Operator, privacy and purchase terms

Responsible operator

F.J.Wehrli
Rue du Chasseral 16
2515 Prêles, Switzerland
florian@buero-wehrli.ch
www.buero-wehrli.ch

Test phase and prices

During the test phase Uggadugu is open to use. After that, trial rounds stay at no cost; full access is paid at the prices published at that time. Prices are shown in the adults’ area before any purchase. There is no subscription with automatic renewal and no automatic future charge. Until payments are enabled, AI pictures do not lead to any payment to the operator either, within the available daily limit.

Optional image packs

After activation, adults can buy 20 AI pictures for CHF 4.90 or 50 for CHF 9.90 in the parents’ area. These are final prices in Swiss francs for a single payment. All 24 scenes are included. An image is generated after completing a learning journey or a round of thinking games. Results vary; an exact resemblance is not guaranteed. Credits are added after confirmed payment. One credit is used when the provider successfully generates a valid image. Failed generations and local replacement cards use no credits. Daily service limits still apply.

Voluntary support of CHF 5, 10 or 20 helps further development and adds no image credits. Tax deductibility is not promised.

Payments and recovery

Payments use Stripe Checkout and the payment methods offered there. Card details go directly to Stripe, not our server. International card acceptance depends on the issuing bank and Stripe. Your bank may charge currency conversion or cross-border fees. Prices remain in CHF. TWINT is offered after activation of that method. Local Ugandan mobile-money payments are not currently integrated.

Your personal recovery code restores purchased credits after changing devices or clearing browser data. Keep it privately outside this app. Anyone with the code can use the credits. Photos and learning progress are not transferred.

For payment or credit problems, contact the operator with your payment reference, without child photos or full card details. If a successfully generated image does not reach the album because of a connection or storage problem, contact us for a credit correction. Justified refunds use the original payment method; associated credits are adjusted accordingly. Statutory rights are unaffected.

Data on your device

The toy photo, name, progress, settings, unfinished exercises and last 30 reward pictures stay in the local browser database. The learning activities have no analytics trackers or advertising placements. Optional YouTube videos may contain ads. Different devices and browser profiles do not share these data. People using the same browser profile share its local data. The service worker stores app files for offline use after the first successful load.

You can delete local data in the parents’ area. Downloaded files must be deleted separately. Local deletion does not refund purchases or remove legally required payment records. Credits remain recoverable with the recovery code.

AI pictures and speech

Optional AI adventures use OpenAI. In imaginary-character mode, OpenAI receives only a prepared character and scene. No photos, names or learning progress are sent. The separate photo mode remains blocked until Zero Data Retention is confirmed for the API project. Even then, this feature is intended only for companions without people. A parent or legal guardian can withdraw permission in the parent area. This cannot retroactively stop processing already started. Cloudflare forwards requests. Images are not stored in our credit ledger or application logs. OpenAI processes content under its API terms; processing outside Switzerland is possible. Safety and legal retention exceptions may apply even with Zero Data Retention.

Read-aloud uses the browser or operating system. Some voices process text online. Only letters, example words, numbers and exercise prompts are spoken; never toy names or photos. Voice availability depends on the device. Luganda needs a suitable installed or supported voice for reading text aloud; the app does not silently substitute a different language's voice. The Luganda A–Z activity shows a real Luganda example word for every letter that has one; six letters (C, H, I, Q, X, Y) have no confirmed Luganda example word yet and show only the letter itself, not a complete Luganda alphabet curriculum.

Language packs and audio clips

The language packs contain pre-generated audio clips for letters, words, numbers and tasks. The voices were generated once with the speech synthesis service ElevenLabs; they are synthetic and not yet checked by native speakers. The app loads the clips as files from our hosting at Cloudflare and stores them for offline use. Playing a clip sends no names, photos, entries or progress to ElevenLabs or any other service. Where a language pack has no clip for a text yet, the device’s speech function reads it, as described above.

