Privacy Policy

Effective date: 17 August 2026 · На български

This is an English translation provided for convenience; the Bulgarian text governs.

The short version, for you

This section is for you, if you use Epoha Online. The rest is written for your parents, but you can read it too.

• We keep the name you chose, your points, your hearts and which lessons you finished. That is how the app remembers where you got to.
• When you ask "Why?" in a lesson, your question is sent to a Google computer in Europe, which composes the answer. No person reads your question, it is not used to teach the computer, and it is deleted within a day.
• Other players on the leaderboard see a made-up name, for example "Смел лъв" (Brave lion), and your points for the week. Nothing else. Your real name shows only if you switch it on yourself in the settings, and you can hide it again at any time.
• If you are in a classroom, your teacher sees only five things: your name, how many lessons you finished, your gold awards, your streak, and when you joined. The teacher does not see your email and does not see what you ask in lessons.
• If a parent email is set, your parent gets a short letter every Sunday about how much you studied that week.
• You can delete your account yourself from the settings. Then we delete your data.
• If you are under 14, ask a parent to read this page and confirm your account. The law requires this, to protect you.

1. Who is responsible for your data

The controller of personal data is Epoha Online edu Ltd („Епоха Онлайн еду" ООД), EIK/company number 208724534, registered office: Sofia 1612, Krasno selo district, 14 Lerin St., floor 1, unit 2, Bulgaria; contact: tiho@epoha.online.

Epoha Online is an educational app that teaches Bulgarian history to children aged 11 to 14 through short films and questions. It runs on phones (iOS and Android) and in the browser, and the data is stored in Google Firebase (project epoha-online-app).

For all personal data questions: tiho@epoha.online.

2. Children, parents and consent

The app is intended for children aged 11 to 14. Under Bulgarian law (the Personal Data Protection Act), a child under 14 cannot alone give valid consent under Art. 8 GDPR; authorisation by the holder of parental responsibility is required.

That is why we ask for the year of birth at registration:

• A user aged 14 or over registers alone.
• For a user under 14 we ask for a parent's email. We send that address a letter describing the service and the data processed. The account runs in a restricted mode (no notifications, no leaderboard visibility, no parent digest) until the parent confirms by clicking the link in the letter and declares that they hold parental responsibility. We store a record of the confirmation (time, terms version).
• The parent may withdraw the confirmation at any time by writing to tiho@epoha.online. The account then returns to restricted mode or is deleted, at the parent's choice.
• When the child turns 14, they may continue using the account in their own name; we record the transition.

Trial mode without registration: a child may watch one lesson before registering. In trial mode we create an anonymous account (a random identifier with no name or email) and keep only the lesson progress and basic usage events. On registration the trial progress transfers into the new account under the same identifier; the registration (and the parental confirmation for under-14s) covers that transferred history too.

3. What data we process, why, and on what basis

3.1 Profile and game state

Display name, sign-in email, profile picture (only if you sign in with Google and it comes from your Google profile; Apple sign-in provides no picture), chosen subjects, age band (optional), points (XP), hearts, streaks, daily goal, lesson progress, per-fact learning state (for spaced repetition), missed questions, badges, daily activity counters. If you reached us through an advertising link, we record once at registration which campaign the account came from (without tracking your subsequent behavior outside the app). If you sign in with Apple you can hide your email address; in that case we receive a private relay address issued by Apple.

Purpose: providing the service you signed up for: learning, progress, the game economy. Basis: performance of a contract (Art. 6(1)(b) GDPR). For children under 14 the contract is concluded with the parent's involvement (section 2). Retention: for the life of the account.

