Parents' Notice: Children's Data Practices

Kudo Kids, LLC (doing business as KudoKids) 4030 Wake Forest Road, STE 349, Raleigh, NC 27609 Email: legal@kudokids.org Phone: (910) 593-7070

KudoKids is designed for children ages 3-12. We collect the following categories of information, all of which require your consent first:

Required for Core Features

• Name and age -- provided by you (the parent), not the child
• Activity data -- task completions, Kudo Coin earnings/spending, game scores
• Routine & reward activity -- per-routine completion records (full or partial credit), per-day routine weight allocations you set, the 100-coin daily allotment consumed, optional hold-challenge outcomes, locked-savings deposits, device-timer sessions, and task-timer events
• Device tokens -- for push notifications (a persistent identifier under COPPA)
• Usage / screen-time data -- which areas of the app your child uses and for how long, recorded by default to power per-child daily screen-time limits. No personal content is recorded. You can adjust or disable this in Settings -> Screen Time Limits and Data & Privacy.
• Cross-household membership -- if your child belongs to more than one family on KudoKids (for example, separated co-parents), we record each household membership so coins, badges, and premium features follow your child between households
• Masked error recordings -- when technical errors occur, a privacy-protected recording of the app screen may be captured. All text, images, and personal content are automatically masked (replaced with blank placeholders) before leaving the device. Only screen layout and tap patterns are recorded to help us fix bugs. Collected under COPPA's internal-operations exception; no separate consent required.

Optional (You Choose)

• Wellness data -- emotion check-ins, personality surveys, meditation sessions
• Social data -- friend aliases, messages between connected children, leaderboard participation
• Speech recognition -- processed by Apple or Google on-device; we do not store audio. KudoKids retains and transmits no biometric identifiers of your child -- speech-to-text is on-device-preferred, and no voiceprint, face template, or other biometric is ever collected, stored, or shared by KudoKids. Face ID / Touch ID, when used, is matched on-device by Apple only and is never collected or readable by KudoKids.

• To operate the app -- tracking chores, managing rewards, running games
• To adjust content for your child's age
• To provide you with reports on your child's activity and progress
• To filter messages for safety (automated content screening)

We do NOT use your child's data for advertising, behavioral targeting, or commercial profiling. We do not sell children's data. We do not display ads to children.

• Supabase -- hosts our database and handles authentication (stores all family/child data)
• Expo -- delivers push notifications (receives device tokens only)
• Stripe -- processes parent payments only; no child data is sent to Stripe
• Apple / Google -- speech recognition processing, on-device (if used)
• Apple StoreKit / In-App Purchase (iOS) -- processes parent purchases only; no child data is sent to Apple
• Sentry -- error monitoring with masked screen-structure capture; all text and images are replaced with placeholders before transmission
• Google Gemini -- generation of non-personalized app content (images/voice); no child data is sent
• Resend -- delivery of parent emails and adult-family-member invitations; no child data is sent
• Apple Quick Look (iOS) / Google Scene Viewer (Android) -- on-device augmented-reality viewers; no camera frames or data are transmitted
• YouTube / Google -- if you add approved YouTube channels or playlists in Safe Browser, approved videos play in a privacy-enhanced embedded player (youtube-nocookie.com) with personalized ads off. When your child watches a video, Google receives standard playback data for that video -- the same data any YouTube viewer generates. We never send your child's name, age, account, or search text to Google.

Each of these service providers is contractually bound to keep your child's information confidential, to use it only to perform the service we have retained them for, and to maintain data-security protections at least as strong as ours.

If you enable family or friend messaging, your child's alias and the messages they send are disclosed to the approved connected families -- that is, to the adults and children in any family you have connected with. We treat the requirement that both children's parents separately approve each connection as your verifiable parental consent for that specific disclosure: no message or alias is shared across families until each side's parent has independently approved the connection. You can disable messaging at any time in Family Settings, which stops this disclosure going forward. Same-family visibility (people you yourself invited into your own family) is not an external disclosure.

Under COPPA, you have the right to:

• Review all data we have collected about your child (via the parent dashboard or by emailing us)
• Delete your child's data permanently at any time
• Refuse further data collection by disabling optional features or deleting the profile
• Export your family's data in JSON format
• Revoke consent at any time, which will result in deletion of associated data

You can manage your child's data directly from the Parent Dashboard in the KudoKids app, or contact us:

Email: legal@kudokids.org Phone: (910) 593-7070 Mail: Kudo Kids, LLC, 4030 Wake Forest Road, STE 349, Raleigh, NC 27609

We will respond within 30 days.

Before collecting any data about your child, we require verifiable parental consent through the app's setup process:

1. You authenticate your identity via email one-time passcode
2. You review a detailed notice describing all data categories
3. You type your full legal name as a digital signature of consent
4. You choose which optional data categories to allow

Augmented Reality (AR) Camera — When enabled by parent, AR uses the device camera on-device only via native OS AR viewers (Apple Quick Look on iOS, Google Scene Viewer on Android). No camera frames are transmitted to KudoKids or to Apple or Google. 3D models stream from our CDN only. Parents can disable AR per-child in Family Settings.

We keep your child's information only as long as needed for the purpose we collected it, and never longer. When you delete your child's profile or revoke consent, we permanently delete the associated personal information. Our retention periods:

We do not retain your child's personal information beyond the time reasonably necessary to fulfill the purpose for which it was collected.

KudoKids maintains a written information-security program with administrative, technical, and physical safeguards reasonable for the sensitivity of children's data and the operations of our business -- including encryption of data in transit and at rest, role- and family-scoped access controls, and routine review of our security practices. We require every service provider that handles your child's information to maintain comparable protections (see "Who Receives This Information").

If you turn on Shared screen-time for a child, that child can start or join a device-timer session with a sibling on one device. Each child's own bank and coins pay for their own seat. When children pick a shared session together, participating siblings can see each other's coin and bank balances so they can choose a length everyone can afford. We record one session ledger entry per child, tagged with which child started it. This stays inside KudoKids and is never shared with third parties. Shared screen-time is off by default and can be turned on or off any time in each child's profile.