Language pack workshop

In the workshop, adult speakers can record the words of a language pack. Name, country, region, consent and recordings stay in this browser until the speakers themselves export a raw pack as a file and pass it on. With their consent, the recordings are played unchanged in the app and may be published with the language pack; they are not used to clone or train AI voices. The name appears only in the raw pack, never in the children’s app. Speakers can ask for their recordings to be removed at any time at florian@buero-wehrli.ch.

Own play cards

In the adult area, adults can write their own play cards with a title, a task and pictures, and make their own recording of at most 30 seconds, only when they tap. Cards and recordings stay on this device and are not sent to any server. They are only passed on as a file that adults create themselves; recordings travel only if the box «Include recordings» is ticked. Each card can be deleted on its own. «Reset the whole device» keeps the own cards. Please do not put children’s names in cards or recordings.

Printable sheets, missions and observations

Printable sheets are created in the browser; a name typed in is not stored. The QR code on a mission card contains only the address of the app and the mission’s identifier, no personal data. Mission results and learning observations stay in the local browser database. An export of the observations is only created on request, as a file on your device.

Payment data and infrastructure

Cloudflare hosts the app, its API gateway and credit database. The database keeps random access identifiers, cryptographic hashes of recovery codes, order and Stripe payment references, amounts, credit movements and timestamps. A daily changing hash of the IP address limits new credit accounts. A necessary Secure, HttpOnly access cookie lasts for one year and is not used for advertising. These data support payment processing, recovery, abuse prevention and legal retention. Credits are not linked to child photos or learning records.

Stripe processes payment and contact details entered at checkout. Providers may process connection data for service delivery and security. See Cloudflare, Stripe and OpenAI.

Further functions, if switched on

The following functions are switched off during the test phase. This information only applies if a function is switched on.

Device handover by QR. Adults can hand over child profiles to another device: child’s name, companion, learning progress, practice name, learning preferences, observations, script, supports, family language and the settings of «Break and play». The data is encrypted in the browser with a six-digit one-time PIN and passed on as QR codes or as a file; it does not go through our server. The PIN is not stored. Anyone who has the codes or the file and knows the PIN can read the data. A saved YouTube video is only transferred as video identifier and duration and only applies after explicit permission on the other device. Album, game pictures and AI and payment permissions are not transferred.

Study mode. Taking part requires the consent of a parent or guardian in the parents’ area. Consent is recorded with the date on this device only and can be withdrawn at any time by removing the tick. A study file is only created on request on your device. It contains a random pseudonym, a child code and details of solved tasks with the day, but no name, no photo, no time of day and no profile identifier. Uggadugu does not send the file; it is only passed on if you hand it over yourself. For files already passed on, contact the study team with the pseudonym.

Family language. A family language can be chosen for a child profile. The choice stays on this device. For this, Uggadugu plays pre-generated audio clips from the language packs and transfers no children’s data.

Access and unlock codes. When redeeming a code, the device sends the code and a random device identifier to our server. The server stores the code only as a cryptographic checksum with product, region, term and activations, plus checksums of code and device identifier, without names, email addresses or children’s data. The country of the connection is not stored. The signed licence token and the device identifier stay device-wide in this browser, apply to all child profiles on the device and are not included in backup files. For purchases, the section «Payment data and infrastructure» applies.

Documents to download. The PDF documents in the parents’ area are only loaded from our hosting when tapped. As with any page request, technical connection data arises; no children’s data is transferred. Delete downloaded files on your device yourself if needed.

“Earth and countries” module (“My places” unit). The globe runs entirely in the browser; there is no location detection of the child, “My place” is set by hand on the globe and, together with the saved places of people the child knows, stays only on this device. Country borders come from Natural Earth (public domain). The earth and night textures are currently a placeholder map, coloured from the same country borders, not a real satellite image from NASA Blue Marble or Black Marble; it will be replaced once real imagery is available. No image of the earth and no location data leave this device.

Contact and privacy requests

Send questions and requests to access or delete server-side payment data to florian@buero-wehrli.ch. Start with the payment reference; do not send your recovery code without being asked. Legal retention duties may prevent immediate deletion of some payment records.