3.2 The "Why?" AI tutor

When the child taps "Why?" and types a question about the lesson (3 to 200 characters), the question, together with the lesson's facts and the related quiz question, is sent to Google Vertex AI (a Gemini model) running in Google's data centre in Belgium (region europe-west1) to compose an answer. Stated honestly and precisely:

• What the child types is processed by a Google system in the EU to create the answer.
• The text is not used to train models.
• We do not log the question or the answer to analytics or server logs, including on error paths.
• The question record is deleted automatically within 24 hours, and immediately when the account is deleted.
• Answers are generated by artificial intelligence and may contain mistakes. Every answer can be reported by the child with a button in the app. If the child reports an answer, we see that specific question and answer in order to review it, within the 24-hour retention window. The report itself keeps only identifiers and the chosen reason, and is deleted within 30 days.

Basis: performance of a contract (Art. 6(1)(b)): the answer is the very service the user requested by asking. Google acts as a processor under Art. 28, not an independent recipient. We also keep a daily per-user counter of questions (no text), deleted within 7 days.

3.3 Leaderboard and leagues

Every week the app shows a leaderboard with the shown name and the weekly points. The leaderboard is visible to other signed-in users of the app; technically the record also contains the account identifier (a random string, not a name or email).

• By default the leaderboard shows a pseudonym composed by the app (for example "Смел лъв"), not the name the child chose. The real name shows only if the child explicitly switches it on in the settings, and the choice can be reversed at any time.
• We keep past weeks' records for up to 12 weeks, after which we delete them.

Basis: legitimate interest (Art. 6(1)(f)) with the safeguards described, or consent where the parent explicitly enables it. Objection: the pseudonym is the default; if the real name was switched on, it can be switched back off in the settings at any time, or write to us.

3.4 Classroom

A child can join a classroom with a code given by a teacher. The class teacher sees only five fields: display name, number of completed lessons, gold awards, current streak, and join date. This list is enforced technically and checked by automated tests. The teacher does not see the email, the AI tutor questions, the activity history, or anything else. The child can leave the class at any time from the app.

Basis: legitimate interest (Art. 6(1)(f)) in an educational context, with joining initiated by the child. Classes are created only by us on a teacher's request.

3.5 Weekly parent digest

If a parent email is set on the profile, every Sunday we send that address a short report: the child's name, the week's lesson, review and perfect counts, up to two lesson titles, gold, streak, and strongest day.

• We send digests only after the address is confirmed: first we send one confirmation letter and start the digests only after its link is clicked. The confirmation is recorded together with the moment it was given and the version of the policy it was given for.
• The digest can be stopped at any time by removing the parent email from the profile in the app or by writing to tiho@epoha.online.

Basis: for the single confirmation letter: legitimate interest; for the digests themselves: the parent's consent (Art. 6(1)(a)), withdrawable at any time. Records of the sent letters are deleted when the account is deleted.

3.6 Push notifications

If you allow notifications through the phone's system prompt, we store a technical delivery identifier (Expo push token) and send notifications: streak reminders, new content, comeback invitations. The choice of when to send a reminder is based on the hours the account is usually active (see 3.7). Notifications can be switched off in the phone settings at any time.

Basis: consent (Art. 6(1)(a)) via the system prompt; for children under 14 notifications are part of the parental confirmation (section 2). Delivery passes through Expo (see section 4).

3.7 Analytics and the activity profile

We record first-party usage events (screen opened, lesson started, question answered and similar) with the account identifier. The event vocabulary is a closed list of about 35 names; free text is never recorded. Events are deleted automatically after 90 days. We use no external analytics or advertising tools; the data does not leave our database.

We also keep an hourly statistic of when the account is active, used solely to send reminders at a suitable hour. You can object to this profiling by writing to tiho@epoha.online.

Basis: legitimate interest (Art. 6(1)(f)) in improving the product and reasonable reminders, with the right to object under Art. 21.

3.8 Anonymous statistics

Counters with no identifier: how many times a film was watched, which questions get confused, where the video stalls. They are not personal data once written and serve only to improve the content.

3.9 Security and operations records

For fraud protection and operations we keep service records that may contain an account identifier or display name: daily reports, win-back lists, point-anomaly records and service records of granted rewards. Only the administrator has access. Basis: legitimate interest (Art. 6(1)(f)). Retention: see section 6.

