Privacy Policy

Kudo Kids, LLC ("we," "us," or "KudoKids") operates the KudoKids app — on mobile devices and on the web — and the website at kudokids.org (collectively, the "Service"). KudoKids is a digital wellbeing platform for children ages 3-12.

Because our Service is directed to children under 13, we comply with the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. sections 6501-6506, and the Federal Trade Commission (FTC)'s COPPA Rule, 16 CFR Part 312, including the April 2025 amendments. This Privacy Policy describes what personal information we collect from parents and children, how we use and share it, how long we keep it, and what rights you have.

If you have questions about this policy, contact us at privacy@kudokids.org.

Kudo Kids, LLC 4030 Wake Forest Road, STE 349 Raleigh, NC 27609 United States Phone: (910) 593-7070

Privacy inquiries: privacy@kudokids.org

When a parent or legal guardian creates an account and manages the family, we collect:

• Account credentials: Email address (used for authentication via one-time passcode) and optional display name.
• Email preferences: The choices you make about the email we send you. We send emails about your account and the services you use. We also send a few product emails that are on unless you turn them off, such as a short note when we release a new version of KudoKids, help getting set up, and occasional check-ins asking how things are going. Release notes are on for accounts created after we made this change; accounts that existed before then keep the setting they had. We send tips, other product news, and promotional offers only if you opt in. Every email that is not about your account includes a link to your email preferences, and you can change any email preference, or withdraw any email opt-in, at any time in the app's Settings. We never override a choice you have recorded.
• Contact details (optional): A first and last name, and an optional phone number, that you can add in Settings → My Profile. If you are an owner or admin of your family, your name and phone number, and messages and game invites you exchange with them, can be shared with another family's owner and admin guardians when an adult in each family has approved a friendship between your children (see Section 8).
• Parent mode passphrase: A cryptographic hash of your passphrase (we never store the passphrase itself), an optional hint, and biometric enrollment preference.
• Payment information: If you subscribe to a paid plan, payment is processed by Stripe, Inc. We do not receive or store your credit card number. Stripe provides us with your email address, billing country, subscription status, and plan type, and, for founding and gift purchases, your name. We use the billing country to refuse, and refund in full, a purchase from a country where we do not sell paid plans (see our Terms of Service). Whenever you buy through Stripe, including a founding or gift purchase, and give a confirmation at checkout (that you are an adult, which we ask when you buy on our website, and, for a subscription, that you agreed to automatic renewal), we keep a record of it, with when you gave it and the browser or app details your device sent, with the purchase at Stripe for as long as we keep that purchase's records (Section 9). Stripe also tells us when a payment is disputed or reported as possible fraud, with the details of the dispute or report (such as its reason, status and amount); we use them to prevent fraud and to manage the subscription that payment is for, and our error-monitoring service (Sentry, Section 7) receives them with Stripe's reference numbers so we are alerted to review each one.
• How you found us: If you create your account in the KudoKids web app after following a link that carries campaign tags — the labels a link uses to name the source, ad, post or partner it came from — the web app holds those tags in your browser for up to 30 days and, when you sign up, stores them once with your new account, so we can see which channels and campaigns — including our own ads — bring families to KudoKids and decide where to spend on marketing. A link from our website into the web app carries the campaign tags you arrived on our website with only while analytics or advertising cookies are on for you there. We keep only the tags: not the full link, the site you came from, your network address, or any device identifier. We do not share them with any third party — advertising platforms included — or use them to target ads at you, and nothing is collected this way from children. Campaign tags that come with a purchase are handled as described for Stripe and Google Analytics in Section 7. Accounts set up after installing the app from an app store are not tracked this way.
• Child profile information you provide: For each child profile, you provide the child's name (a first name is enough) and date of birth (we use the date of birth to calculate your child's age for age-appropriate content). You may optionally provide growth areas (behavioral focus areas), wellness feature preferences, and a PIN or image-based PIN for child access.
• Screen-time item photos: if you upload a photo for a screen-time item, we store it at an unlisted web address in a public storage bucket so the app can show it.
• Behavioral assessments you provide about your child: You may optionally complete a Strengths and Difficulties Questionnaire (SDQ)-based assessment with scores across five domains (emotional, conduct, hyperactivity, peer relationships, prosocial behavior).
• Consent records: When you consent to data collection about your child during setup, we store your typed full legal name, the consent version, the consent method, and a timestamp. When you later turn on friends of friends, or use a code from another household to link a child to your family, we record that consent event too, with its category and timestamp.
• Social feature approvals: When you turn on friends for your child, and when you approve a friend request, we record that approval and when it happened.
• Calendar feeds (optional): If you connect a calendar to KudoKids, we store the calendar's web address (the .ics link you give us), a label you choose, and which children its events should become tasks for. Once a day our servers fetch that address and read the events it returns — their titles, dates and times — and turn them into tasks. We send nothing to the calendar's host except the request for the file, and that request comes from our servers, not from your device or your child's, so the host does not see your family's network address. Whatever you put in an event title becomes a task title your child can see, so leave out anything you would not want on their screen. Remove the feed at any time and we stop fetching it.
• Invitations: If you invite another adult to your family, we store their email address, the role you chose and whether you let them give consent for your children, and email them the invitation. We email them a reminder, and a last notice before the invitation expires, unless they accept it first.
• Partner organization staff: If you work for an organization that partners with KudoKids, we can create your KudoKids account from the email address, and any name, your organization gives us, and then email you how to sign in.
• Parent surveys (optional): during setup and a few times in the first months, we may ask you a few short questions about how your household's routines are going (and, in some surveys, whether you would like product emails). Your answers are stored with your family account, are used to improve KudoKids and to measure whether it helps families, can be skipped, and are kept for the period in Section 9.
• School and district contacts: if you work for a school or district we are talking with, we keep your name, title and work contact details (from you, your colleagues, or public sources such as your school's website), the role you have in the conversation, our notes, and the emails exchanged between you and our staff, including their text, so we can manage that relationship. We keep them for the period in Section 9 and do not use them for anything else.
• If you delete your family: we ask why, from a short list that always includes "Prefer not to say". We keep your answer with the family until its data is deleted, then keep only an anonymous monthly count of each answer to improve KudoKids.
• Support requests: If you contact support from inside the app, we store the request's title, your message, the category and priority you chose, anything you attach to it, your device type, operating-system version and app version and build, and a technical snapshot of which content bundles your app had downloaded -- all with your family's account so we can reply. If you leave the title blank we generate one from your message -- see the Google Gemini entry in Section 7 for how that works and what is sent. Attachments go into private storage that is not readable from the public internet. Screenshots often show an app screen -- please check what is in one before you send it.

