Privacy Policy

This Privacy Policy explains how Nurro ("Nurro," "we," "us," or "our"), operated by Muhammad Hamza, a sole proprietor, trading as Nurro, collects uses, and protects information when you use nurro.app, including Nurro when it's installed to your device's home screen as an app (together, the "Service").

Nurro is a subscription service for parents, built around content for children ages 2 to 4. Only a parent or guardian may create an account. Everything below is written with that in mind. Most of what we collect is about you, the parent, and the small amount we collect about your child is described in detail in the Children's Privacy section.

What we collect

From you, the parent

• Your email address, used to create your account, send your weekly activity summary, and send billing receipts.
• Your parental control PIN, stored securely and used only to protect profile management and settings.
• Payment information. We never see or store your card details. Billing is handled entirely by Paddle, our Merchant of Record.

From your child's profile

• A first name or nickname you choose for them.
• Their age, not an exact birthdate, used to pick age-appropriate stories and set the right reading difficulty.
• An illustrated avatar (a character and a color) your child picks for their profile.
• Optionally, a few activity interests you or your child select, used only to suggest stories they're more likely to enjoy.
• Which stories they watch, how many times, which one-tap missions they complete, and roughly how long they spend in the app, used only to build the weekly activity summary and pick which content to surface next.

Stored on your device

Because Nurro is a progressive web app, your browser keeps a copy of the app's files on your device so it opens quickly and works offline. Stories you download for offline viewing, and any activity your child completes while offline, are also kept in your browser's storage on that device until they can sync with your account. This stays on your device; we don't read it from there. You can remove it at any time by deleting your downloads in Nurro, removing Nurro from your home screen, or clearing this site's data in your browser settings.

What we don't collect

We deliberately do not ask for, and do not collect:

• Your child's surname, photo, exact birthdate, school, or home address
• Contacts, location, or device-level advertising identifiers
• Any information used to build an advertising profile of your child

We can't lose, leak, or misuse what we never collected in the first place.

How we use information

• To operate the Service, deliver stories, run profiles, remember progress
• To generate the weekly activity summary for each child profile
• To process payments and manage your subscription
• To respond when you contact support
• To understand, in aggregate and anonymized form, which stories and habits are working, never to advertise to your child, and never to build a profile that follows them elsewhere

Who we share information with

We do not sell your data or your child's data. We do not show ads, we do not use advertising trackers anywhere, and we do not use third-party analytics inside the app or on any page tied to a child's profile or activity. The only outside parties involved in running Nurro are:

• Paddle, our Merchant of Record, who handles billing and receives payment details directly from you.
• Supabase, hosts our database (Postgres) and handles account authentication, storing app data securely on our behalf, under contract, and is not permitted to use it for any other purpose.
• Cloudflare (R2 storage), hosts our story audio and images, under the same contractual restriction.
• Google reCAPTCHA, used only to block spam and automated abuse on our sign-up and contact forms. It runs on parent-facing forms only, never on any page tied to a child's profile or activity, and is not used for advertising or analytics.
• Google Analytics, used only on our public, parent-facing website (for example the home, pricing and about pages) to understand general website usage. It loads only after you accept analytics cookies in our cookie banner, never runs on the sign-up or sign-in pages or inside the app your child uses, and is configured with advertising features and Google signals turned off. If you decline, it is never loaded. To change your choice later, clear this site's cookies and stored data in your browser and the banner will ask again.

When you check out, Paddle's checkout page sets its own cookies to process your payment securely and prevent fraud, separate from anything Nurro itself sets. See Paddle's privacy policy for how they handle that.

We may also disclose information if required by law, or to protect the safety of a child, our users, or the public.

Children's privacy

Nurro is a service directed at children ages 2 to 4, and we take children's privacy seriously. This section explains the privacy protections Nurro applies to children's data, with reference to the US Children's Online Privacy Protection Act (COPPA), GDPR Article 8, and the UK Age Appropriate Design Code.

• Only a parent or guardian can create a Nurro account and add a child profile. Children do not sign up, sign in, or manage their own account.
• By creating a child profile, you confirm that you are the child's parent or legal guardian and consent to the limited collection and use of information described in this policy.
• We collect the minimum information needed to run the Service for your child, first name/nickname, age, avatar, and optional activity interests only, as described above.
• You can review, export, or permanently delete your child's profile and all associated data at any time from Settings, with no need to contact us first.
• You may revoke your consent at any time by deleting your child's profile. Deleting a profile immediately removes it from your account and starts permanent deletion of the associated data, completed within 30 days as described below.
• We do not require a child to disclose more information than is reasonably necessary to use the Service.

If you believe we have collected information from or about a child in a way that doesn't match this policy, contact us immediately at hello@nurro.app and we will investigate and delete it.

How long we keep information

We keep account and child-profile data for as long as your account is active. Deleting a child's profile or your account immediately removes it from your account and starts permanent deletion of the associated data. Deletion is completed within 30 days, including applicable backups, except for records we're legally required to retain (for example, limited billing records for tax, accounting, or legal purposes).

Security

We use industry-standard safeguards, including encryption in transit, access controls, and regular review of who on our team can access user data, to protect the information we hold. No method of storage or transmission is 100% secure, but we treat child data as the most sensitive data we hold and design accordingly.

Your rights

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you and your child (use Settings, or email us)
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Export your data in a portable format
• Object to or restrict certain processing
• Lodge a complaint with your local data protection authority

To exercise any of these rights, use the Export or Delete options in Settings, or email hello@nurro.app.

International data

Nurro operates internationally. Your account and app data are stored in India (Mumbai), where our database provider's servers are located, and story audio and images are delivered through Cloudflare's global network. Where we transfer data internationally, we rely on appropriate safeguards required by applicable law.

Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date above and, for significant changes, notify you by email before they take effect.

Contact us

Questions about this policy, or about your data or your child's data? Email hello@nurro.app.

Nurro is operated by Muhammad Hamza, a sole proprietor, trading as Nurro, who is responsible for the personal information described in this policy.