1. Introduction

Lyko AI LLC, doing business as LexiMap ("we," "us," or "our"), operates the LexiMap vocabulary training application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use the Service. Because our Service is designed for children in grades 4–12, we comply with the Children's Online Privacy Protection Act (COPPA) and take additional steps to protect children's privacy.

2. Information We Collect

Parent Account Information

Email address (used for authentication via magic link)
Billing information (processed by Stripe; we do not store credit card numbers)
Account preferences (digest settings, session configuration)

Child Profile Information

Nickname (chosen by parent; no real names required)
Grade level (used to calibrate content difficulty)
Avatar selection

Learning & Usage Data

Session activity (items answered, accuracy, response times)
Mastery progress and spaced repetition state
Device information (for offline sync and session continuity)
Anonymous device/session identifiers used to connect pre-signup activity to an account when a parent later signs in or checks out
Application events (for improving the learning experience)

Lead Magnet & Marketing Data

When you submit an email capture form on our public website (e.g., to download a free prep plan or guide), we collect the following:

Email address
Lead magnet type (which resource was requested)
Source page URL
UTM tracking parameters (utm_source, utm_campaign)
Anonymous attribution identifiers used to measure aggregate funnel and checkout performance
IP address (for fraud prevention and rate limiting)
Timestamp

3. How We Use Information

We use the information we collect to:

Provide and personalize the vocabulary learning experience
Track learning progress and adapt content using spaced repetition
Send parent digest emails about their child's progress (when opted in)
Process payments and manage subscriptions
Diagnose technical issues and improve application performance
Analyze anonymized and aggregated usage patterns to improve our educational algorithms, content effectiveness, and overall service quality
Deliver requested free resources (e.g., prep plans, guides) via email
Send occasional marketing and educational emails to lead magnet subscribers (you can unsubscribe at any time via the link in every email or by contacting [email protected])

We do not use children's personal information for advertising, profiling, or selling to third parties.

4. Third-Party Services

We use third-party service providers based in the United States for authentication, email delivery, hosting, and operations. These providers receive only the data necessary to perform their function (e.g., email address for authentication). We may use additional service providers for monitoring and infrastructure, which process data only as needed to provide their services to us.

Payment processing is handled by Stripe. Stripe processes billing information directly; we do not store credit card numbers and receive only a customer ID and subscription status. You can review Stripe's Privacy Policy for details on how they handle payment data.

Transactional and marketing email delivery is handled by Resend. You can review Resend's Privacy Policy for details on how they handle email data.

5. Local Storage & Cookies

The Service uses browser storage (localStorage, IndexedDB) to support offline functionality, save your session, and improve load times. Locally stored data syncs to our servers when connectivity is restored.

Analytics and Advertising

We use the following third-party analytics services on our marketing and account pages to understand how visitors find and use our site:

Google Analytics (GA4) — sets _ga and _gid cookies to distinguish unique visitors. We run GA4 in a privacy-minimized configuration with Google Signals and ad personalization disabled.
Statsig — measures product usage and experiment outcomes using pseudonymous identifiers.
Meta Pixel and Google Ads — measure advertising effectiveness on approved marketing and parent-operated funnel pages.
Microsoft Clarity — sets _clck and _clsk cookies for aggregate session-quality and usability analytics (heatmaps and anonymized session replay). Clarity runs only on marketing and conversion pages and the parent/tutor account experience — never within child-facing practice, diagnostic, tutorial, handoff, readiness, or practice-test content.

Service analytics and advertising measurement load by default for our U.S. service. You can opt out of advertising measurement at any time using the panel or the "Cookie Settings" link in the footer. Advertising opt-out, including a supported Global Privacy Control browser signal, disables Meta and Google Ads browser and server events and clears their browser identifiers. Google Analytics, Statsig, and route-limited Clarity service analytics continue on approved non-child surfaces.

No advertising or session-replay cookies run within child-facing learning, diagnostic, tutorial, or practice content. Advertising tags (the Meta Pixel) run only on public marketing pages; product analytics (Google Analytics, privacy-minimized — no ad personalization or cross-device signals) and usability analytics (Microsoft Clarity) run only on the parent/tutor account experience, never on child-facing screens.