We collect the following categories of personal information from or about children. All child data collection requires verifiable parental consent (see Section 6), except error diagnostics and the app's automatic update check (Sections 4e and 7), which we collect under COPPA's internal-operations exception. Categories marked "optional" are individually parent-controlled — a child is never required to use any of them: friends and messaging with children in other families stay off until you choose a friends setting for that child; you then approve each new friend unless you choose auto-approve, and you can set a child's friends to "Friends off" at any time; family chat (with siblings and with adults you invite into your family) and sibling cheers start on, and you can turn off messaging for that child or for your family; wellness and creative features start on and can be turned off per child at any time in Settings.

4a. Identity Information (required for core Service)

• Child's name (a first name is enough) and date of birth (provided by parent; used to calculate the child's age)
• Profile avatar, companion and color theme selection
• A nickname your child may type for their own profile, which your family sees in place of their name (screened before it is saved)
• A sign-in passcode, if you or your child set one (number and letter codes are stored only in scrambled, one-way form; a picture passcode is stored as the pictures chosen), used only to sign your child in, and which in-app guides your child has finished
• Cross-household membership: if your child belongs to more than one family on KudoKids (for example, separated co-parents), we record each household membership so coins, badges, and premium features follow your child between households

4b. Activity Data (required for core Service)

• Task completions and last completion dates
• Task mastery: as your child completes a task, a mastery level for that task (still learning, proficient or mastered), based on how many times it has been completed and approved
• Routine records: per-routine completions (full or partial credit), the day weights you set, the daily coin allotment used, skips and task-timer events, and, if you set an earliest time for a routine and your child marks it done before then, a record that they did and your answer if you review it
• Streaks, streak adjustments, streak shields earned or used, and saving-helper records (savings goals and streaks)
• Kudo Coins your child puts toward a family reward goal
• The rewards your child adds to their wishlist
• Hold challenges: the store's "wait before spending" offers and what happened (accepted, waited out, refused or ended early), how many your child has refused in a row, and the stage they have reached
• Calendar: calendar events you create, or import from a calendar feed, and assign to your child (title, notes, days and times, and whether it earns Kudo Coins), shown on your child's calendar
• Each practice session with a specialist you invited: which activities you allowed, and when it started and ended (see Section 8)
• Story progress: which stories and episodes your child reads, how far they got, and the choices they make along the way
• Badges earned, the items your child unlocks (by buying them or earning a badge), and which items they have equipped
• Kudo Coin transactions -- earned and spent (recorded as an immutable ledger)
• Requests to a parent: when your child sends you a request — for more time or access (more screen time, more Safe Browser time or a schedule change), for help with an activity, for a new task to earn Kudo Coins, or to take Kudo Coins out of savings — we store the request, the reason the app shows with it, any short note they choose to write, and your answer.
• Gift notes: when your child sends Kudo Coins to a sibling, they may write a short note (up to 120 characters) to go with it. This is free text your child writes, it is screened for inappropriate language before it is stored, and it is readable by the sibling who receives the gift and by you.
• Store purchases (rewards, skins, themes, companions, music, games)
• Game sessions: which game, the score, how long, whether it was finished, the coins spent and earned, and the theme

4c. Wellness and Assessment Data (parent-controlled)

Wellness features are on by default, are always voluntary for the child, and can be turned off per child at any time in Settings. Behavioral assessments exist only if you (the parent) choose to complete one — children are never presented with assessments or surveys.

