Privacy Policy

📋 1. How We Collect and Use Your Personal Information

1.1 To provide core functionality and to protect account and system security, we process, on a minimum-necessary basis, the personal information directly related to the relevant feature:

• Account and sign-in: phone number plus SMS verification code, or email plus password or verification code; access tokens, refresh tokens and their expiry times. Used for authentication, session maintenance and security auditing.
• Device setup and management: nearby Wi-Fi information (SSID, BSSID — used only to scan for and display available networks), local network information (LAN IP), device model, operating-system version, app version, error logs, and the router name needed for setup. We do not use location data for positioning; on Android, location permission is only a compliance precondition for scanning Wi-Fi.
• QR scan / camera, voice / microphone and photo album (optional): with authorization, the camera, microphone or photo permission is used to scan QR codes to join a family, set up devices, take photos, for voice interaction, or to select or save images.
• Messages and service notifications: device identifier, app version, basic network status, error logs and similar, used for the message center, in-app notices and troubleshooting.
• Customer support and feedback: the contact details you voluntarily provide (email, phone) and the problem description, screenshots or logs, used only to contact you and to locate the problem.
• Orders and payment (where applicable): necessary information such as order number and transaction status. Payment is implemented through the Alipay SDK, and the related processing follows Alipay's privacy policy.
• Baidu Netdisk authorization and listening source (optional): only when you voluntarily initiate Baidu Netdisk authorization and use it for a TocoTalk feature do we process the access token, refresh token, authorization scope and expiry returned by Baidu OAuth, and associate the authorization at the family level. To display and play content you have chosen, we process file information in the authorized directory — file name, path, file identifier (fsid), file size, checksum (such as md5), media information and temporary playback URLs.

1.2 Why we use your personal information

• To deliver core services: recognise picture-book content and provide AI read-aloud, translation and picture-storytelling; record reading progress and generate learning reports; recommend content based on a child's interests; provide device management and firmware updates.
• To improve service quality: analyse product usage to improve features and experience; carry out internal audits, data analysis and research; troubleshoot and fix system faults.
• To keep the service safe and lawful: prevent, detect and investigate fraud and infringement; keep systems and services secure and stable; comply with legal requirements.

We do not use your personal information for any purpose not described in this policy. If we need to use it for another purpose, we will obtain your explicit consent in advance.

1.3 In the following situations we may process your personal information in accordance with law or based on authorization:

(1) in an emergency, to protect major lawful interests such as the life or property of you or the public; (2) to cooperate with administrative enforcement or judicial proceedings in accordance with law; (3) to protect our or others' lawful rights and interests (such as copyright or trademark rights); (4) for de-identified or anonymized statistics and service-quality improvement; (5) other situations permitted or required by law, regulation or regulatory policy.

1.4 Specific scenarios (where used)

• Service display / runtime logs: to keep core services available we may collect device and runtime log information (such as access time and error logs).
• Search (where used): when you search in the App we may process search keywords, time and click activity, to return and improve search results.
• Content creation / publishing / interaction (where used): if you record, shoot or upload content in a feature, we process that content as you act and display your display name or avatar to the necessary extent.
• Voice samples and AI story synthesis (optional): when you use the story features, you may record or select a voice sample and upload it. We upload and store the sample and its file information (file name, size, format, upload time) on our servers and in object storage to synthesize children's story audio in that voice. A voice sample may contain the voice characteristics of you or another person and is sensitive personal information; where it comes from a child, it is children's personal information. We process it only after you upload it and tick the authorization box.
• Ordering and fulfilment (where used): to complete a transaction we process order information to the necessary extent; where third-party fulfilment or delivery is involved, we share delivery information as necessary for fulfilment.
• Customer support and user response: to verify identity and troubleshoot, we may process account information, contact details and communication records (text, images, audio, video or call records).
• Personalized recommendations: the current version does not provide personalized advertising or third-party advertising SDK delivery. If we introduce this in future we will obtain your consent separately and provide an opt-out.

1.5 Information and permissions you may choose to provide (authorized on demand; refusal does not affect unrelated features):

• Photo album permission: to select or save images (for example, to change your avatar or save a QR code).
• Camera permission: to scan QR codes to join a family, set up devices, take photos and similar.
• Microphone permission: for voice interaction or recording (if enabled).
• Location permission: to scan nearby Wi-Fi (a system/platform precondition); not used for location services.
• Local network permission (iOS): to communicate with devices on the local network (for example, device setup).
• Wi-Fi permissions (Android: ACCESS_WIFI_STATE, CHANGE_WIFI_STATE, NEARBY_WIFI_DEVICES and similar): to read or change Wi-Fi state and scan nearby Wi-Fi, to assist with setup.

