitute acceptance.

12. Contact Us

For privacy inquiries, data requests, or to exercise your rights:

• Company: Loro Universe LLC
• Email: help@lorouniverse.com
• Address: 1712 Pioneer Ave, Suite 500, Cheyenne, WY 82001