Privacy Policy

Last updated: July 16, 2026

Digital Mundo, LLC, a Delaware limited liability company doing business as SpeechTherapyMagic (“we,” “us,” or “our”), operates the website, applications, and services covered by this Privacy Policy (the “Service”). This policy describes the information we collect, why we use it, and when it may be disclosed.

Information we collect

Adult accounts and business activity

We may collect an adult user's name, email address, hashed password, Google authentication identifiers, account role, organization or practice information, plan and subscription status, billing and transaction records, seller or creator profile, Stripe Connect onboarding and payout status, marketplace purchases and sales, support messages, feedback, and communications preferences. Payment card and bank-account details are handled directly by Stripe rather than stored as raw credentials by us.

Child profiles and practice activity

An adult may enter a child's first name or nickname, age or grade, target sounds, goals, group or assignment information, and other profile or practice details. The Service may also collect games and activities used, responses, scores, accuracy, duration, progress history, generated content, downloads, and the adult's notes or other free text. Please do not enter full names, diagnoses, treatment records, or other identifying clinical information that is not necessary to use the Service.

Voice, AI, and generated content

When pronunciation tools are used, raw audio and expected text are sent to SpeechAce for processing. We receive and store derived information such as pronunciation scores, phoneme feedback, attempts, and practice history. We do not promise that raw audio is never retained by a provider; provider handling is governed by its service configuration and terms.

OpenAI may process free-text prompts, character descriptions, themes, target sounds, age or grade settings, generated text, text submitted for moderation, and text sent for text-to-speech. Uploads or recordings may also be transmitted to a provider when a feature requires them. Users must not submit protected health information (PHI) or identifying clinical information to these features.

Device, network, and usage information

We and our service providers may collect IP address, browser and device type, operating system, page or route, timestamps, referring page, campaign or attribution parameters, cookie and session identifiers, approximate location derived from IP address, feature interactions, performance information, and error diagnostics. We use cookies, session storage, and local storage for sign-in, security, preferences, feature state, attribution, and analytics.

How we use information

  • Operate, personalize, secure, troubleshoot, and improve the Service.
  • Provide practice activities, progress history, scoring, AI content, downloads, and text-to-speech.
  • Authenticate users and manage accounts, subscriptions, payments, marketplace purchases, sellers, and payouts.
  • Respond to support and feedback, send service communications, and investigate misuse or security issues.
  • Measure public-site engagement and attribution, and monitor Service performance and product reliability.
  • Comply with law and establish, exercise, or defend legal claims.

We do not sell personal information or use children's personal information for behavioral advertising.

Service providers and disclosures

We disclose information to providers when reasonably necessary for their services. Depending on the feature and information a user enters, this can include personal information or child-related practice data. Current provider categories include:

  • SpeechAce processes raw pronunciation audio and expected text to return pronunciation scores and feedback.
  • OpenAI processes prompts, story and character descriptions, themes, text-to-speech text, moderation inputs, and other content used for AI-enabled features.
  • Stripe and Stripe Connect process subscription, payment, seller onboarding, payout, tax, and fraud-prevention information.
  • Cloudflare, DigitalOcean, and Laravel Forge support application hosting, delivery, security, and file storage.
  • Resend processes adult contact and account context for onboarding and marketing drip emails. Mailgun handles transactional account and service emails. Brevo handles contact-form delivery and may process adult contact attributes for configured marketing automation or contact sync, including email, name, plan tier, account role, signup date, and whether the adult account has student profiles.
  • Google processes authentication information when an adult chooses Google OAuth.
  • PostHog provides analytics only on public marketing, legal, and account-access pages, including automatic page views. It may receive current URL or route, permitted page interactions, referrer and campaign information, device and browser details, IP-derived information, and persistent analytics identifiers. It does not initialize on direct dashboard visits, events from nonmarketing routes are rejected, and session recording is disabled.
  • Sentry receives application diagnostics such as error details, page or route, device and browser information, IP address, and related technical context.
  • Linear receives support or feedback content and related account or technical context when needed to manage requests and issues.

External embedded games are displayed through third-party frames or websites. Their hosts, including services such as Replit, may receive IP address, browser and device details, cookies or identifiers, and any information entered directly into the embedded game. Third-party terms and privacy policies apply to those services.

We may also disclose information when required by law, to protect users or the Service, in a business transaction, or at an adult user's direction. See our Subprocessors and Third-Party Services page for more detail.

Children's privacy

Adult account holders create and manage profiles. Information an adult enters about a child is collected from that adult. When a child uses the Service, child-originated use may collect voice recordings, activity responses, scores, practice history, and persistent identifiers such as cookies, session identifiers, or device and IP information.

The Service does not claim COPPA certification. Creating a profile by itself is not represented as Digital Mundo, LLC's verifiable parental consent mechanism. Depending on how an organization, practitioner, or family uses collection features, separate direct notice to a parent and verifiable parental consent may be required before a child uses voice, activity-tracking, persistent-identifier, or other collection features. Digital Mundo, LLC remains responsible for the duties that apply to it as operator of the Service. Adults and organizations also remain responsible for notices, consents, authority, and records that applicable law requires from them; this allocation does not waive or transfer the operator’s duties.

A parent or guardian may contact us to request access to, correction of, or deletion of information associated with a child and may refuse further collection. We may verify the requester's identity and authority before acting.

Data retention and security

We retain information for as long as reasonably necessary to provide the Service, maintain required business and transaction records, comply with law, resolve disputes, enforce agreements, and protect the Service. Retention varies by data category, account status, provider, and legal obligations. Backups, logs, and records required for fraud prevention, tax, accounting, or legal purposes may remain after an account request.

We use reasonable administrative, technical, and organizational safeguards. No transmission or storage system is completely secure, so we cannot guarantee absolute security.

Access, correction, and deletion requests

Adult account holders, parents, guardians, and authorized organizations may request access to, correction of, or deletion of relevant information by emailing hello@speechtherapymagic.com or using our contact form. We may verify identity and authority, and may retain information where permitted or required by law. Some information can be reviewed or edited within the Service where the applicable controls are available.

HIPAA-regulated workflows

Digital Mundo, LLC does not enter into Business Associate Agreements for the Service. The Service is not intended for a covered entity's or business associate's HIPAA-regulated workflow, and users must not upload or enter PHI or identifying clinical records into the Service.

Changes and contact

We may update this policy and will post the revised date on this page. Questions or privacy requests may be sent to hello@speechtherapymagic.com or through our contact form.