• Emotion check-ins: Children may voluntarily record daily emotion check-ins by choosing the emotion they feel and a mood score (1-5). Children do not type free text into check-ins; a parent may later add a short written note to a check-in for context.
• Meditation sessions: Duration, frequency, and completion percentage of guided meditation sessions.
• Affirmations and wellness exercises: which affirmations and wellness exercises your child does, and when, and any affirmations you write or switch off for your child.
• Behavioral assessments: if you use this feature, the answers you give about your child.
• Growth areas: Parent-defined behavioral focus areas used to personalize task recommendations.
• Practice progress: For the speech-practice and learn-to-read activities, we record which sounds or levels your child has worked on, how far along each one is, any practice targets set for them, and when each practice session happened. Your child types nothing into these, and targets are chosen from a fixed list we supply.

4d. Social Data (family features start on; friends outside your family start only when you choose a friends setting)

• Nickname and group chat names: a nickname your child may choose to type (screened before it is saved), which is shown, with your child's friend code, to someone who enters that code and to your child's accepted friends and their families, and the names your child gives to group chats they create; a chat's name is visible to its members, who can include children in other families when you have turned on friends.
• Friend code (alias): A 3-20 character code used for friend discovery. We generate a starting code automatically when a child profile is created — two random words, with digits added if needed, never your child's name. Your child can swap it for another random pair of words (free when they first sign in, 50 Kudo Coins after that); a code is never typed by hand. The code becomes discoverable outside your family only after you enable friends for that child; until then it is stored but not listed. Once enabled, someone signed in to KudoKids can find it only by entering the complete code — there is no partial-match search, no browsing, and no way to list codes in bulk.
• Messages: Free-text messages (up to 500 characters each) your child sends to members of your own family — parents, siblings, grandparents, and other adults in the family, one-to-one or in family group chats — and, if you turn on friends, to connected friends. An adult you invite into your family who joins a family chat can see that chat's earlier messages. We retain message edit history for safety auditing. When your child deletes or edits a message, the earlier text is hidden from the chat, not deleted: the parents who monitor that conversation (in a chat with another family, that family's monitoring parents too) and our safety and support staff can still read it, it is included in your data export, and it is kept for the period in Section 9. Messages are subject to automated content filtering (URL detection, spam/caps/pattern checks, and inappropriate-language screening, described in Section 5), and a message between friends is visible to the parents, guardians and admins of both children's families. If you and another family both turn on friends of friends, your child's messages can also reach a group chat that includes a friend's friend, where that child and the adults in their family see them (see Section 8).
• Cheers: the cheers your child sends to brothers and sisters (a phrase they pick).
• Friendship connections: Records of which children are friends, including parent approval status and timestamps.
• Leaderboard participation: Unless you turn off Leaderboards for a child in Settings → Kid features → Friends & Messaging, while Friends & Messaging is on for your family that child's game scores and rankings appear on the global game leaderboard, which anyone signed in to KudoKids can view — not only the child's own friends. The child's name is shown only to their own family and accepted friends; every other viewer sees the entry as "Anonymous."
• Multiplayer sessions: who played together (family members and, if you turn on friends, approved friends), with each player's score, finishing place and game moves, including any word a child types as a guess, which the other players see.

4e. Device and Technical Data

• Push notification tokens: Device-specific identifiers used to deliver push notifications. These are persistent identifiers as defined by COPPA and are treated as personal information. Tokens are registered only from a device in parent mode and are stored on the parent's profile; a child-mode device never registers one.
• App update identifier: When the app checks for a newer version of its code, every device, including a child's, sends our update provider (Expo, Section 7) a random identifier that the update software creates once for each installation of the app. It is a persistent identifier, not linked to any account, family, or child, and used only to deliver app updates, as support for the internal operations of the app (see Section 7).
• In-app notifications: the alerts the app creates for your child and for you about your child's activity, such as an approved task or a blocked message, and a record of alerts we held back, for example during bedtime quiet hours, kept for the period in Section 9.
• Device records: for each device signed in to your family, including a shared or kid-mode device a child uses, a persistent identifier the app creates for that device, the device's name and type, its mode, and when it was last used (updated each time the app opens), so you can see, manage and remove devices.
• Access logs: When a profile is selected, we log the profile ID and its role, the device platform, operating system version, app version, and a timestamp; for parent logins we also record the authentication method used. Access logs are automatically deleted after 90 days.
• Network address during a device handoff: When you move a child's session to another device by scanning a pairing code, we record the network (IP) address of the device asking and the device approving, so we can investigate abuse of the handoff. On a child handoff one of those is the child's own device. We erase both addresses 30 days after the handoff and delete the handoff record entirely after 90 days, both by scheduled job. We do not use these addresses for anything else, and we never use them to locate or profile a child.
• Companion interactions: Taps and gestures on your child's companion animate it in the moment only — they are not stored or transmitted. Which areas of the app your child visits, and for how long, is recorded as the app-usage activity described in Section 4h.

