Kiddo AI — Privacy Policy

Effective Date: February 22, 2026 Last Updated: February 22, 2026

Kiddo AI ("we," "us," or "our") is an AI-powered personalized storybook platform for children ages 2–12, available on iOS and Android. We take the privacy and safety of children and families seriously. This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have.

This policy complies with the Children's Online Privacy Protection Act (COPPA) in the United States, the General Data Protection Regulation (GDPR) in the European Union, and the requirements of the Apple App Store and Google Play Store.

Table of Contents

1. Who This Policy Applies To
2. Information We Collect from Adults
3. Information We Collect About Children
4. How We Use Your Information
5. Third-Party Services
6. Data Sharing
7. Data Retention
8. Data Security
9. International Data Transfers
10. Your Rights
11. Parental Consent
12. Children's Privacy
13. Push Notifications
14. Subscriptions and Payments
15. Changes to This Policy
16. Contact Us

1. Who This Policy Applies To

Kiddo AI is designed for parents and guardians of children ages 2–12. Adults create accounts, manage child profiles, and control all aspects of the app experience. Children do not create accounts or interact with the app unsupervised in any way that involves data collection.

This policy covers:

• Adults (parents and guardians) who create and manage accounts.
• Children (ages 2–12) whose profile data is entered by their parent or guardian.

2. Information We Collect from Adults

2.1 Account Data (Collected During Sign-Up)

We use Google or Apple OAuth for authentication. During sign-up, we receive:

• Email address
• Full name (first and last)
• Google or Apple account identifier

We do not collect or store passwords. Authentication is handled entirely through Google or Apple.

2.2 Profile Data (User-Provided, Optional)

You may choose to provide additional information to personalize your experience:

• Gender (default: not specified)
• Preferred language (English, Turkish, German, French, Spanish, Italian, Japanese, Korean, Portuguese, Russian, or Chinese)
• Country
• Cultural preferences (free text)
• Lifestyle (free text)
• Profile avatar or image

2.3 Device and Technical Data (Collected Automatically)

When you use the app, we automatically collect:

• Device ID — Android ID (Android) or Identifier for Vendor / IDFV (iOS)
• App Install ID — a unique identifier (UUID) generated once per app installation
• Device platform — iOS or Android
• FCM push notification token — only if you grant notification permission
• Session authentication token — a JSON Web Token (JWT) used to keep you signed in

2.4 Data Stored Locally on Your Device

Certain data is stored on your device using local storage (AsyncStorage) and is never sent to our servers:

• Authentication token
• Cached user profile
• Onboarding completion flag
• App settings (language, audio, notification, and theme preferences)
• Story reading display settings (text size, theme, audio volume, child mode settings)

3. Information We Collect About Children

Important: All child data is created, entered, and managed by the parent or guardian — never by the child directly.

3.1 Child Profile Data

Parents provide the following information when creating a child profile:

• Name (required) — used as the character name in stories
• Birth date (required — day/month/year) — used to calculate age for age-appropriate content
• Gender (default: not specified) — used for character gender and pronouns in stories
• Reading level (required) — Parental Read, Beginner, Intermediate, or Advanced — determines story complexity
• Interests (optional) — used to select relevant story topics
• Fears (optional) — used to avoid triggering content in stories
• Sensitivities or special needs (optional) — used for content safety filtering
• Dream jobs (optional) — used for character role customization
• Special skills (optional) — used for character abilities in stories
• Profile photo (optional) — a real photograph uploaded from camera or gallery
• Physical appearance description (optional — text)

3.2 AI-Generated Child Data

When a parent uploads a child's photo, our AI processes it to create:

• A visual profile containing a gender classification, visual description prompt, color palette, and unique visual identifiers (e.g., "blonde hair," "glasses")
• An AI-generated avatar image, stored on our cloud servers (AWS S3)

This visual profile is used to generate the child's character appearance in all future story illustrations. This process is fully disclosed to parents and requires explicit consent before any photo is processed (see Section 11: Parental Consent).

