Last updated May 2026. SonSpeak is built for kids, used by parents, and trusted by therapists. Here's exactly what we do and don't do with your data.

What we store

Account: your email and a hashed password (we never see your password).
Boards: the tiles, photos, and voice recordings you save. These belong to you.
Usage: how often each tile is tapped, so we can show you a 30-day activity chart.
Privacy-respecting analytics: we record a small, fixed set of server-side events (e.g. "someone visited the landing page," "someone created an account") so we can understand how the product is being used. IP addresses are one-way hashed before they touch the database. No third-party scripts. No advertising IDs. No cross-site tracking.

What we don't do

We do not sell, rent, or share your data with advertisers — ever.
We do not mine your child's voice recordings to train AI models.
We do not require your child's name or photo to use the app.
We do not show ads anywhere in the app.

Your child's photos and voice

When you record a voice or upload a photo for a tile, that data lives in your account on our server so it can sync across your phone and tablet. You can wipe it any time from Settings → Reset board or by deleting your account in Settings → Danger zone.

Backups and exports

Settings → Backup & restore exports your entire board (every tile, photo, recording) as a single JSON file you can save anywhere. You own this file. It can be re-imported on any device — including yours, if we ever shut down.

Data deletion

One tap in Settings → Danger zone permanently deletes your account, every board, every photo, and every recording. We don't keep "soft-deleted" copies. Once it's gone, it's gone.

AI suggestions

When AI suggestions are turned on, the words currently in your sentence strip are sent to Google's Gemini API to generate the next-word predictions. Tile labels (e.g. "I", "want") are sent — voice recordings and photos are not. You can turn AI off in Settings → AI suggestions at any time.

Kids under 13 (COPPA)

SonSpeak is designed to be set up by a parent, therapist, or caregiver — not the child. The account belongs to the adult. We don't request, collect, or expose anything that would identify a child to anyone outside the household. You can use the app without ever entering your child's real name.

Sub-processors (the third parties we use)

We deliver SonSpeak with help from a small list of named vendors. Each one only sees the minimum it needs to do its job. None of them are advertisers. None of them train AI models on your child's data.

AI provider (for AI suggestions & symbol generation, opt-in): receives only the short text labels currently in your sentence — never voice, never photos, never your child's name. We use API tiers whose published terms exclude using requests to train consumer models. AI suggestions can be turned off at any time.
Resend (transactional email): receives the recipient address and the email body for invites, password resets, and account emails. No marketing email is sent.
Stripe (payments — only when you choose to pay): handles card details directly; SonSpeak never sees them. Children never interact with Stripe.
MongoDB (our database): stores your boards, photos, and recordings until you delete your account.
AbuseIPDB (security only): receives anonymous server IPs of suspicious traffic to block bots. Never receives user data or content.
Google Workspace (inbound email only — for replies to hello@/support@/press@ etc.): receives whatever a parent or therapist types into a reply. Paid Workspace plans contractually exclude consumer-style training on customer data.

We deliberately do not use Google Analytics, ad pixels, social-login trackers, session-replay tools, or any cross-site tracker. We are happy to share our full sub-processor audit with parents, therapists, schools, or counsel on request — just email us.

Questions or requests

Email us at hello@sonspeak.com and we'll get back within two business days. You can request your data, delete your data, or just ask us anything — we read every email.