4f. Speech Recognition

Some educational features let your child interact by voice. Speech recognition is performed entirely on your child's device — the app requires on-device recognition, and the spoken audio never leaves the device. On a device that cannot recognize speech on the device, the activities are still offered but the app does not listen for words; there is no cloud fallback. KudoKids does not keep any audio (if you turn on the microphone level meter in speech practice, audio is held briefly on the device only to measure loudness and deleted when the meter stops), and no audio or transcript is ever sent to KudoKids' servers, Apple, Google, or anyone else. The on-device recognizer is provided by the device's operating system (Apple on iOS, Google on Android) — see Section 7.

4g. Routine Mastery Progression

• Routine mastery progress: For children ages 3-12, the app evaluates how consistently a child completes the steps of a routine — derived when needed from the routine-completion records described in Section 4b, not stored as separate scores — so it can recognize when a child may be ready for more challenging routine steps. What we store is a record of the in-app encouragements we have shown a child about progressing (the dates and how many times), used solely to avoid repeating the same encouragement too often.
• Child-initiated request for harder routines (ages 7+): Children aged 7 and older may optionally tap to let their parent know they feel ready for more challenging routines. We record that the child made this request so the parent can review it.

This information is used only to run KudoKids and for the uses in Section 5, is stored with our hosting provider (Supabase), and is never sold, used for advertising, or shared with any other third party, except that our staff's support tooling (Anthropic's Claude) may process it while they work on a support request or an operational task (Section 7). It is retained for 1 year, or until the child's profile is deleted (whichever is sooner).

4h. Screen-Time and App-Usage Activity (on by default)

To help families manage healthy screen habits, KudoKids records app-usage activity for each child profile: which sections of the app are used, the categories of features opened, and how long each session lasts. This recording is controlled by the Usage Time Insights setting, which is turned on by default for every child profile, and a default daily screen-time limit of one (1) hour per child is applied. Parents can adjust or turn off the daily limit, or pause optional data collection (such as the saving helper), at any time from Settings → Kids Access → Daily Time Limits and Settings → Data & Privacy. Routine, task, and device-timer records needed to run those features continue while your child uses them; you can delete them by deleting the child profile. Turning off Usage Time Insights in Settings → Data & Privacy stops KudoKids from recording app-usage activity for every child in your family until a parent turns it back on; activity already recorded is kept only for the periods in Section 9.

This usage activity contains no free-text and no new categories of personal information beyond the activity already described in Section 4b — it is route/feature/session-duration data, used to power the daily limit, the parent's usage insights and the weekly digest, to decide whether to send you getting-started help, check-in emails and reminders (Section 5), and to add to the anonymous totals we keep before a child's data is deleted (Section 5). It is used only to run KudoKids and for the uses in Section 5, is stored with our hosting provider (Supabase), and is never sold, used for advertising or profiling, or shared with any other third party, except that error reports to Sentry can include which screen was open, a specialist you invite can see your child's app-use record during a live session (Section 8), and our staff's support tooling (Anthropic's Claude) may process it while they work on a support request or an operational task (Section 7). Raw usage sessions are retained for 90 days and aggregate rollups for 1 year (see Section 9).

4i. Shared Screen-Time Sessions (optional — off by default)

If you enable Shared screen-time for a child, that child can start a device-timer session on one shared device for any of their siblings, with or without joining it themselves; the siblings they add do not need Shared screen-time enabled themselves. Each child's own banked minutes and Kudo Coins pay only for their own seat — costs are never split or pooled. While a shared session is being set up, the child starting it can see whether each of their brothers and sisters can afford the chosen length, including their available screen-time minutes and Kudo Coin balance — including siblings who are not opted in or do not join. Balances are shown only within your family. KudoKids records one session ledger entry per participating child, noting which child started the session when that child also joins. All of this is used only to run KudoKids and for the uses in Section 5, is stored with our hosting provider (Supabase), and is never sold, used for advertising, or shared with any other third party, except that a specialist you invite can see your child's Kudo Coin history, which includes shared-session spending, during a live session (Section 8), and our staff's support tooling (Anthropic's Claude) may process it while they work on a support request or an operational task (Section 7). Shared screen-time is off by default and can be turned on or off per child at any time as the gate to start a session.