You can change authorizations at any time in system settings: iOS: Settings → Privacy & Security → select the relevant permission or this app to adjust. Android: Settings → Apps → this app → permissions/notifications/network to adjust.

🍪 2. How We Use Cookies and Similar Technologies

We may use local storage (such as AsyncStorage) or similar technologies to store sign-in state, the privacy-consent version and timestamp, and similar, for authentication and to improve your experience. We do not use them for cross-product tracking. You can clear this data in device or system settings; clearing it may require you to sign in again or affect your experience.

🤝 3. How We Share, Transfer and Publicly Disclose Your Personal Information

3.1 Third-party services / SDKs Third-party services in the current version:

• Cloud storage provider: Alibaba Cloud (data storage, backup and server operations).
• Payment providers: WeChat Pay and Alipay (processing payment transactions); the related processing follows the respective provider's privacy policy.
• Baidu Netdisk open platform: for Baidu Netdisk OAuth authorization that you voluntarily initiate, directory browsing, file selection, audio preview, and setting the files or directories you choose as the listening source for your home device. The product access boundary for this feature is the /TocoTalk folder in the Baidu Netdisk root and its subdirectories. Only after you complete authorization and Baidu Netdisk permits that access method will TocoTalk process the necessary file information in that folder; it does not browse or process files in your other directories.
• Voice synthesis and voice-processing provider: used to upload and store voice samples and to synthesize story audio. It processes the above samples and the information necessary for synthesis only within the scope we authorize and may not use them for its own purposes.

Baidu Netdisk authorization is completed by you voluntarily. The server stores the credentials used for later access and refresh at the family level, and briefly caches access tokens and temporary playback URLs at runtime; we do not record full tokens in logs. Baidu Netdisk files remain provided and managed by Baidu Netdisk; TocoTalk reads only the necessary directory, file metadata and playback data when you authorize and initiate the relevant feature, and does not change file ownership.

You can unlink Baidu Netdisk in the App. After unlinking, we stop further access, clear the runtime authorization cache, and delete or invalidate the local authorization record; files already stored by Baidu Netdisk and their authorization status on Baidu's side remain subject to Baidu Netdisk's rules. We are not currently aware of any behavior that deletes your Baidu Netdisk files on your behalf through Baidu's API or calls Baidu's authorization-revocation API; if you wish to fully revoke authorization on Baidu's side, follow the method Baidu Netdisk provides.

Sharing uses the system share component. The current version does not integrate third-party advertising SDKs and does not use your personal information for personalised advertising. To keep the service stable and to troubleshoot faults, we use a self-hosted error-monitoring service that collects crash and exception logs (excluding identifiable information such as phone number, email or tokens). If we integrate other third-party SDKs in future, we will assess them on a minimum-necessary basis, disclose the vendor, processing purpose, information type and opt-out path prominently in a version update, and obtain your consent where necessary.

3.2 Transfer of personal information If a merger, division, restructuring, asset transfer or bankruptcy liquidation requires the transfer of personal information, we will inform you of the recipient and require it to remain bound by this policy; where necessary we will seek your consent again.

3.3 Public disclosure We do not in principle publicly disclose your personal information; if public disclosure is genuinely necessary, it will be based on a lawful ground, follow legal procedure and apply security measures that meet legal and industry standards.

3.4 Exceptions to consent Situations related to legal obligations; directly related to national security, public security or major public interest; directly related to criminal investigation, litigation or enforcement of judgments; necessary to protect the major lawful rights of you or others where consent is hard to obtain; information obtained from lawful public channels; necessary to maintain service security and stability (such as fault handling); and other situations provided by law or regulation.