Optional YouTube videos

For titles in the video history, our server queries YouTube using the video ID. It does not forward your browser’s IP address or cookies to YouTube. Titles are stored on your device.

YouTube is optional and off by default. Parents choose a single link and duration. The player from youtube-nocookie.com loads only when the unlocked video is opened. Google then receives technical connection data such as the IP address; playback may involve further processing. Privacy-enhanced mode does not prevent all data transfer. YouTube may display advertising, other videos and external links. The timer stops the embedded video only inside Uggadugu. It is not a device lock. Parents can withdraw permission.

The video feature uses YouTube API Services. Using it also binds users to the YouTube Terms of Service. Acceptance of this privacy policy and permission from a parent or legal guardian are required before activation. All learning games remain available without permission.

We store the selected video ID, duration, permission version and date, and the start and end of video time locally. Changing or withdrawing permission replaces or removes this data as applicable. It is excluded from backup files. We also remember the most recently used video links locally, together with their date and chosen duration, at most eight entries, so you can select them again without searching. You can remove each entry at any time; like the other video data, this list is excluded from backup files too. We do not request YouTube credentials or access your Google account.

Loading the player sends Google the IP address, browser information and our website address; cookies or similar storage may be used. Google may process data outside Switzerland, including in the USA. See the Google Privacy Policy and its data transfer information. Uggadugu cannot retrieve data already received by Google or delete Google’s storage.

Permission can be withdrawn at any time under “Parents → Turn off YouTube”. An open player is removed at the next check, which runs twice per second while the app is visible. Closing or hiding the app removes the player. Please watch together. Ads, changed content and outgoing links are outside our control. The parent question does not verify identity.

Google Privacy · YouTube Terms

A YouTube video saved by adults can be passed on to other devices with a class code or, if switched on, with the device handover by QR. Only the video identifier, the duration and the chosen reward type are transferred, not the permission. On the other device the video only applies once an adult there explicitly enables it when adopting and accepts the YouTube Terms and this privacy policy; without this permission the video is not loaded there.

Updated September 2026.

Practice name and local voices

The optional name activity stores the first name or favourite word and its progress only in this browser. The practice name is not sent to any AI service. Reading the name aloud uses only a voice identified as local by the browser; without a suitable local voice, the name is not spoken. You can change or remove the practice name in the activity. The private backup includes the practice name and its progress. Keep this file private.

When an approved video is opened, the video feature also loads the YouTube IFrame API from youtube.com and, where necessary, ytimg.com. We store the last reported playback position and completion status locally in this browser, so the same video can resume with about seven seconds of overlap for a new reward. Changing the video, revoking permission or deleting local app data removes this position. It is not exported in the private backup. Abruptly closing the browser may lose the last unsaved seconds.

Video messages and teachers’ own videos

In the adult area, teachers or parents can record short video messages (90 seconds at most). Camera and microphone are only switched on when the adult taps «Turn on camera and record» there, and they are released again after the recording. Children cannot record anything in the app. The recording, title, subtitle and the selection of child profiles stay in the local browser database of this device; there is no upload and no server. Sharing with other devices only happens when an adult saves the message as a file and passes it on themselves; on the other device it is only imported after confirmation. Messages can be deleted individually in the adult area; «Delete all local data» removes them as well. Files that have been passed on are outside our control.

Note for teachers: do not film children and do not mention names of children or schools. Show other people only with their consent and use music only with the necessary rights. YouTube’s terms apply to your own videos on YouTube; the instructions in the app refer to YouTube Help.

This section still needs legal review.

School handwriting font

In the Swiss edition, Uggadugu shows letters and tracing templates in the Deutschschweizer Basisschrift to children in German-speaking Switzerland. Deutschschweizer Basisschrift © NW EDK / EDK-Ost / BKZ. The font file is only delivered to connections from Switzerland; for this the server checks the country of the connection and does not store it. The tracing lines are derived from the letter shapes. Outside Switzerland, or without this check, Uggadugu uses the Andika font (© SIL International, SIL Open Font License 1.1).