4j. Creative Content — Drawings and Artwork (parent-controlled)

KudoKids' Create features let your child draw, color, and follow drawing lessons. The drawing feature, and family sharing of drawings, are on by default; a parent can turn either off at any time. For each drawing your child saves, we store the finished image and the stroke data used to draw it (so your child can keep editing it later). Drawings are stored privately in KudoKids' systems. Your child sees their own gallery and, while family sharing is on, other family members can see shared drawings; a specialist you invite and grant drawing to can also see the drawings that child has saved, including ones removed from their gallery (Section 8). Parents can see the drawings saved in their family on the parent dashboard (the family's most recent drawings; we send a full copy of every drawing on request), including drawings the child has removed from their own gallery, which remain visible to parents, and only an adult in your family who can approve requests (a parent, guardian or admin, or another adult you give that permission) can permanently delete a drawing. A parent can turn the drawing feature, and family sharing of drawings, on or off at any time in Settings → Drawing & Art. Drawings are not shared with anyone else and are used only to show them to the people described here (see Section 9 for retention).

4k. Safe Browser Sessions (optional — off by default)

Safe Browser is an optional feature a parent turns on and stocks with an approved list of sites, YouTube channels, and playlists. It is a walled garden: your child can reach only the destinations you approved, and there is no open web access. While it is on, we record each session — which approved destination was opened, when, and for how long — so the time can count against the daily limits you set and, where you have enabled it, toward the coins your child earns for watching approved content. We do not record general web browsing, search terms, or any destination you did not approve. For what Google receives when an approved YouTube video plays, see Section 7.

Any other website you approve is run by someone else, not by us. (YouTube and YouTube Kids are handled separately, as described above and in Section 7.) It loads inside the app as it would in a browser, except that links away from that site are blocked. Approving a site covers its pages and its subdomains. When your child opens it, that site receives what any website receives from a visiting device: the device's network address and the technical details any browser sends, such as its type and version. It can store its own cookies and site data on the device, and it can play sound or video as soon as it opens. It can run advertising and analytics code, including code from other companies: KudoKids does not filter the scripts, images, fonts, or tracking pixels a page loads, and the services they come from receive the same technical data. What KudoKids does block is navigation to, and embedded frames from, any site other than the one your child is on, which stops advertising delivered as a frame from another site. There is one exception: so pages display, every approved site may load supporting content, frames, and pages from a short fixed list of hosts we chose, several of them run by Google; they are named in Section 7. We never send the site your child's name, profile, or anything entered in KudoKids. We also do not clear the cookies, site data, or cache an approved site leaves on the device — not when the session ends, not when your child exits, and not when you turn Safe Browser off — so they stay available to that site the next time it is opened on that device, whichever child profile opens it. What an approved site collects is governed by that site's own privacy practices, not by this policy. You choose every site, and you can remove any of them at any time in Safe Browser settings, under Sites.

4l. Companions your family creates (Companion Studio — Premium, adult-run)

Companion Studio is an optional Premium feature that lets a grown-up in your family make a new companion; while it is in beta, we offer it to some families only. An adult sets out the companion they want — the picker choices the draft was built from and, if they like, a short written description — and picks one of the flat concept images generated from them. Before the companion is built we compare that image against the companions KudoKids already has and the ones other families have listed, so a near-copy can be caught. The image is then turned into a 3D companion with a name and a short spoken name clip. Every step that creates or spends anything is taken by an adult in parent mode, and no dollar price, purchase, or credit balance is ever shown to a child.

An adult can also start a companion from one reference picture: a child's drawing, a pet, a toy, or a thing — never a photo of a person. We check each picture automatically and refuse one that looks unsafe or shows a person or a face (a child's drawing of people can be used, but only as a written description of it). We keep the picture for about 24 hours at most, and delete it sooner once the draft moves past choosing a concept image or the adult removes it.

A child can take part in one way: assembling an idea card from fixed picker cards we supply. This is off for every child until you turn it on for that child in the Create family setting, and we record that choice; it is not offered to children under 6. A child's part has no free typing, and no photo, upload, or camera. Nothing a child picks leaves your family's account unless an adult decides to build the companion; the picks then help shape the adult's request to our picture tool, and are never sent with your child's name or profile.

