Nothing about your child
leaves this device.

01 Who we are

Little Orchid is an independently developed educational app for Singapore Primary Chinese (华文), published for Android and the web, with iOS coming soon. Your child's learning never reaches us, so there is nothing of it for us to look after: it is made and kept on your own phone, under your control.

For the three connected features in §05, we are responsible for what you send: a word to be read aloud, a list of words, or a photograph of a spelling worksheet. Those are handled on our behalf by Cloudflare, Microsoft and Google, as named there. Opened in a web browser, the app has no connected features at all.

Little Orchid is not affiliated with, endorsed by or connected to the Singapore Ministry of Education.

02 What we do not collect

This list is exhaustive as at the version above. Little Orchid does not collect, receive or store:

• Names, email addresses, phone numbers or postal addresses
• Accounts, usernames or passwords — there is no sign-in of any kind
• Your child's progress, answers, handwriting, scores, streaks, mistakes or study history — none of it is ever transmitted
• Learner profile names, or which primary level a child is on
• Voice recordings. The app never records, saves or uploads audio of your child; when speech is recognised it is your device's own recogniser doing it (§07)
• Photographs, beyond the worksheet pages you deliberately submit for reading — up to four at a time — which are discarded (§05)
• Contacts, calendar or location
• Device identifiers or an advertising ID
• Usage analytics, event logs, session recordings or heatmaps
• Crash reports or diagnostic reports sent to us
• Cookies or similar identifiers in the app

There is no advertising in Little Orchid, no advertising or analytics SDK embedded in it, and no data broker relationship. We do not profile users and we do not make automated decisions about anyone. One piece of Google's own plumbing does arrive inside the Google Play Billing library, and an exhaustive list has to say so rather than round it down to nothing: §08 describes it.

03 What the app stores on your device

So that a learner can pick up where they left off, the app writes the following to one file on your phone, inside the app's own private storage:

Opened in a web browser instead, the same information is kept in your browser's own storage for this site rather than in a file on your phone.

On Android, this is kept out of Google's automatic backup and out of phone-to-phone transfer: the app tells Android not to copy it. Your child's progress is therefore never put into a Google account behind your back.

None of the above is sent anywhere, with two narrow exceptions, both described in §05. The random tag goes along with the connected requests, so that a fair-use limit can be applied without making you create an account. And the words on your own 听写 lists are the one kind of content that can travel: a word is sent, on its own, when it has to be read aloud for the first time, and the list is sent as a whole if you ask for 自编例句. Nothing else in the table above has anywhere to go. The weekly parent summary is written on your phone from this same information and put on your clipboard when you press the button; it is never sent to us.

04 The only things that leave your device

A privacy claim is only worth reading if it also names what it does not cover. There are exactly seven situations in which anything crosses the boundary of your device. Every one needs a deliberate tap; four of them are behind the parent gate in §10, and the three a child can start on their own are marked as such below rather than left for you to discover.

1. Having a word from your own list read aloud. The word — no name, no context, at most 120 characters — goes to our server and on to Microsoft to be spoken. A child can start this one, by tapping 听 on a word no recording covers yet. See §05.
2. Photographing a spelling list. The picture goes to our server and on to Google to be read into words; we keep no copy of it. See §05, which says what Google may do with it.
3. Having example sentences written (Little Orchid Plus). Your list of words goes the same way. See §05.
4. Speaking — either the read-aloud check or dictating a list. The microphone is handed to your device's own speech recogniser. Dictating a list is behind the parent gate; a child can start the read-aloud check. See §07 — please read it; this is where audio may be processed off your device by Apple or Google.
5. Buying or restoring Little Orchid Plus. Google Play handles the transaction and sees it. See §08.
6. Sharing a backup file, or sharing a list with another parent. You choose the destination in your own operating-system share sheet. See §09.
7. Copying the weekly parent summary. It goes to your clipboard, and the button sits in the Parent tab without a gate in front of it, so a child can press it. Some operating systems synchronise the clipboard between your own devices (for example Apple's Universal Clipboard), so the text may travel between machines you own, under Apple's or Google's terms.

Outside these seven, nothing. In particular: no learner name, no answer, no score, no handwriting, no mistake, no streak and no scheduling state is ever sent, in any of the seven.