3.3 Child Activity Data

We track the following reading and listening activity per session:

• Reading sessions: story ID, child ID, duration (seconds), pages read, completion status, and timestamps
• Listening sessions: story ID, child ID, duration (minutes), pages listened, completion status, and text-to-speech provider used
• Reading streaks: consecutive days of reading activity
• Aggregated statistics: total stories read, total reading time, average session duration, and weekly trends

This data is used to provide parents with reading analytics and to power gamification features such as milestones and badges.

4. How We Use Your Information

4.1 Adult Data

We use adult (parent/guardian) data to:

• Authenticate and maintain your account
• Personalize your app experience (language, preferences)
• Deliver push notifications (if you have granted permission)
• Process subscriptions and payments
• Provide customer support
• Track app usage events for product improvement

4.2 Children's Data

We use children's data to:

• Generate personalized AI stories where the child is the main character
• Adapt story complexity, vocabulary, and themes based on the child's age and reading level
• Use interests to select relevant story topics
• Use fears and sensitivities to exclude potentially triggering content
• Generate character illustrations that resemble the child (from an uploaded photo)
• Track reading and listening progress so parents can monitor their child's activity
• Calculate reading streaks and achievement milestones

We do not use children's data for advertising, marketing, profiling, or any purpose other than providing the story personalization and content safety features described above.

5. Third-Party Services

We work with the following third-party service providers to operate the app. Data is shared with these providers only as necessary to deliver their specific function.

5.1 Authentication

5.2 Payments and Subscriptions

We do not store credit card numbers or bank account details. All payment data is handled by these processors.

5.3 Push Notifications

5.4 AI and Content Generation

All AI processing is performed on our backend servers. Child profile data is sent to AI providers solely for story and illustration generation.

5.5 Infrastructure

5.6 What We Do NOT Use

• No advertising SDKs or ad networks
• No behavioral advertising or ad targeting
• No third-party analytics SDKs (Firebase Analytics is explicitly disabled)
• No crash reporting SDKs (no Sentry, Crashlytics, or similar)
• No data brokers or data selling

6. Data Sharing

• We do not sell personal data to any third party.
• We do not share children's data for advertising or marketing purposes.
• Data is shared with third-party services only as described in Section 5, solely to provide app functionality.
• Family sharing: Within a family account, all family members (invited by the account admin) can see shared children's profiles, stories, collections, and reading history.
• Public stories: If you choose to make a story or collection public, the story content and your name (if you opt in) will be visible to other Kiddo AI users.
• Ratings and reviews: Story ratings and reviews may be visible to other users. Whether your name is displayed is controlled by a toggle in your settings.

7. Data Retention

If you request account deletion, we will delete your personal data and your children's profile data in accordance with applicable law. Certain data (such as payment records) may be retained where we have a legal obligation to do so.

8. Data Security

We implement the following measures to protect your data:

• Encryption in transit: All data is transmitted over HTTPS.
• No password storage: We use OAuth 2.0 authentication through Google and Apple, so we never store passwords.
• Secure session tokens: JWT session tokens are stored securely on your device.
• Consent-based notifications: Push notification permission requires your explicit consent.
• Content safety: AI-generated content undergoes multi-provider safety review before being made available.
• No tracking: We do not use third-party advertising or behavioral tracking tools.

While we take reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

9. International Data Transfers

Your data may be transferred to, and processed in, countries outside of your country of residence, including the United States. Our third-party service providers — including Google, Apple, AWS, OpenAI, ElevenLabs, Microsoft Azure, and Amazon — operate servers globally.

For users in the European Economic Area (EEA), we ensure that any transfer of personal data outside the EEA is protected by appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission or other legally recognized transfer mechanisms, in compliance with the GDPR.