6. COPPA Compliance

We recognize that our Service is used by children under 13. In compliance with COPPA:

Child accounts can only be created by an authenticated parent or guardian.
Parents must provide verifiable consent before a child profile is created.
We collect only the minimum information necessary for the Service to function. For each child profile this is limited to: a parent-chosen nickname, current grade level, an avatar selection, and an optional target test preference.
We do not collect a child's real name, email address, phone number, photograph, or precise geolocation. Child profiles use nicknames rather than real names, and we do not collect contact information from children.
Parents can review, modify, or delete their child's information at any time through the Parent Dashboard.
Parents can request complete deletion of all their child's data by using the data deletion feature in their account settings.

Lead magnet email capture forms on the public website are intended for parents and guardians only, not children. We do not knowingly collect email addresses from children under 13 through these forms.

7. Data Retention & Deletion

We retain learning data for as long as the child's account is active to provide continuity in the learning experience. Parents may request deletion of all data associated with a child profile at any time. Upon deletion, the following data is permanently removed:

All learning session records and item responses
Mastery progress and spaced repetition state
Event and analytics data
Hint usage history
The child profile itself

Deletion is irreversible. Aggregated, anonymized statistics may be retained for service improvement purposes.

Upon cancellation of a paid subscription, we may retain learning data for a reasonable period to allow for resubscription without loss of progress. We reserve the right to delete inactive account data at our discretion.

Parents may delete their entire account at any time from Account settings. Deleting your account permanently removes your profile and every child profile and all associated learning data, cancels any active subscription, and signs you out. This action is irreversible. We retain only the limited financial, consent, and dispute records we are required or permitted to keep for accounting, tax, refund, and dispute purposes, with product account links severed or minimized where possible.

Lead magnet email capture records are retained for 2 years after collection or until you request deletion, whichever is sooner. Unsubscribe requests are honored within 10 business days. To request deletion of your email capture data, contact [email protected].

8. Data Security

We use industry-standard technical and organizational measures to protect your personal information, including encrypted data transmission and secure authentication. While no method of transmission or storage is 100% secure, we are committed to protecting the data entrusted to us.

9. Parental Rights

Parents and guardians have the right to:

Review the personal information collected about their child
Request correction of inaccurate information
Request deletion of their child's personal information
Refuse further collection or use of their child's information

To exercise these rights, visit the Parent Dashboard.

10. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to access or delete it, to correct it, and to opt out of its "sale" or "sharing" as those terms are defined under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). We do not sell personal information for money.

Categories of personal information we collect (see Sections 2 and 5): identifiers (parent email, IP address), commercial information (subscription status via Stripe), internet and other electronic network activity (analytics events on marketing and account pages), and inferences drawn for service improvement. For each child profile we collect only a parent-chosen nickname, grade level, an avatar, and an optional target test.

"Sharing" for cross-context behavioral advertising. When you visit our public marketing pages or approved parent-only funnel pages, we may share online identifiers and browsing activity with an advertising partner for cross-context behavioral advertising, which California law treats as "sharing." We do not share children's personal information, and no advertising or session-replay technologies run on child-facing learning screens.

We do not sell or share the personal information of any user we know to be under 16, and we never use children's personal information for advertising or profiling.

How to opt out of sharing. Turn off Advertising measurement in or use the "Do Not Sell or Share My Personal Information" link in the footer. This disables advertising measurement in the browser and related backend vendor forwarding. You may also email [email protected]. These controls are the current opt-out mechanisms for advertising sharing.

To exercise access, deletion, or correction rights, contact [email protected] or use the Parent Dashboard. We will not discriminate against you for exercising your privacy rights.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The current version number and date are displayed at the top of this page. We will notify you of material changes by posting the updated policy on this page and, where practicable, by email. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your parental rights under COPPA, please contact us at:

Lyko AI LLC d/b/a LexiMap
Email: [email protected]