Bira and Biro Privacy Policy
Version 1.1 · Effective 27 October 2026
Bira and Biro ("Bira and Biro", "we", "us" or "our") provides an early-learning app for children aged approximately 3 to 8. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have. It applies to the Bira and Biro mobile application and website (the "Service").
We are the data controller for the personal data described here. Our contact details are at the end of this policy.
1. Summary
- We collect the minimum needed to create a parent account, to keep a child's learning profile and progress, and to operate the app.
- We do not sell your data or your child's data, and we do not use it for advertising.
- We do not collect precise location, contacts, photos, microphone or camera data. If you tap "Use my location", the device converts your location into a city and country; the coordinates are not sent to us or stored.
- Children's profiles are created and controlled by a parent or guardian who accepts this policy on the child's behalf.
- You can request access, correction or deletion of your data at privacy@biraandbiro.com.
2. Data we collect
2.1 Account and parent data
| Data | Why we need it |
|---|---|
| Phone number | To sign you in with a one-time code and to identify your account |
| Name and email address | Only when you choose Google sign-in; to identify and contact you |
| Google account identifier | To recognise your account when you sign in with Google |
| Relation to the child, city and country | Optional details you provide after sign-up so the app can show relevant content |
| Location consent flag | To remember whether you allowed the device to suggest your city/country |
| Profile photo | Only if you choose to add one |
A one-time code is sent to your phone through an SMS provider. We store the code only as a hash for a few minutes, together with the requesting IP address and the number of attempts.
2.2 Child profile data
A parent or guardian may add, for each child:
- name, age, gender and grade level;
- an optional disability status (for example hearing, vision, learning or autism), which we treat as sensitive personal data; and
- an optional avatar.
We use this data only to run the learning experience, adapt content where relevant and show progress to the parent.
2.3 Learning progress
We store which activities and chapters a child has completed, XP events, completion timestamps and a randomly generated identifier for each offline event so that uploads are not counted twice.
2.4 Device and notification data
If you allow notifications, we store the Firebase Cloud Messaging token of the install, the platform (for example Android), an optional device name and the last time the token was used. You can turn notifications off in the app; the token is then removed on sign-out or when Firebase reports it invalid.
2.5 Technical and security data
Our servers receive the IP address and user agent of requests, authentication tokens, and standard server logs. We use them to operate the Service, prevent abuse and investigate security incidents.
2.6 Data we do not collect
We do not collect precise GPS location, contacts, calendar, photos, microphone or camera content, advertising identifiers, or behavioural advertising data. The Art Studio stores drawings on your device; we do not upload them. The app does not include third-party analytics or advertising SDKs.
3. Children's privacy and parental consent
The Service is intended to be used by a parent or guardian together with a child. We do not knowingly allow a child to create an account or to provide personal data directly to us without a parent or guardian.
When you create a child profile, you confirm that you are the child's parent or legal guardian and you consent, on the child's behalf, to the collection and use of the child's data as described in this policy. This consent is required by:
- the U.S. Children's Online Privacy Protection Act (COPPA), which applies to personal information collected from children under 13; and
- Ethiopia's Personal Data Protection Proclamation No. 1321/2024, which protects personal data, including children's data and sensitive personal data such as health or disability information.
A parent or guardian may review the child's data, ask us to correct or delete it, or refuse further collection by contacting privacy@biraandbiro.com. We will respond within the time required by applicable law. Deleting the child profile removes it from the Service; some backup copies may remain for a limited period as described in Section 7.
3.1 Our commitments to your child
These commitments, together with the rest of this policy, make up our Children's Privacy Notice. You review them before a child's account is created.
- Safe and positive learning. We provide age-appropriate, inclusive educational activities that respect every child, regardless of gender, ability, religion, ethnicity or background.
- Parental responsibility. Parents and guardians supervise the child's use of the Service, support the learning activities and make sure the child learns in a safe environment.
- Healthy screen time. Children are encouraged to learn daily, but Bira and Biro screen time should be limited to a maximum of one hour per day, or less where age-specific guidance applies. Adults are responsible for monitoring total screen time.
- Privacy and data protection. We collect only the information necessary to provide the educational services, monitor learning progress and maintain platform security. We protect children's data, do not sell it and do not use it for targeted advertising.
- Child safeguarding. We are committed to protecting children from harmful content, exploitation, discrimination and inappropriate interactions. Report any safety concern immediately to privacy@biraandbiro.com.
- Educational use. The Service supports children's learning but does not replace formal education, parental guidance, physical play or real-world interaction.
