Privacy policy

1. Who is responsible

The controller of the personal data described here is the company that publishes and sells Kidventures. Its name, address and registration details are in section 1 of our Terms of use.

Contact for any privacy question: hello@kidventures.app.

2. Who this policy covers

This policy covers the grown-ups who create or join a family space (parents, co-⁠parents and caregivers), the children whose profiles they add, and the visitors of our website.

The legal bases below are those of the EU and UK General Data Protection Regulation (GDPR, article 6). Where another law applies to you, we process the same data for the same purposes under that law.

3. What we collect, why and for how long

• Website visits: IP address, browser type, page requested and time, processed by our host to deliver the page and protect the site. Legal basis: legitimate interest in running a secure site. Kept only as long as our host's service needs them.
• Visit counting (our own, without cookies): when you open a public page, we record the page, its language, the site you came from, campaign tags in the link, the country (worked out from your IP address, which we do not keep), the device type (phone, tablet or computer) and a visitor code. While a page stays open, it also sends a short signal every 30 seconds, so we know how many people are on the site at a given moment. The code is a one-way hash of your IP address and browser made with a key that changes every day and is never stored: it lets us count unique visitors per day, but not recognise you from one day to the next or recover your IP address. Nothing is stored in your browser. In the grown-up space we count, the same way, the type of screen that is open and a family code made with the same daily key: it lets us count active families per day without recognising a family from one day to the next. We do not count browsers that send Do Not Track or Global Privacy Control, bots, or the kid screens. Legal basis: legitimate interest in knowing which pages help families. Page views and signals are deleted after 90 days; after that we keep only daily totals per page, language, country, source and device type, which contain no visitor or family code.
• Read-aloud counting on kid screens (our own, anonymous): when a kid taps Listen, the kid screen tells our server that Noki's recorded voice or the device voice started, finished or failed. We record which quest from our library was read (for a quest you wrote, only that it is your own quest, never its text; for Noki's short phrases, which phrase), the language, the voice used, how long it played, why it failed if it did, the date and hour, and whether it ran on the website or in the iPhone and iPad app. The family becomes a code made with a key that changes every day, so we cannot recognise a family from one day to the next. We store no kid id, name, birth date, IP address or browser details, and no third party receives this count. Browsers that send Do Not Track or Global Privacy Control are not counted. Purpose: to improve the read-aloud feature and fix errors, such as a recording that does not load. Legal basis: legitimate interest in making read-aloud work well for kids. Hourly counts are deleted after 90 days; after that we keep only daily totals, which contain no family code.
• Grown-up account: email address, the name you choose, your language, sign-in codes and sessions. If you sign in with Google, we receive your name and email from Google. Legal basis: contract. Kept while your account exists.
• Family and children: for each kid, a first name or nickname, a birth year, plus a birth month and day only if you add them (or an age band for kids added earlier), the avatar you pick from our set, and their quests, completions, stars, rewards and goals. Also the chores and rewards you create and your parent PIN, stored only as a secure hash. You enter this data as the kid's parent or caregiver. Legal basis: contract with you, to provide the service you asked for. Kept while your family space exists, then deleted.
• Setup answers: what would help at home and an optional short text. We ask you not to write health details. Legal basis: contract. Kept while your family space exists.
• Product events: grown-up actions such as sign-up, setup steps, first chore assigned, first approval and return visits, stored without kids' names, to understand where families get stuck. Legal basis: legitimate interest in improving Kidventures. Kept at most 24 months.
• Product analytics and session recording (PostHog): on our website, the sign-in pages, the setup and the grown-up space, we use PostHog to see how Kidventures is used and where families get stuck. It records the pages and screens opened, taps, scrolling, errors and loading times, and a recording of the session that can include what is shown on screen and what you type, such as the names of kids, grown-ups and the family, chores and rewards. Passwords, sign-in codes, the parent PIN and invitation links are never recorded, and page addresses are sent without their query. When a grown-up is signed in, this data is linked to the account: account id, email, family name, language, plan, number of kids and grown-ups, the day the family started, and website or iPhone and iPad app. Our server also reports actions such as a chore added, a quest ticked or a reward approved, without any free text. PostHog never runs on kid screens, on the profile picker of a shared device, in our back office or on invitation pages. Legal basis: legitimate interest in understanding and improving Kidventures. You can object at any time by writing to hello@kidventures.app, and we then delete your PostHog data. Events are kept up to 1 year and session recordings for the period our PostHog plan allows, currently 30 days.
• Security records: sensitive actions such as PIN changes, invitations and deletions, to keep accounts safe. Legal basis: legitimate interest in security. Kept at most 12 months.
• Contact messages: your name, email, topic and message. Legal basis: legitimate interest in answering you. Kept 3 years after the last exchange, unless a legal claim needs longer.
• Payments, once Kidventures Plus is on sale: from our payment provider Stripe, your email, country, plan, amounts, taxes, invoice and transaction ids and status. We never see your full card number. Legal basis: contract and legal obligation. Accounting records are kept as long as tax law requires (7 years in the United Arab Emirates).
• Service emails: sign-in codes, invitations, receipts and notices about changes to these terms or prices. Legal basis: contract and legal obligation.
• Reminders and notifications: your notification choices (the daily reminder time, the approval and weekly emails) and the dates the last reminders went out. The daily reminder goes out only on days when quests are still open or wait for your OK, and pauses after 7 days without activity in your family. If you turn on notifications on a device, we keep what that device gives us to reach it: in the iPhone and iPad app, its Apple notification token; in a browser, the address of the browser's push service and its encryption keys. Legal basis: contract. Kept until you turn notifications off on that device or sign out there, or until the push service tells us the address no longer works. If you create an account but no family space, we send at most 2 reminders to finish it, each with a link to stop them; legal basis: legitimate interest in helping you start. Every reminder email has a link to stop it in 1 click.
• Getting started tips: after you create a family space, each parent receives a short series of 5 emails with tips, 1 a morning during the first days. We keep the step reached and the date of the last tip. Legal basis: legitimate interest in helping you start. The series ends by itself, or after 7 days without activity in your family, and you can stop it anytime with the "Stop tips" link in each email or in Family, Settings.
• Founding families: if your family holds a founding place, we keep its number, its status, the dates it was claimed, a notice was sent or it ended, and why it ended. We use the activity your family already records (quests, stars, rewards, setup steps) to see whether the place is still used, and we email the family owner before a place may be released. Legal basis: contract. Kept while your family space exists.
• Email opens and clicks: our service emails contain a tiny invisible image and links that pass through www.kidventures.app, so we can see whether an email arrived, was opened and which of our links was clicked (the time of the first open and click, how many, which link, and whether the open came from Apple Mail's privacy proxy). We measure this ourselves: no third party receives it, and our email provider's own open and click tracking is off. Sign-in links and unsubscribe links are never tracked. Legal basis: legitimate interest in knowing that our emails arrive and are useful. Kept with our record of each email we send (template, language, delivery status and a one-way code of your address; we never store the address there). Turning off images in your email app stops the open measurement.
• Analytics, only if you accept: Google Analytics 4 on our public pages, loaded only after you accept, never in the app and never on kid screens. Before that, no Google script runs and nothing is sent to Google. Page addresses are sent without ids. Legal basis: consent, which you can withdraw at any time; we then remove the Google Analytics cookies. Data kept 14 months by Google Analytics.