05 The connected features, and what each sends

Little Orchid can now take the school's own weekly 听写 list. Three parts of that cannot honestly be done by a phone on its own, so a small service of ours does them — it passes the request on to Microsoft or Google and hands you back the answer, and it does nothing else. This section describes all three, in full. The first row is the one a child can set off without a grown-up; the other two cannot be reached without passing the parent gate.

Each of those requests carries one thing besides the word, the list or the photo: a random tag, a string of letters and numbers picked at random the first time you use one of these features. It is not an account. It is not your phone's ID. It is not worked out from anything about you or your child, and it is attached to no name, email or payment. It exists so we can apply a fair-use limit without asking you to sign in, and it disappears when you uninstall the app or clear its data. The photo and sentence requests also carry a yes/no flag saying whether 自编例句 are wanted, which is the whole of the rest of the request. As with any website you visit, the company that hosts our service, Cloudflare, also sees the internet address your phone is connecting from.

Neither we nor Microsoft nor Google are ever sent a learner's name, a score, a mistake, a streak, a review schedule or anything else out of the list in §03. The curriculum itself never goes near the internet: all 2,296 生字, their recordings, stroke guides and lessons are inside the app.

What Google is allowed to do with a worksheet. Submissions on Google's free Gemini tier are used to improve its models, and a spelling worksheet can carry a child's name, class and school in the corner. So we pay for the billed tier, on which they are not — and our service refuses to send a photo or a word list at all unless its configuration states that billing is on, rather than trusting anyone to remember. What we cannot promise on Google's behalf is that nothing is held for a moment: Google keeps prompts for a period for its own abuse monitoring, under its terms rather than ours. “Not used to train a model” is a promise; “never touched Google's disks” is not one we are in a position to make. Microsoft is given the word to be spoken and nothing else.

Fair-use limits, and the only two names they are kept against. So that one phone cannot run up a bill for everybody, our service counts how many words were read aloud today and how many pages were read this month. Those counts are held against your random tag, and against the network your phone connected from rather than the phone itself. On an IPv6 connection the address is cut down to its /64 prefix — the part that identifies the line into your home — and the half that identifies the device is discarded before anything is written. An IPv4 address is one household already, so it is kept whole; rounding it off would only heap 256 unrelated homes into one bucket and protect nobody. Both are held in the clear, as the name of a counter.

Nothing sits beside those counters — no words, no pictures, no history. What is stored is a handful of numbers and the day and month they belong to. The day's numbers are deleted two days after your last request; the monthly photo count goes two days after that month ends, and when the last number goes the record goes with it. No request body is ever written to a log: not a photograph, not a dictated list, not a 听写 word. Cloudflare, which hosts the service, keeps its own brief record of requests, as any web host does.

None of this applies in a web browser. The browser version of the app is built without any of it: no recordings fetched, no photo import, no random tag.

06 Permissions, and why each exists

The app asks for as little as it can, and each permission maps to one visible feature. You can decline any of them and keep studying.

That is the complete list. There is no location, no contacts, no calendar, no access to the rest of your files and no advertising ID, on either kind of phone.

07 Speech: the read-aloud check and dictating a list

Two features listen. In the 说 · Read aloud mode a child can tap 听听我读 · Check my reading; and in the import sheet a grown-up can tap 念出听写表 and say this week's spelling words one at a time. In both cases the app asks your device's own speech recogniser — Apple's Speech framework on iOS, or the recogniser installed on your Android device, usually Google's — to listen and return text. Nothing is sent to Little Orchid. In the read-aloud check the app compares that text with the model sentence and stores only whether the reading was clear; in the import sheet each utterance simply becomes a line you then correct.

The Mandarin a child hears is a different matter. Every voice in the curriculum is one of 5,160 spoken items packaged inside the app — 4,338 sound files, because words that sound alike share one — played with no connection; the app never falls back to the robot voice built into your phone. The one exception is a word off your own 听写 list that the packaged pack does not cover, which is read aloud once as described in §05 and then kept on the phone.

08 Purchases and subscriptions

Little Orchid Plus starts with a 7-day free trial for eligible new subscribers, then costs $2.99 SGD per month through Google Play. Google collects and processes your payment details under its own privacy policy; we never see them.