3.10 Website forms

If you write to us through the form on epoha.online (name, email, phone, message), we use the data only to reply to you. Basis: steps taken at your request prior to a contract (Art. 6(1)(b)). Retention: up to 12 months after the last contact.

3.11 Backups

We make a daily full backup of the database, kept for 30 days in Google Cloud Storage in the same region as the database. Data of a deleted account can therefore remain in backups for up to 30 days, after which it disappears there too. Restoring from a backup does not resurrect deleted accounts in the live system. Basis: legitimate interest (Art. 6(1)(f)).

3.12 Watching the films (CDN)

Films are delivered through the Firebase Hosting content delivery network. As with any website, Google's servers see the device's IP address in their standard logs when you watch. We keep no record of our own of who watched what beyond what is described in 3.7. Basis: legitimate interest.

4. Who processes data on our behalf

We do not sell data and do not share it with third parties for marketing. Data reaches only providers working on our instructions under a data processing agreement (Art. 28 GDPR):

The Apple and Google app stores process standard install and app performance data as independent controllers under their own policies.

5. Transfers outside the EU

We aim to keep data in the EU: the database and the AI processing are in European regions. Exceptions: Firebase Authentication is a global Google service; compute functions may run on Google Cloud infrastructure outside the EU; notifications pass through Expo in the USA. For those cases the contractual safeguards of the respective provider apply (EU standard contractual clauses or an adequacy decision, including the EU-US Data Privacy Framework where applicable).

6. How long we keep the data

7. Your rights and how to exercise them

For a child under 14 the rights are exercised by the parent; a child aged 14 or over may also exercise them alone.

• Erasure. The fastest path is inside the app itself: the Profile tab, the Delete account button. Deletion is immediate and self-service: it removes the profile and the sign-in, lesson progress and per-fact learning state, badges, AI tutor questions, classroom membership, leaderboard records, parent digest letters and their send markers, and the XP anomaly records. Data disappears from backups within 30 days. The parental confirmation record is kept separately under section 6. The same can be done in a browser at epoha.online/delete-account or by writing to tiho@epoha.online.
• Access and portability. Write to tiho@epoha.online and you will receive a copy of your data in a machine-readable format (JSON).
• Rectification. The display name and settings are editable in the app; for anything else, write to us.
• Objection to processing based on legitimate interest (activity profiling, reminders, analytics): at tiho@epoha.online.
• Restriction of processing: at tiho@epoha.online.
• Withdrawing consent: notifications stop from the phone settings; the parent digest stops by removing the parent email from the profile or by writing to tiho@epoha.online; the parental confirmation is withdrawn by writing to tiho@epoha.online.

We respond within one month. If you are not satisfied, you have the right to complain to the Commission for Personal Data Protection: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., www.cpdp.bg, kzld@cpdp.bg.

8. Data on your device

The app keeps settings and service markers on the device, and when lessons are downloaded for offline use: the lesson's video file and questions. Offline packs are deleted from the app settings. On iPhone, downloaded lessons may end up in the device's iCloud backup (these are educational films, not personal data). Local data is also removed when you delete the app from the device.

9. Security

Data travels only over encrypted connections (TLS). Database access is governed by rules under which each user sees only their own data, and lists involving children (leaderboard, classroom) are limited to what section 3 describes. There are no advertising or external analytics libraries in the app. In the event of a security breach creating risk for you or your child, we will notify the CPDP within 72 hours and the affected parents without undue delay.

10. Changes to this policy

For material changes we will announce the new version in the app and on epoha.online at least 14 days in advance, and where a change affects a child under 14 and requires new consent, we will ask the parent to confirm again. The version history is kept on this page.

11. Contact

Epoha Online edu Ltd („Епоха Онлайн еду" ООД), EIK/company number 208724534, registered office: Sofia 1612, Krasno selo district, 14 Lerin St., floor 1, unit 2, Bulgaria
tiho@epoha.online

Version history

• 17 August 2026: current version
• 15 June 2026: previous version

See also: Terms of Use (Bulgarian)