A companion your family builds stays inside your family unless an adult lists it in the shared gallery, where other families can add it. Listing is off unless an adult turns it on for that companion, and can be turned off again. A listed companion also gets its own web page that anyone with the link can open, without an app or an account: it shows the companion's pictures, its name, its rarity word and its theme, plus the alias described below — never a family name, a child's name, a photo, or anything anyone typed. An adult can turn that page off, or the whole listing off, under Manage companions. A listing carries a two-word creator alias we mint — never your family name, your child's name, or anything anyone typed — or no credit at all, if the adult chooses the anonymous option. KudoKids staff can review a companion, and what was submitted to make it, for safety. KudoKids owns the companions this feature generates and the assets built from them; see our Terms of Service.

A listed companion can carry more than a model: a short backstory in four fixed fields, up to eight spoken lines, and a five-second trailer clip generated once for it. An adult writes the backstory and the lines, and the trailer is generated video, not footage. A child in another family sees and hears these only if the companion suits their age; the written lines are on for any child the companion suits, and a parent can turn them off for that child at any time ("Creator-written lines"). Everything that crosses a family line was written by an adult or generated by us, and we check it first. A companion built from a child's idea card carries a "Made together" credit inside your own family only; that credit, and everything else that names anyone, is removed before another family can see the companion. Nothing a child wrote or recorded is ever part of it, and a child's picks are never shown as theirs.

For what our providers receive, see the Google Gemini, Google Cloud Vision and Tripo entries in Section 7; for how long each piece is kept, see Section 9.

4m. Theme Worlds (beta)

Theme Worlds lets your child walk their companion around a 3D world. While it is in beta, we offer it to some families only. Once your family is admitted, it is on for each child unless you turn it off for that child or for your whole family in Settings, where you also set the daily time limit (up to 15 minutes, or up to 60 with Premium) and how many Kudo Coins each minute costs (zero to three). We keep a record of each visit (when it started and ended, which place, how many minutes, and the Kudo Coins each minute cost) and the minutes used each day, so we can hold your child to the limit you set and charge the coins.

In a room, up to four children explore one world together and can play short games. Today a room holds only brothers and sisters in your own family; a child from another family can join only after each child's parent reads a separate notice and gives a consent we record for that child. Hosting a room needs Premium; joining one does not. Inside a room, the other children see your child's companion move, the set gestures and world stickers your child sends, the name and emoji shown for your child, and their age range (3–5, 6–8 or 9–12). That movement is relayed live between the devices in the room and is not stored. There is no typing and no voice in a room. We keep who asked to join a room and the answer, a record when the host sends a child home from a room (that child cannot come back into that room), and each game round's results. Your child's best scores are kept for a world leaderboard only if you turn world leaderboards on for a child aged 6 or older (off by default). Children aged 3 to 5 are never ranked, and their rounds are always played together, not as a race.

A child in a room can hide another player's moves on their own screen, leave, or tell us what happened by choosing a reason from a list (there is no free text). We keep that report, with who was in the room and the round under way, so our team can review it. We tell the reporting child's parent that a report was filed, and we never tell another family who reported their child. If a report is not reviewed within 24 hours, or our team decides to, we pause Theme Worlds for the reported child until our team lifts the pause, and Settings shows you that it is paused. Theme Worlds notices go to parents, never to a child. Your family's data export includes your child's world visit minutes, round scores and reports.

For how long each piece is kept, see Section 9.

We use children's personal information for the following purposes:

• Service delivery: To operate the core features -- tracking tasks, managing Kudo Coin balances, delivering rewards, and running games. Where you have granted a specialist access (see Section 8), what your child does in a practice session with that adult is recorded on your child's own record and used for these same purposes.
• Age-adaptive experience: To adjust content difficulty, UI complexity, and available features based on the child's age.
• Personalized recommendations: Growth areas are used to suggest age-appropriate tasks and educational content.
• Wellness features: Emotion check-in data and meditation history are used to provide wellness insights to parents and to power features like daily affirmations.
• Supportive check-in notifications: The adult members of the child's own family — parents, guardians, and any other adults the parent has invited, such as grandparents or caregivers — receive an in-app notification, and an optional push notification, when the child completes a check-in indicating they may want extra support (for example, feeling worried or sad), so a caregiver can offer help. These notifications go only to the child's own family, contain no clinical labels, and the underlying information is used only to run KudoKids, is stored with our hosting provider (Supabase), and is never sold, used for advertising, or shared with any other third party, except that the push notification passes through Expo and Apple's or Google's push service to reach the device, and our staff's support tooling (Anthropic's Claude) may process it while they work on a support request or an operational task (Section 7). The push notification is on by default and can be turned off (or back on) at any time in Settings > Notification Preferences.
• Security, support and legal compliance: To keep KudoKids secure, answer support requests, and meet our legal obligations.
• Improving KudoKids: The answers parents give in the optional surveys described in Section 3 help us improve KudoKids and measure whether it helps families.
• Anonymous totals: Before we delete a child's information under the 24-month rule or after you delete your family, we add their activity and age group to anonymous app-wide totals (Section 9).
• Task mastery: We use your child's mastery level for each task to adjust celebrations and to move the task up a level as your child masters it.
• Parental reporting: Parents can view their child's activity, progress, assessment results, and social interactions through the parent dashboard.
• Getting-started and check-in emails: We use whether and when your children last used KudoKids to decide whether to send you getting-started help or, if you opted in to tips, a note checking whether KudoKids is still working for your family. These emails go only to you, contain no details of your child's activity, and you can turn them off in your email preferences.
• School program reports: If your family joined KudoKids through a school program, we count whether your children completed routines each week, together with the other families in that program, so we can show the school how many families are active. The school sees only totals for the whole program, never a child or a family, and we show no totals for a program with too few families to keep them anonymous.
• Safety and moderation: Messages your child sends are automatically screened for inappropriate language. Depending on your family's setting, a message that matches is blocked, delivered and flagged, or allowed; we alert you when one is blocked or flagged as a safety concern, and some words are always blocked. A blocked message or edit is not delivered, but the start of its text is saved in the alert we send you, which is deleted on the schedule for in-app notifications in Section 9. Our team can review any flagged message, with the sender's name, to keep chats safe. Message edit history is retained for parent audit.