From the store, the app receives only the product identifier, the localised price to display, and whether the purchase succeeded, is pending or failed. The only thing it keeps is a single flag recording that the device is entitled to Little Orchid Plus. It does not store a receipt, a transaction identifier, a store account, an email address or a name — and that flag is deliberately excluded from backups you create, in both directions.

Restoring a purchase re-asks Google Play; it does not involve us. Manage or cancel the subscription in your Google Play settings. iOS is coming soon.

The one Google component in the app, named. Selling a subscription means shipping Google's Play Billing library, and that library brings a piece of Google's own plumbing with it: com.google.android.datatransport, the transport Google's libraries use to report to Google on how they themselves are working. We do not configure it, cannot read what it carries, and send nothing through it. It is also, for what it is worth, where Android first learns that this app wants internet permission — the app then asks for it in its own name (§06), because a permission arriving through the back of a library is not a permission a parent can check. We would rather name it here than let “no third-party code” stand as a claim we cannot fully audit. There is nothing else: no advertising, analytics, attribution or crash-reporting library of any kind.

09 Backups you create yourself, and lists you share

The Parent tab can package one learner, or every learner on the phone, into a single ZIP file so you can move to a new phone. It contains learner profiles, study settings, review scheduling, handwriting history, skill statistics, the mistake book, streaks, daily new-word counts, and your own 听写 lists with their words. Your Plus subscription and the random tag are left out.

The file is built on your phone and handed to your phone's own share sheet. You choose where it goes — Google Drive, Files, OneDrive, email, or anything else installed — and whatever you choose then applies its own privacy terms. Nothing is uploaded until you pick somewhere for it to go, and we never receive a copy.

Because the ZIP contains learner names and progress in readable form, treat it as you would any document about your child, and keep it somewhere private.

Sharing a spelling list with another parent is the same idea at a smaller scale and with no file: the words go out as plain text through your own share sheet, with the list's name as the subject, so they are readable in the chat even by a parent who does not have the app. Nothing about your child travels with them — no name, no scores, no history — and no Little Orchid server is involved.

10 Children's privacy

Little Orchid is made for primary-school children and is intended to be set up by a parent, guardian or teacher. It is built so that children's privacy is a matter of how the app works rather than a promise on a page: there is no account to create, no personal information collected, no advertising, no messaging inside the app, no social features, nothing a child writes is published anywhere, and no advertising or analytics company's code sits inside the app watching them — §08 names the single Google component that is in it, and what it is there for.

Every route off the phone but the three §04 marks is behind a parent gate. The camera and the microphone in the import sheet, sharing a list, exporting or restoring a backup, switching or deleting a learner, clearing the 错题本 and buying Little Orchid Plus all sit behind it, and whatever an import brings back always lands in an editor for a grown-up to check before the child sees it. A child using the app cannot photograph anything, cannot reach the import sheet, cannot share a list or a backup out of the app and cannot buy anything.

The gate is a multiplication question. It asks a two-digit product — 17 × 6 — rather than the single-digit times table it used to ask, because a Primary 3 to Primary 6 child is drilled on the times table and answers it faster than the grown-up it was meant to summon. A wrong answer replaces the sum with a new one and three misses pause the dialog, so guessing is slow. It is a speed bump built for a child who is not trying to break it, not a lock, and we will not describe it as one.

One of those three sends something to us, and we would rather write it down than let you discover it. When a child taps 听 on a word from a list a grown-up typed at home, the app looks first in the packaged pack, then among the recordings already on this phone — and if neither has that word, it goes to our service to be read aloud. What travels is that one word. Not the child's name, not the level, not a score, not the progress, not the rest of the list: the word, and the random tag of §05, which identifies nobody. The recording that comes back is kept, filed under a scrambled code rather than under the word and joined to nothing and nobody, exactly as §05 sets out.

That was a deliberate decision, taken knowingly. The alternative is a child on the evening before the test looking at a word the app will not say, and the word itself comes off a school worksheet — it is not information about a child. If you would rather that never happened, the packaged curriculum never takes this route, and a word already read once never takes it again.

