This is a pre-release policy. Public enrollment is not open until the final operator name, mailing address, privacy email and telephone are published here.

We use it to operate the family account, deliver quests and rewards, save progress, verify parental consent, protect the adult area, send essential parent messages, prevent abuse and keep the service reliable. We do not use child data for advertising.

Supabase provides authentication, database and server infrastructure. AWS SES sends adult account and consent messages; our messages contain no child nickname or free-text activity. SES may scan and retain email for security, and may retain adult addresses for bounce/complaint suppression. Failed feedback messages may remain in an encrypted, restricted queue for up to 14 days. Cloudflare delivers and protects the web. Optional adult push uses Expo and Apple APNs or Google FCM, with generic text rather than child details. Grafana receives bounded aggregate metrics, not child names, text or family identifiers. Epic Kids Web Services is retired for new verification; existing evidence is retained under the consent retention policy. Provider safeguards, processing terms and safety-retention exceptions must be reviewed before public enrollment.

The current iOS subscription integration uses Apple StoreKit and direct server verification in Supabase. Billing is not yet enabled for public purchases. Apple processes a purchase when available; our server uses its verified transaction and adult account reference to provide family access, without sending child profiles or activity text to Apple. RevenueCat is not a current processor. Optional reading aloud runs through the device operating system: the app does not record the microphone or send text to an app-operated speech service.

When commissioned, our product statistics use a fixed list of daily aggregate counts, such as created quests, completed activities and observed app or payment-page openings. The separate aggregate dataset contains no account, family, child, device, session or transaction identifiers, names, contact details or activity text. It is not a record of individual journeys. Operational authentication and abuse controls still process the existing access credentials separately; infrastructure may process ordinary request metadata. Administrator authorization and security records remain restricted and identity-based. Purchase statistics come from verified store records, not a button press. No session replay, advertising analytics or cross-app tracking is introduced.

Child profiles and collection stay blocked until server-confirmed parental consent is active. Where enabled for the declared US region and reviewed private-service use, Email Plus sends the full direct notice to the signed-in adult’s confirmed email. The adult explicitly confirms parental/legal-guardian status and the described use. In the single-confirmation flow, access then opens immediately and an automatic confirmation email follows 24 hours later with the same notice and withdrawal instructions. No second approval or 24-hour access block is required. Opening an email link alone never activates consent. Failed delivery can pause access; an undelivered follow-up closes access at the seven-day delivery deadline. Earlier two-confirmation requests keep the process described in their original notice. Existing KWS consent evidence is preserved. New purposes or disclosure outside the reviewed internal-service boundary require a new assessment and, where necessary, a different consent method.

A second adult must independently verify their email and accept a private invitation as the child’s parent or legal guardian. This is not an invitation to teachers, coaches, friends or unrelated adults. A PIN or biometric unlock protects the adult area; it does not prove a legal relationship or replace consent. Store age-assurance and guardian-revocation duties are separate from this consent flow.

Detailed completed quest, routine, reward and learning activity is normally removed after 12 months while current XP and coin balances can remain. Notifications are removed after 30 days. Pending child idea proposals are removed after 30 days; decided proposal text after 90 days. An adult-approved published quest follows the activity deadline; a text-free idea association can remain for up to 12 months. Pending Email Plus requests expire after seven days. Minimal consent evidence is retained while active and for up to 90 days after closure. Pairing and expired access records expire sooner; limited deletion evidence remains for up to three years. These rules are enforced by daily cleanup, so expiry and physical purge are not simultaneous. Adult account contact details have their own account lifecycle; a pending consent request does not extend it indefinitely.

Deleting a child or family removes its active database data through linked deletion. Family deletion also creates tracked authentication/provider/backup cleanup tasks. Provider safety records and backups may outlive active deletion. Backup erasure within the documented 35-day window and successful recovery still need operational proof before public launch; a queued task is not proof of completion.

The parent can review and export family data, correct profile details, withdraw consent and request child or family deletion from adult Data Controls or by contacting the operator above. Consent links and the pending setup screen also let the signed-in owner refuse or withdraw Email Plus consent. Withdrawal immediately blocks child access and future collection; it is not a promise that every provider copy or backup is immediately erased. Deletion is a separate explicit action. Limited evidence may remain only for the documented security, legal or deletion-verification purpose.

This product is designed for families and requires a parent or guardian to create the account and provide verified consent before a child profile is created. Native app stores may provide limited age-range or guardian-approval signals. Public availability in a region remains blocked until its required age-assurance, approval and revocation integrations are verified; Email Plus alone does not fulfill those duties. Any such signal is restricted to age-appropriate access, not advertising or analytics. If this policy or a data purpose changes materially, we will explain the change to the adult and request new consent when required.