We make no automated decision that has legal or similar effects on you, and we build no profile of you or your children for marketing.

4. Children's privacy

Kidventures is used by children, but it is run by grown-ups. Kids have no account, no email and no password. A grown-up adds each kid and controls everything the kid sees.

We collect only what a grown-up enters for a kid and what the kid does in the app (quests done, stars, reward requests). We ask for a birth year; a birth month and day are optional. Photos are optional and only a parent adds them (see Kid photos). We do not ask for a school or an address.

Kid screens show no ads, no chat, no purchases and no links to other sites. They load no analytics tool, no third-party script and no AI, and they are never recorded. The only usage they report is the anonymous read-aloud count described in the section on what we collect: when a kid taps Listen, which library quest was read, without the kid's name or the words of your own quests.

A device handed to a kid opens with a short-lived kid pass (up to 12 hours) that only reaches that kid's quests, shop and reward requests. The grown-up space needs the parent PIN or a fresh sign-in.

We never use children's data for advertising, never sell it and never build marketing profiles from it.

Grown-up accounts are for adults only. If we learn that a child created a grown-up account, we delete it.

A parent or legal guardian can see, correct, export or delete a kid's data at any time by writing to hello@kidventures.app from the email of the family account. A kid old enough to exercise their own rights can also write to us. Before we share or delete a kid's data, we take the kid's rights and interests into account.

5. AI suggestions for grown-ups

Some features suggest chores, rewards or a starter week to grown-ups. To do this we send our AI provider, Anthropic, only what it needs: kids described as "Kid A, age 6 to 8", the priorities you chose and items from our chore library.

We never send kids' names, birth dates or free text that contains health details. Anthropic processes the request to return the suggestion, as our processor, and under its commercial terms does not train its models on it.

If we change AI provider, we update this policy first.

6. Noki, the assistant

Noki answers questions on our website and in the grown-up space. In the grown-up space it can also make changes for you, such as adding a quest, giving stars or setting a reward, through the same checks as the screens. Kid screens have no Noki.

What we send to our AI provider: the message you type, the earlier messages of the same chat (12 at most), the language and the page on screen, and in the grown-up space a short summary of your family: each kid as a code (K1, K2...) with an age, today's quests and stars, and the quests, rewards and requests Noki looks up to answer you. Before anything leaves our servers, we replace your kids' names with these codes and remove email addresses; Noki's answer gets the names back on your screen. We never send invitation links, sign-in details or payment details. Please do not type health details or other sensitive information in the chat.