The other two send us nothing at all. The read-aloud check hands the microphone to the phone's own recogniser, which may be Apple's or Google's and is theirs rather than ours (§07); and the button that copies the weekly summary puts that text on your clipboard, where a child can put it as easily as you can.

Because we collect no personal information from anyone, we do not knowingly or unknowingly collect personal information from children under 13 — or under any other age — and there is nothing for us to delete on request. The learner names you type are visible only on your own device and can be edited or deleted there at any time. The words a grown-up puts on a spelling list are words from a school worksheet, not information about a child.

Purchases are gated behind a parent check inside the app and completed in your store account, not by the child.

11 This website

This site is static. It sets no cookies, uses no analytics or tag manager, embeds no social or advertising pixels, and loads no third-party fonts, scripts or iframes — every asset, including the 楷体 font, is served from this domain. There is no comment form, mailing list or sign-up.

As with any website, the server that delivers these pages writes ordinary technical request logs — IP address, timestamp, requested file, user agent — which exist so the site can be operated and abuse investigated. They are not used to build a profile, are not shared for advertising, and are kept no longer than needed for that purpose.

If you open the web build of the app, your learner data is stored by your browser in this site's own storage and is not transmitted to the server. Clearing site data for this domain erases it.

12 Your rights, and how to exercise them

Singapore's Personal Data Protection Act 2012 (PDPA) gives you rights of access to and correction of personal data an organisation holds about you, and the GDPR and similar laws give access, rectification, erasure, portability, restriction and objection rights.

We hold no personal information about you, so there is nothing for us to hand over, correct, export or erase — the only things we have ever received are a word to read aloud, a list of words, a photograph you chose to send, a random tag that identifies nobody, and the network your phone connected from, kept as the name of a counter for a day or two (§05). You keep full practical control, directly and without asking us:

• Access and portability — export any learner to a ZIP from the Parent tab at any time. It includes your own spelling lists.
• Correction — edit learner names, spelling lists and settings in the app.
• Erasure — delete a learner in the app, clear the mistake book, delete a spelling list, or uninstall the app, which takes its file and the random tag with it. In a browser, clear this site's data.
• Changing your mind — take away the microphone, camera or notification permission in your phone's settings, or simply stop using the connected features; the app continues to work.

If you believe we hold data about you and want to make a request anyway, write to [email protected] and we will respond within 30 days. You may also complain to your data-protection authority; in Singapore that is the Personal Data Protection Commission.

13 Retention and deletion

Learner information stays for as long as you keep it on your phone, and goes when you delete the learner, clear the data, or uninstall the app. We hold no copy of it: nothing on our side, no grace period, no archive.

What we do keep is short, and named in §05. The fair-use counts — just numbers, held against a random tag and against a network prefix — are deleted two days after your last request, and a month's photo count two days after that month ends. The recording of a word that was read aloud has no deletion date: it is filed under a scrambled code rather than the word, joined to nothing and nobody, and kept for as long as the app is in service, so that the next family whose teacher sets that word is not paid for twice. Photographs and word lists sent to be read are held by us for no longer than the request takes; what Google does with them for its own abuse monitoring is described in §05 and governed by its terms.

14 Security

Learner information is protected mainly by removing the ways it could get out: it is never sent anywhere, there is no copy in the cloud, no account to break into and no password to steal. On the phone it sits in the app's own private storage, walled off by the phone from every other app and locked behind your passcode or fingerprint, and it is kept out of Android's automatic backup.

The connected features are deliberately narrow: they reach one place, they can do two things, there is no login and no cookie, and nothing a caller sends can change what is stored. The keys that let us talk to Microsoft and Google are held by our service and are never inside the app. Because there is no account, there is nothing for anyone to take over.

Two consequences follow, and both are honest trade-offs of an offline-first design: a backup ZIP you export is a plain, readable archive, so store it privately; and if you lose the device without having exported a backup, the progress is gone, because there is no copy anywhere else.

15 Changes to this policy

If the app ever gains a feature that changes any of the above, this policy will be updated before that feature ships, with a new effective date and version at the top. Material changes — in particular anything that would begin collecting data — will also be described in the app's release notes. This page is the authoritative version.

16 Contact

Questions, corrections or a privacy request: [email protected]. For anything else, [email protected].