3.2 What you confirm when you create a child's account
When you add a child profile you confirm that:
- you are the child's parent, legal guardian or legally authorised representative, and you agree to the full Terms of Service;
- you have read this Children's Privacy Notice; and
- you consent to the processing of the child's data for the educational purposes described in this policy, where consent is legally required.
4. How we use data and our legal bases
We use personal data to:
- create and secure your account and sign you in;
- create and sync child profiles and learning progress across your devices;
- deliver content, downloads and offline activities;
- send notifications you have enabled, such as a chapter-completion message or an optional weekly reminder;
- provide support and respond to your requests;
- prevent fraud, abuse and unauthorised access, and keep the Service secure; and
- comply with the law and enforce our Terms of Service.
Under Ethiopian law we rely on your consent, the performance of our agreement with you, our legitimate interests in operating and securing the Service, and legal obligations. Under U.S. law we rely on the consent you give as a parent or guardian, our provision of the Service, and our legitimate business interests. Where consent is the basis, you may withdraw it at any time, but that will not affect processing that already happened.
5. Sharing and service providers
We do not sell personal data. We share data only as needed with:
- Google — Google Sign-In (if you choose it) and Firebase Cloud Messaging (if you enable notifications), which may process data in the United States;
- our SMS provider — your phone number, to deliver one-time sign-in codes;
- our hosting and infrastructure providers — to store data and run the Service; and
- authorities or other parties — where required by law, to protect rights or safety, or in connection with a merger, acquisition or sale of assets (subject to appropriate safeguards).
Service providers may process data only for the purposes we specify and under contracts that require confidentiality and security. We do not allow them to use your data for their own advertising.
6. International transfers
We may store and process data outside Ethiopia, including in the United States, where our service providers operate. Where Ethiopian law requires it, we transfer data only to countries that provide an adequate level of protection, or with your consent and any authorisation required from the Ethiopian Communications Authority. We use contractual and technical safeguards appropriate to the risk.
7. How long we keep data
We keep personal data only as long as needed for the purposes in this policy:
- Account and profile data — while your account is active. After you delete your account, we delete or anonymise the data within 30 days, and remove it from backups within 90 days, unless the law requires us to keep it longer.
- Child profiles and learning progress — while the profile exists or until you delete it.
- OTP codes — a few minutes, then automatically pruned.
- Authentication tokens — until you sign out, the token expires, or the account is deleted.
- Push tokens — until you disable notifications, sign out, or the token becomes invalid.
- Server security logs — up to 90 days, unless needed to investigate an incident or required by law.
When data is no longer needed, we delete it or make it anonymous.
8. Security
We use technical and organisational measures designed to protect personal data, including encryption in transit (HTTPS), hashed one-time codes, hashed authentication tokens, access controls and least-privilege administration. No system is completely secure; if a breach affects your rights, we will notify you and the Ethiopian Communications Authority as required (within 72 hours of becoming aware, where that law applies), and any other authority required by U.S. law.
Where Ethiopia's Personal Data Protection Proclamation No. 1321/2024 requires it, we register our processing with the Ethiopian Communications Authority and appoint a data protection officer. You can reach that role at privacy@biraandbiro.com.
9. Your rights
Depending on where you live, you may have the right to:
- know what personal data we hold and receive a copy;
- correct inaccurate data;
- delete data (subject to legal retention obligations);
- restrict or object to some processing;
- withdraw consent;
- receive your data in a portable format; and
- complain to a supervisory authority.
Under Ethiopia's Personal Data Protection Proclamation No. 1321/2024, you may exercise these rights with us and complain to the Ethiopian Communications Authority. If you are in the United States, you may also have rights under the California Consumer Privacy Act (as amended by the CPRA) and other applicable state privacy laws, including the right to know, delete, correct and opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioural advertising. We will not discriminate against you for exercising your rights.
To make a request, email privacy@biraandbiro.com. We may need to verify your identity, and for a child's data we may ask you to confirm that you are the parent or guardian. You may use an authorised agent where the law allows it.
10. Cookies and similar technologies
The mobile app does not use advertising cookies or cross-app tracking. Our website uses only the cookies and local storage needed to operate the site and remember your language choice. We do not use third-party advertising cookies.
11. Changes to this policy
We may update this policy to reflect changes in the Service or the law. If a change is material, we will notify you in the app or by another reasonable means before it takes effect. The version and effective date are shown at the top of this document.
12. Contact us
Bira and Biro Addis Ababa, Ethiopia Privacy and legal: privacy@biraandbiro.com Support: support@biraandbiro.com
If you are not satisfied with our response, you may contact the Ethiopian Communications Authority or, in the United States, the Federal Trade Commission or your state attorney general.