Summary
1. Who we are
Mechoon (the "Service") is a robotics and artificial intelligence learning platform operated by Teclox (Private) Limited, a private limited company incorporated in Sri Lanka ("Teclox", "we", "us" or "our"). Teclox is the data controller responsible for personal information processed through the Service, and the "operator" of the Service for the purposes of the U.S. Children's Online Privacy Protection Act (COPPA).
This policy applies to our website, the Mechoon web app, the admin and support processes behind it, and the Mechoon Live Link firmware. It should be read together with our Terms of Service.
2. Children's privacy
Mechoon is designed for children aged 8 and over to use under the supervision of an adult. We take children's privacy seriously and follow the principles of COPPA, the GDPR (including Article 8 on children's consent), the UK Age Appropriate Design Code and Sri Lanka's Personal Data Protection Act, No. 9 of 2022 (PDPA).
How we protect children
- Adult-only accounts. Only a person aged 18 or over can create an account. When registering, the adult confirms their age and that they are the parent, legal guardian or teacher who will manage the account and supervise any child who uses it. Children must not create their own accounts.
- No personal information from children. The Service does not ask a child to enter their name, email address, phone number, photo, school, location or any other contact information. Robot projects, programs and practice results that a child creates are stored under the adult's account.
- No public profiles or chat. Mechoon has no public profiles, messaging between users, social features or public sharing that could expose a child's information.
- No advertising or tracking. We do not show advertising, use behavioural advertising, build profiles of children, or allow third-party trackers on the Service.
- On-device camera and voice features. See section 5. Video is processed on the device and is never sent to us.
- Data minimisation. We collect only what is reasonably necessary for a child to take part in the learning activities.
Parental consent and parental rights
Because the account is opened by the parent, guardian or teacher, that adult provides consent on the child's behalf and controls the account. A parent or guardian can at any time:
- review the information held in the account, including the child's robot projects (Account > Privacy & data > Download my data);
- ask us to correct it, or delete individual projects in My Projects;
- refuse further collection by stopping use of the Service, and have all of the account's data deleted (Account > Privacy & data > Delete my account), or by contacting us at .
Schools and teachers
When a school or teacher creates an account for a class, the school acts on behalf of parents and is responsible for obtaining any parental consent or notice that applies to it under local law or school policy. Teachers should not enter students' personal information. We use information from school accounts only to provide the Service to the school and never for any commercial purpose unrelated to the school's use.
If we learn a child has given us personal information
If we discover that a child under 13 (or under the age of digital consent in their country, which is up to 16 in the European Union) has created an account or given us personal information without the involvement of a parent or guardian, we will delete that information promptly. If you believe this has happened, please contact us at .
3. Information we collect
| Category | What it includes | Source |
|---|---|---|
| Account details | The adult's name, email address, account type (parent, teacher, school or adult learner), optional mobile number and optional school or organisation name. Your password is handled by our authentication provider and we never see it. If you use Google sign-in, we receive your name and email address from Google. | You |
| Consent record | The date and version of the Terms and Privacy Policy you agreed to, and your confirmation that you are an adult. | You |
| Device information | A random device identifier created by the app, a device label (for example "Windows · Chrome") and the first and last time each device was used. We use this only to manage the number of devices allowed by your plan and to prevent repeated free trials. | Your device |
| Learning content | Robot designs, block programs, project names, Academy progress and what the robot learned by practice. These are stored on your device and, when signed in, backed up to your account. | You and the child you supervise |
| Plan and payment records | The plan you request, number of devices, amount, payment reference code, an optional note and the photo or PDF of the bank slip you upload (which may show the payer's name, bank and part of an account number). We do not collect or store card numbers or online banking credentials. | You |
| Support messages | What you send us by email, phone or WhatsApp. | You |
| Technical and security data | IP address, browser type, sign-in times and error logs processed by our hosting and authentication provider to deliver the Service and protect it from abuse. | Automatically |
We do not collect precise location, contacts, advertising identifiers, biometric data, or recordings of camera images or voice.
4. How and why we use information
We use personal information only for the purposes below. Where the GDPR or the PDPA applies, we rely on the legal bases shown.
| Purpose | Legal basis |
|---|---|
| Create and run your account, save and back up projects, and provide the learning features | Performance of our contract with you |
| Check bank transfers, activate plans, issue receipts and manage device seats | Performance of contract; compliance with legal obligations (tax and accounting) |
| Keep the Service secure, prevent fraud and repeated free trials, and fix errors | Our legitimate interests in a safe and reliable service |
| Answer support requests and send essential service messages (for example about your plan or changes to this policy) | Performance of contract; legitimate interests |
| Record your agreement to our Terms and this policy | Compliance with legal obligations; legitimate interests |
| Comply with law, respond to lawful requests and enforce our Terms | Compliance with legal obligations; legitimate interests |
We do not use personal information for advertising, sell it, rent it or share it for cross-context behavioural advertising. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. We will only send marketing messages if you have separately opted in, and never to children.
5. Camera, microphone and AI features
Some optional activities use the camera, the microphone or artificial intelligence. They are switched on only when you choose to use them, and your browser asks for permission first.