We do not use children's personal information for advertising, behavioral targeting, profiling for commercial purposes, or any purpose not described in this policy.

KudoKids is an app directed to children ages 3-12. We comply with COPPA as follows:

6a. Parental Consent Is Required

All child profiles are created by a parent or legal guardian. Children cannot self-register. Before we collect personal information about a child, the parent must provide verifiable parental consent ("VPC") through the app's setup wizard, except for the error diagnostics and the app's automatic update check described in Sections 4e and 7, which COPPA's internal-operations exception permits without consent. The parent consents by:

1. Authenticating their identity via email one-time passcode.
2. Reviewing a notice describing the categories of data that will be collected, how the data will be used, and the parent's rights.
3. Typing their full legal name as a digital signature of consent.

We store the consent record (typed name, consent version, consent method, and timestamp) to demonstrate compliance. Optional data categories are controlled per feature rather than during this signature step: friends and messaging with children in other families stay off until you choose a friends setting for that child (you then approve each new friend unless you choose auto-approve, and "Friends off" turns them off again), family chat and sibling cheers start on, wellness and creative features can be turned off per child at any time in Settings, and friends of friends records its own separate consent, with a category and timestamp, when you turn it on; when you share a code that links your child to another household, the parent in that household records their own consent before the link is made (see Section 6b on refusing or revoking any category).

6b. Parental Rights

At any time, a parent may:

• Review all personal information collected about their child through the parent dashboard's data review screen, or request a copy by emailing privacy@kudokids.org.
• Delete their child's personal information. Deletion is permanent and removes data across all systems (profile, assessments, transactions, game sessions, messages, friendships, leaderboard entries, push tokens, and all other associated records). Deletion can be initiated from the parent dashboard or by emailing us.
• Refuse further collection by disabling specific data categories (assessments, emotion tracking, social features) in the child's settings, or by deleting the child's profile entirely.
• Export their family's data in JavaScript Object Notation (JSON) format through the parent dashboard. The export includes each child's activity, wellness, social, and creative records, and we send any record the export does not include when you ask us; drawing images themselves can be reviewed on the parent dashboard's Kids' Art screen (the family's most recent drawings), and we send a full copy of every drawing on request.

6c. Data Minimization

We do not require children to provide more personal information than is reasonably necessary to participate in the core Service (task management and rewards). Behavioral assessments, emotion tracking, and social features are all optional and individually controlled by the parent. No features are conditioned on providing optional data.

6d. No Behavioral Advertising

KudoKids does not place ads in the app or sell advertising space. When a parent approves YouTube channels or playlists, or a website, in Safe Browser, that video or website can show its own ads or sponsored content, which KudoKids does not remove; videos play in YouTube's privacy-enhanced player (youtube-nocookie.com), which YouTube says does not show personalized ads (see Sections 4k and 7). We do not use children's personal information for targeted advertising, behavioral advertising, or any form of commercial profiling. We never sell or share children's personal information.

We use the following third-party service providers to operate the Service. Each provider receives only the data necessary for its function:

• Supabase, Inc. (cloud database, authentication, real-time subscriptions): Supabase hosts our database and handles parent authentication (email OTP). It also relays theme-world room play (Section 4m) live between the devices in a room; that stream is not stored. All family data -- including children's personal information -- is stored on Supabase's infrastructure in the United States (AWS us-west-2 region). Supabase processes data in accordance with its Privacy Policy and Data Processing Agreement.