10. Your Rights

10.1 Rights for All Users (Under GDPR)

If you are located in the European Economic Area or where similar rights apply, you have the right to:

• Access — Request a copy of all personal data we hold about you.
• Rectification — Correct any inaccurate or incomplete data.
• Deletion ("Right to be Forgotten") — Request that we delete your account and associated data.
• Data Portability — Receive your data in a structured, commonly used, machine-readable format.
• Objection — Object to specific processing activities.
• Restriction — Request that we restrict processing of your data in certain circumstances.
• Withdraw Consent — Withdraw your consent for data processing at any time, without affecting the lawfulness of processing carried out before withdrawal.

10.2 Rights for Parents and Guardians (Under COPPA)

As a parent or guardian, you have the right to:

• Review all data we have collected about your child.
• Request deletion of your child's data.
• Refuse further collection of your child's data.
• Be informed about what child data is collected and how it is used.
• Delete child profiles at any time directly through the app.

10.3 How to Exercise Your Rights

You can exercise most of these rights directly within the app (for example, editing or deleting child profiles). For formal data requests, please contact us at hello@kiddoai.net. We will respond to all requests within 30 days.

11. Parental Consent

Kiddo AI is designed so that only parents and guardians can create and manage accounts. Children cannot create accounts or submit data independently.

• Accounts are created exclusively through Google or Apple OAuth authentication, which requires an adult account.
• Before creating the first child profile, parents must provide active consent by acknowledging they have read and agree to our Children's Privacy Policy.
• This consent covers all child data collection described in this policy, including the photo-to-AI-avatar pipeline (processing a child's photo to create a visual profile and AI-generated illustrations).
• Consent is provided once per account and covers all child profiles created under that account.
• Parents may withdraw consent at any time by deleting their child's profile or contacting us at hello@kiddoai.net.

12. Children's Privacy

Kiddo AI complies with the Children's Online Privacy Protection Act (COPPA) and GDPR Article 8 regarding the processing of children's personal data.

For detailed information, please see our separate Children's Privacy Policy, available within the app and at kiddoai.net.

Key commitments:

• We collect children's data only from parents and guardians, never directly from children.
• Children's data is used solely for story personalization and content safety.
• When a parent uploads a child's photo, it is processed by AI to create illustrated story characters. This is fully disclosed and consented to before any photo is collected.
• We never share children's data with advertisers or data brokers.
• Parents can review, modify, or delete all children's data at any time through the app.
• We do not condition a child's participation in any activity on the disclosure of more personal information than is reasonably necessary.

13. Push Notifications

• We request notification permission explicitly before sending any push notifications.
• If you decline, no notifications are sent and no FCM token is collected.
• Types of notifications: story completion alerts, milestone unlocks, shared story updates, reading streak milestones, illustration-ready alerts, reading reminders, new feature announcements, subscription alerts, and family invitations.
• You can enable or disable notifications and reading reminders at any time in the app settings.

14. Subscriptions and Payments

• Subscription tiers: Free and Plus (paid).
• Billing periods: Monthly, Quarterly, or Yearly.
• Payments are processed through the Apple App Store, Google Play Store, or Stripe. We do not process payments directly.
• RevenueCat manages subscription lifecycle operations including entitlements, renewals, and cancellations.
• We store: payment amount, currency, transaction status, payment method type, and transaction ID.
• We do not store credit card numbers or bank account details — these are handled entirely by the payment processors listed above.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app. The "Last Updated" date at the top of this document will be revised accordingly.

Your continued use of Kiddo AI after any changes to this policy constitutes your acceptance of the updated terms. We encourage you to review this policy periodically.

16. Contact Us

If you have any questions about this Privacy Policy, your data, or your rights, you can reach us through any of the following channels:

• Email: hello@kiddoai.net
• Website: kiddoai.net
• Instagram: @kiddoaiapp
• In-App: Menu → Contact Us

© 2026 Kiddo AI. All rights reserved.