🔒 4. How We Store and Protect Your Personal Information

• Storage location: personal information collected and generated within the People's Republic of China is stored on servers within China.
• Retention period: kept only for the shortest period necessary to achieve the purpose; on expiry, or after you delete your account or request deletion, we will delete or anonymize it in accordance with law (unless otherwise required by law).
• Baidu Netdisk authorization information: the credentials needed to refresh authorization are deleted or invalidated when you unlink, delete your account, or no longer need the feature; access tokens and temporary playback URLs are cached only briefly at runtime and are deleted when they expire or are cleaned up. The original files in Baidu Netdisk and their retention period are determined by your relationship with Baidu Netdisk and Baidu Netdisk's rules.
• Security measures:
  • Technical: encrypted transmission and storage, access controls and least privilege, regular security audits and vulnerability scanning, and data backup and disaster-recovery mechanisms.
  • Organisational: a dedicated security team responsible for information security, information-security training and confidentiality agreements for staff, and an emergency plan for responding to security incidents.
• Your responsibility: keep your account and password safe and do not disclose your account information to others; if your account is compromised, contact us immediately.
• Security notice: despite the measures we take, the internet is not absolutely secure. If a data breach or similar security incident occurs, we will notify you promptly and take remedial measures.
• Voice samples: stored in our object storage. The retention period runs until you delete the sample, you delete your account, or the feature is discontinued; playback and download links are short-lived signed links that expire automatically. After you delete a sample or your account, we delete the sample file and its records (unless the law requires otherwise).
• Voice models: to complete a story batch we temporarily create a voice model for that batch; it is deleted when the batch finishes and is not kept long-term.

⚖️ 5. How You Exercise Your Personal-Information Rights

• Access and correction: access or correct your account information on pages such as "Profile" or "Edit profile".
• Deletion: request deletion when the statutory conditions are met.
• Withdrawal of consent: withdraw consent through system permission switches, in-app settings or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Account deletion: you may apply directly in the App under Me → Settings → Delete account, or through the email or support hotline listed under "Contact Us". After submission the account enters a 30-day recovery period; signing in again with verification during that period restores the account. Once the recovery period ends, we will stop providing the service and delete or anonymize your personal information in accordance with law (unless otherwise required by law).
• External deletion channel: if you cannot sign in to the App, you may submit a deletion request through the email or support hotline listed under "Contact Us"; after verifying your identity we will handle it as described above.

👶 6. Protection of Minors

The TocoTalk mobile app and mini program are intended for parents, to pair devices and manage the content their children listen to. Children do not sign in, do not authorize anything, and do not browse the Netdisk; they simply listen to content a parent has chosen on the device at home.

If you are a minor, please read and use the App with a guardian and with the guardian's consent. For users identified as children (under fourteen), we apply stricter protections as required by law. For the special rules on children's personal information, see the Children's Privacy Policy.

📧 7. How to Contact Us

• Company: Shenzhen Yuanqi Chuangxiang Artificial Intelligence Co., Ltd.
• Email: privacy@tocotalk.com
• Support hotline: 0755-23216256
• Address: 601-A05, Yousuowei Building, No. 2000 Jiaxian Road, Gangtou Community, Bantian Street, Longgang District, Shenzhen
• Website and general domain: https://www.mindax.cn
• Filing number: 粤ICP备2025456131号-3A

If you have any question, comment or suggestion about this policy, or wish to exercise rights relating to your personal information, contact us through the channels above. We will respond to your request within 15 business days.

🔄 8. Changes to This Privacy Policy

We may update this policy to reflect business, legal or regulatory changes. Material changes will be notified at a prominent position in the App or by pop-up; if you disagree you may stop using the service and apply to delete your account; continued use constitutes acceptance of the changed policy.

☁️ 9. Legacy Baidu Netdisk Directory Migration (Disabled by Default)

If you previously used the Baidu Netdisk feature under "My App Data/TocoTalk", we may offer a family administrator an optional migration entry for the old directory in the App. Only after you actively confirm will it process file information and migration-task status in the exact old directory /apps/TocoTalk and try to move it to /TocoTalk in the Netdisk root. We do not initiate migration automatically and do not read or process Netdisk content outside those two directories.

During migration, to avoid overwriting or accidental deletion we first check whether the root /TocoTalk already has content; if a conflict is found we stop, without overwriting or creating a copy. We delete the exact old empty directory only after verifying each file move, completing the related device-source synchronization, and confirming the old directory is empty and safe to clean up; if migration fails, the authorized account changes, the network drops, or the Baidu result cannot be confirmed, the old directory and unverified content are kept, and you can review it later or restore the original task as prompted.

This capability is currently disabled by default and requires written confirmation from the Baidu Netdisk open platform that root-directory authorization, move and empty-directory deletion are supported, plus non-production verification. Disabling the capability prevents new migration tasks from running and does not automatically move back files that were already migrated.