- Camera ("Robot eyes" and the teachable camera). Object recognition and the examples you teach run entirely inside your browser. Video frames are not uploaded to Teclox. The first time you turn on the camera, the browser downloads the open-source recognition software (TensorFlow.js models) from public content delivery networks (jsDelivr and Google), which receive your IP address as part of that download.
- Voice commands. Speech recognition uses the speech service built into your web browser. In some browsers (for example Google Chrome) the audio is sent to the browser maker's servers to be turned into text, under that company's privacy policy. Teclox does not receive or store any audio. Speech output is generated on your device.
- Offline AI ("Buddy"). The built-in AI works on your device without any internet connection or account.
- Optional cloud AI. An adult may choose to connect a cloud AI provider (such as Anthropic Claude, Google Gemini or an OpenAI-compatible service) by entering their own API key. The key is stored only in your browser on that device. When the cloud AI is used, the text prompt (and, for the "ask AI about the camera picture" block, a single camera picture) is sent directly from your browser to the provider you chose. It does not pass through Teclox, and that provider's terms and privacy policy apply. Please only enable cloud AI if you are comfortable with the provider's practices, and supervise children when they use it.
- Live Link and Web Serial. Connecting a real robot by USB happens locally between your browser and the robot. No data is sent to us.
6. Who we share information with
We share personal information only with the following, and only as needed:
- Service providers (processors). Google Firebase (Google LLC and its affiliates) provides our authentication, database and web hosting. Our database is located in Google Cloud's asia-south1 (Mumbai, India) region. If email notifications are enabled, emails are delivered through a Firebase email service. These providers act on our instructions under data processing terms and may not use your information for their own purposes.
- Authorised Teclox staff who need access to activate plans and provide support. Administrative actions are recorded in an audit log.
- Authorities when required by law, a court order or to protect the rights, property or safety of our users, the public or Teclox.
- A successor if Teclox is involved in a merger, acquisition or sale of assets, in which case this policy will continue to protect your information and we will tell you before it becomes subject to a different policy.
We never sell or rent personal information, and we do not share it with advertisers or data brokers.
7. International transfers
Teclox is based in Sri Lanka and our database is hosted in India. Our service providers may process data in other countries. When personal information of people in the European Economic Area, the United Kingdom or another region with transfer rules is transferred abroad, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses included in our providers' data processing terms, and on the cross-border transfer rules of the PDPA.
8. Cookies and storage on your device
Mechoon does not use advertising cookies, analytics cookies, social media pixels or any other tracking technology. Fonts and icons are served from our own website, so loading a page does not contact third-party font or analytics services.
The app stores the following on your device using your browser's local storage and IndexedDB. Each item is strictly necessary to provide a feature you asked for, so under the EU ePrivacy rules no consent banner is required. We show a short notice instead.
| Item | Purpose | How long |
|---|---|---|
firebase:authUser… (IndexedDB) | Keeps you signed in | Until you log out |
mechoon.device | Random device identifier for device seats and the one-trial-per-device rule | Until you clear site data |
mechoon.ent, mechoon.settings | Remembers your plan and prices so the app opens quickly and works offline for up to 7 days | Until you log out or clear site data |
robolab.* | Your robot projects, settings and preferences (for example HD graphics), and any AI key you entered | Until you delete them or clear site data |
mechoon.notice | Remembers that you have seen the privacy notice | Until you clear site data |
You can remove all of these at any time by clearing this website's data in your browser settings. Projects that are not backed up to your account will be lost if you do.
9. How long we keep information
- Account details, devices, consent record and cloud projects: for as long as your account is open. When you delete your account, they are deleted from our live database immediately and from our providers' backups within their normal backup cycle (typically within 30 days).
- Plan and payment records (including bank slips): kept for as long as Sri Lankan tax and accounting law requires us to keep financial records, and then deleted. These records are retained even if you delete your account.
- Support messages: up to 2 years after the conversation ends, unless needed longer to resolve a dispute.
- Security logs held by our providers: according to their standard retention periods.
10. How we protect information
We use industry-standard safeguards appropriate to the sensitivity of the data, including encryption in transit (HTTPS/TLS), encryption at rest by our hosting provider, database security rules that let each user read only their own data, restricted administrator access, and an audit log of administrative actions. No online service can be completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the relevant authorities as required by law, including within 72 hours where the GDPR applies.
11. Your rights
Depending on where you live, you have some or all of these rights over your personal information:
- Access a copy of your information, and portability to receive it in a machine-readable format (Account > Privacy & data > Download my data).
- Correction of inaccurate information (you can edit your name, phone and organisation in Account settings).
- Erasure of your information (Account > Privacy & data > Delete my account).
- Restriction of, or objection to, certain processing, including processing based on our legitimate interests.
- Withdraw consent at any time, without affecting processing that took place before.
- Complain to a data protection authority, such as the Data Protection Authority of Sri Lanka, your local supervisory authority in the EU or EEA, or the UK Information Commissioner's Office.
To use a right that is not available in the app, contact us at . We may need to verify your identity, and we will reply within one month (or the shorter period your local law requires). We will not discriminate against you for exercising your rights.
12. Changes to this policy
We may update this policy when our Service or the law changes. The date at the top shows the latest version. If we make material changes, we will tell you in the app and ask you to review and accept the new version before you continue using your account. We will obtain fresh parental consent where the law requires it.
13. Contact us
Questions, requests or complaints about privacy can be sent to our privacy team: