Pupila — Privacy Policy & Terms of Use

Last updated: 9 September 2026

Privacy Policy

Who we are

Pupila is operated by ROPUPA LTD, registered in England and Wales under company number 13293181. Our registered office is 71-75 Shelton Street, London, Greater London, United Kingdom, WC2H 9JQ. ROPUPA LTD is responsible for personal information processed to operate Pupila. Contact support@ropupa.com for privacy questions, support or data requests.

For families

Pupila provides stories, narrated reading, practice quizzes and reading-progress features. Parents and legal guardians manage accounts, purchases and child profiles. Children use the reading features under adult supervision. Please use a child's nickname where possible and avoid entering unnecessary personal information.

Accepting our terms does not by itself give consent to every use of personal information. Children have their own privacy rights, even when their information is connected to a parent's account.

Information we use

Account information includes the parent's name and contact details supplied at registration or to support, sign-in information, account identifiers and preferences. A chosen sign-in provider may supply information needed to authenticate the account.

Child profile information includes a name or nickname, age, selected avatar, reading-level or ability preference and the connection to the parent account. Reading records can include stories opened or completed, saved page, reading time and days, weekly goals, quiz answers and attempts, scores, points and badges.

Usage and technical records can include screens visited, searches and search-related events, downloads, recommendations selected, onboarding and subscription actions, timestamps, app version, device and operating-system details, installation and event identifiers, account identifiers, acquisition source and an experiment identifier where configured. Providers may derive approximate location from network information. These records are not necessarily anonymous.

We also process notification tokens and notification interactions, subscription and purchase references, receipts or purchase tokens, entitlement status, and information you choose to send to support. App-store payment providers handle the payment credentials used in their checkout; we use purchase records to verify access and restore subscriptions.

Why we use information

We use account and purchase information to provide the service requested by the adult account holder, authenticate access, administer subscriptions and handle support. Where necessary for that adult's contract, we rely on performance of the contract.

We use child profiles and activity records to provide the reading features requested by the family, remember progress and offer practice reports and relevant story suggestions. For necessary child-profile and progress processing, our legitimate interest is providing a useful, age-appropriate reading service while protecting the child's interests and rights. This is separate from optional usage analytics. Recommendations and quiz results are learning aids, not formal diagnoses, certificates of mastery or promises of a specific educational result.

Necessary security and fraud-prevention processing supports our legitimate interest in protecting accounts and the service. Records required for tax, accounting or other legal obligations are processed to comply with those obligations. Optional analytics and diagnostic reporting in versions offering Privacy choices rely on your choice to enable them, subject to applicable law.

Your optional privacy choices

In app versions offering Parent Zone → Legal & Privacy → Privacy choices, usage analytics and crash reporting are separate optional settings, off until enabled. When no choice is saved on this device, the app asks the signed-in parent or guardian before entering the main app. You can allow both, continue without sharing, or save separate choices. The app remembers a refusal as well as an agreement. You can change the saved choices at any time in Privacy choices. Reading, downloads, saved progress, quizzes and subscriptions remain available if optional collection is declined.

Turning analytics off stops future optional usage collection by that app and clears its queued analytics events. It does not automatically delete information already received. Contact support@ropupa.com about existing information. Settings are device-specific; review them on each device. Earlier app versions may collect usage and diagnostic information automatically and may not offer these controls. Update the app when available or contact us for assistance.

Notification permissions are managed separately in your device settings. Disabling notifications does not itself disable analytics. Withdrawing consent does not affect processing that was lawful before withdrawal.

Firebase and other providers

Google Analytics for Firebase measures app use, including usage events and app/device identifiers. Where enabled, events may be associated with an internal account ID. The updated app denies advertising consent signals and requests that analytics not be used for personalised advertising.

Firebase Crashlytics helps diagnose failures through crash reports and technical app/device information. Firebase Cloud Messaging uses messaging tokens to deliver notifications. Their purposes are different; permission to receive notifications is not consent to analytics. Read more at https://firebase.google.com/support/privacy.

RevenueCat helps manage subscription entitlements and restoration using transaction and technical information. Apple and Google process relevant store purchases and selected sign-in services under their applicable terms. Read RevenueCat's provider information at https://www.revenuecat.com/privacy.