Anthropic, PBC processes these requests as our processor to write Noki's answer. Under its commercial terms it does not train its models on them. Anthropic keeps requests for a limited time (up to 30 days) to detect abuse, then deletes them.

What we keep: the chat stays in your browser tab only and disappears when you close the tab or tap New chat. On our servers we keep for 30 days the changes Noki proposed or made (which action, its settings and whether you confirmed it), so that Confirm and Undo work and we can look into errors, and a count of messages per family and day with the tools used and the cost, without any text.

Every change that moves stars, removes something or invites someone waits for your Confirm. A family can send a limited number of messages a day. Legal basis: the performance of our contract with you (Noki is part of the service) and our legitimate interest in preventing abuse.

7. Kid photos

Photos are optional. A parent of the family may add photos of a kid (5 at most per kid) and turn them into cartoon pictures in a style we prepared, such as a superhero or an astronaut (30 pictures at most per kid). A photo or a picture may become the kid's avatar in the app. Only the grown-ups of the family and the kid see them, and only inside the app.

When you add a photo, our servers remove the location, the camera details and every other metadata, and keep a smaller copy (1024 pixels at most) in private storage in the European Union (Supabase, Paris). Each photo is shown through a link that works for 5 minutes and only for members of the family. Photos never appear in emails, notifications, our analytics or session recordings, and Noki, the assistant, never sees them.

When you ask for a picture, we send that photo and the chosen style, with no name and no other detail of the family, to our image partner Scenario, Inc., as our processor. Scenario has the picture drawn by an image model of OpenAI, its subprocessor, sends it back to us, and we delete the photo and the picture at Scenario as soon as the job ends. OpenAI does not use these requests to train its models and may keep them for up to 30 days to detect abuse. We never use photos to train models, never share them with anyone else and never use them for advertising.

We keep photos and pictures until a parent deletes them (each has a Delete button, effective at once) or the family is deleted. A photo sent but never finished is deleted within 2 hours. For each picture request we keep the date, the style, the cost and whether it worked, without any image, to apply the monthly limit and watch costs.

Legal basis: your consent, given by a parent or guardian with a tick box before the first photo and again before the first picture. You can withdraw it at any time by deleting the photos. The data export of Family settings lists the photos and pictures stored.

8. Who helps us

We use these service providers. They process data only on our instructions.

• Supabase, Inc.: database and sign-in, including the visit and read-aloud counts. Data stored in the EU (Paris region).
• Vercel Inc.: hosting of the website and the app. App servers in the Paris region, with a global network that delivers pages.
• Resend, Inc.: sending sign-in codes and service emails.
• Push services of the device makers and browsers (Apple for iPhone, iPad and Safari, Google for Chrome and Android, Mozilla for Firefox, Microsoft for Edge): they deliver the notifications you turned on. Browser notifications are encrypted, so the push service cannot read them.
• Anthropic, PBC: AI suggestions for grown-ups and Noki, the assistant, as described above.
• Scenario, Inc.: drawing the cartoon pictures a parent asks for from a kid photo, with an image model of OpenAI as its subprocessor, as described in Kid photos. Each photo is deleted there once the picture is made.
• Gandi SAS: domain name and the mailbox where emails to hello@kidventures.app arrive.
• PostHog, Inc.: product analytics and session recording of the website, sign-in, setup and the grown-up space, as described above. Data stored in the EU (Frankfurt).
• Google LLC: only if you choose Google sign-in, and Google Analytics only if you accept it.
• Stripe: payments, once Kidventures Plus is on sale. For some purposes, such as fraud prevention and its own legal duties, Stripe acts as an independent controller under its own privacy policy.

We share data with authorities only when the law requires it. If Kidventures is sold or merged, the data passes to the new owner under this policy, and we tell you first.

9. Where your data goes

Our database is in the European Union. We operate from the United Arab Emirates, and some providers above may process data in other countries, such as the United States.

For each transfer that the GDPR restricts, we rely on an adequacy decision of the European Commission (such as the EU-⁠US Data Privacy Framework for certified companies) or on the Commission's standard contractual clauses. Write to us to learn the safeguard used for a named provider.

10. Your rights

You can ask to access, correct or delete your data and your kids' data, to restrict or object to its use, and to receive it in a portable format. You can withdraw your consent at any time, which does not affect what we did before.

Write to hello@kidventures.app from the email of your account. We answer within 1 month.

You can also complain to the data protection authority of the country where you live or work.

11. Security

Every connection is encrypted (HTTPS). Database rules let a family see only its own data. The parent PIN is stored as a hash and locks after 5 wrong tries. Access to our systems is limited to the people who run Kidventures.

12. Changes to this policy

We update this policy when our processing changes. Each version shows its number and date. Before a material change applies, we tell account holders by email.