We also use hosting and operational providers to run the service. Relevant information may be disclosed to authorised service providers, where legally required, to protect legal rights, or in connection with a business transfer with appropriate safeguards and notice. A provider's own privacy notice supplements this policy; it does not replace our responsibility for Pupila's processing.

Offline storage and synchronisation

Books and their available quizzes can be saved on your device. Supported downloaded content and manifests are encrypted in the current app; this does not mean every preference, cover image or local record is encrypted. Reading activity and quiz submissions can be queued locally and synchronised when internet access returns.

Removing a download removes local content, not necessarily account reading history. Uninstalling the app does not submit an account-deletion request or cancel an app-store subscription.

Retention and deletion

We retain account and child-progress information while needed to provide the account's features, subject to deletion requests and applicable legal obligations. Support and security records are retained according to the unresolved support issue, investigation or claim and the need to establish or defend legal rights. Transaction records may need to be retained for applicable accounting and tax obligations even after an account is closed.

At the date of this notice, the linked Google Analytics property is configured for two months of event-data retention and fourteen months of user-data retention, with user retention restarting on new activity. These controls do not cover most aggregated standard reports. Other provider data, operational records and backups have separate retention processes; deleting live data does not necessarily remove a backup copy immediately.

You can submit an account-deletion request through the app or contact support@ropupa.com. We assess the information associated with the request, the child's rights, any necessary identity verification and any lawful retention exceptions. Requesting deletion is not a promise that every record across all providers and backups disappears instantly. We will explain applicable limits when responding. We do not apply a blanket minimum six-month retention requirement to all personal information.

International processing and your rights

Providers may process information outside the United Kingdom, including in the United States. A UK registered office does not mean all data is stored in the UK. Where restricted international transfers apply, the applicable legal mechanism must be used, such as an adequacy decision or appropriate contractual safeguards. Contact support@ropupa.com for information about the providers and safeguards applicable to your information.

Depending on applicable law, you may have rights to access, correct, erase, restrict or object to processing, obtain portable information and withdraw consent. A parent or guardian may make requests for a child subject to parental authority and the child's own rights. You can complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or the relevant local regulator. No term below removes these rights.

We will show the updated date and provide appropriate notice of material changes. Updating this notice does not itself authorise a new use requiring consent.

A short explanation for children

Pupila remembers where you stopped and the activities you finish so you can carry on reading and your parent can see your progress. Some app information helps us find problems and improve things. Ask your parent before entering personal information or buying anything. Your parent can contact us if you need help with your information.

Terms of Use

Accounts and content

These terms are between ROPUPA LTD and the adult account holder. The adult manages purchases and supervises child access. Keep account details secure and tell us about suspected unauthorised access.

We provide a limited, personal, non-transferable licence to access content available to your account. Downloads permit supported offline use within Pupila; ownership of the content does not transfer to you. Access may depend on the applicable subscription or entitlement. Do not unlawfully copy, distribute, sell or broadcast content, misuse accounts or interfere with security. These restrictions do not remove exceptions or rights provided by law.

Subscriptions and consumer rights

The purchase screen and relevant store show the price, billing period, any trial and renewal terms before purchase. Manage or cancel store subscriptions through the account used to purchase them. Deleting Pupila or requesting account deletion does not itself cancel an app-store subscription.

Refunds and cancellation are governed by applicable consumer law and the relevant purchase provider's procedures. Nothing in these terms removes statutory remedies for faulty or misdescribed digital content or other mandatory rights. Additional terms displayed for a particular offer apply to that offer only to the extent permitted by law.

Educational features and service changes

Stories, quizzes, recommendations, points and badges support practice and engagement. They do not guarantee language mastery, a formal qualification or a particular result within a fixed period.

We may make reasonable changes to maintain, improve or secure Pupila. We will provide appropriate notice of material changes affecting paid access and respect remedies required by law. Access may be restricted where reasonably necessary to address fraud, unlawful use or a material breach, with proportionate action and an explanation where lawful and appropriate. Contact support@ropupa.com if you believe a restriction is mistaken.

Law and disputes

Contact support@ropupa.com first so we can try to resolve a concern. These terms are governed by the law of England and Wales. If you are a consumer, this does not deprive you of mandatory protections under the law that would otherwise apply in your country of habitual residence.

The courts of England and Wales have non-exclusive jurisdiction, without limiting any right under applicable law to bring proceedings in your local courts. Nothing in these terms restricts statutory consumer rights, privacy rights or the right to contact a regulator.