• Expo / Expo Application Services (push notifications and app updates): We use Expo's push notification service to deliver notifications to devices. When sending a notification, Expo's servers receive the device push token (a persistent identifier) and the notification content. Expo delivers each notification through the device maker's push service — Apple Push Notification service on iOS, Google Firebase Cloud Messaging on Android — which receives the push token and the notification's generic text. Notification payloads may include references to child profiles. Device push tokens are considered persistent identifiers under COPPA; Expo processes these tokens in accordance with its terms of service. The push token identifies a device, not a person, and it is used only to deliver notifications that are turned on for that parent. Children's devices never register one at all -- the app returns without registering when the device is in child mode. Separately, when the app starts or returns to the foreground it checks Expo's update service for a newer version of the app's code; that check carries the standard connection data any network request includes (such as the device's network address) plus the app's runtime version, platform, and update channel, and a random identifier that the update software creates once for each installation of the app and sends with every check, from every device, including a child's. That identifier is a persistent identifier: it is not linked to any account, family, or child, and it is used only to deliver app updates, as support for the internal operations of the app (16 CFR 312.5(c)(7)). The check carries no account, family, or child data. How we make sure the update identifier is never used for anything else: it goes only to Expo's update service; no code in the KudoKids app reads it, it is never sent to our servers or stored in any KudoKids system, and nothing of ours links it to an account, family, or child. We do not run an advertising network or an analytics SDK anywhere in the KudoKids app, and we never use this identifier, or ask Expo to use it, to contact a child, build a profile of a child, or serve or measure advertising.

• Stripe, Inc. (payment processing — app and website): Stripe processes payments for KudoKids subscriptions and one-time purchases on both the KudoKids mobile app and the KudoKids website (kudokids.org) via Stripe Checkout. When a parent makes a purchase, payment details (card number, billing address) are sent directly to Stripe and are never stored on KudoKids servers. Stripe also receives, to send receipts, grant the purchase and keep our purchase records, the buyer's email address, KudoKids account and family identifiers and plan selection, and the record of the confirmations the buyer gave at checkout (that they are an adult, which we ask on our website, and, for a subscription, that they agreed to automatic renewal), with when they were given and the browser or app details the buyer's device sent. With every purchase except a purchase or gift of Companion Studio credits, Stripe also holds whether analytics consent was active for the buyer, any campaign tags the buyer arrived with and the page they first landed on, and, only while analytics consent is active, the Google Analytics identifiers described in Section 13. For a founding or gift purchase on kudokids.org, Stripe also holds the site the buyer came from, whether advertising consent was active, the advertising identifiers described in Section 13 (only while advertising consent is active), and any gift name and note the buyer writes (see Section 16). Stripe also pays the partners, sales representatives and nonprofit partners we pay through our programs: each payee gives Stripe their identity and bank details directly in Stripe's own onboarding, and we do not receive them; we send Stripe our internal identifiers for the payee and the program a payment comes from, and the details it needs to make each payment (for a nonprofit, including its tax identification number), and Stripe tells us whether the payee's account is ready to be paid and, for a nonprofit, its registered name. If we pay you as a partner, a sales representative or a nonprofit partner, we keep the reference Stripe gives your payout account and a record of each payment we make through Stripe, for as long as we need them to meet tax, accounting, and other legal obligations. Stripe processes data under its Privacy Policy. No child data is sent to Stripe. A gift note is the buyer's own message to the recipient, and we pass it to Stripe without removing names or other details, so anything the buyer chooses to type in it, such as a child's name, reaches Stripe too. (On iOS, in-app purchases are instead processed by Apple's In-App Purchase system — see the Apple In-App Purchase entry below. Web and other platforms use Stripe.)

• Apple Inc. (in-app purchases via App Store / StoreKit 2): On iOS, subscription and one-time purchases inside the KudoKids app are processed by Apple's In-App Purchase system using StoreKit 2 via the expo-iap library. When a parent initiates a purchase, Apple receives the parent's Apple ID, device identifier, payment instrument (handled entirely by Apple — KudoKids never sees credit card data), and transaction metadata (product identifier, purchase date). KudoKids also gives Apple the purchasing parent's KudoKids account identifier, which Apple returns with the transaction; we use it only to match the purchase to that parent's account. Apple returns to KudoKids a signed transaction object (JWS) containing original_transaction_id, transaction_id, environment (Sandbox or Production), productId, purchaseDate, and expirationDate — used to grant entitlements and validate receipts server-side. No child data is sent to Apple. Purchases can only be initiated from the parent-gated subscription screen; child profiles cannot initiate or complete in-app purchases. Web purchases continue to be processed by Stripe (see the Stripe entry above). Apple processes data in accordance with its Privacy Policy at https://www.apple.com/legal/privacy/. Separately, a link on our website to the App Store or Google Play tells Apple or Google which page, and with your cookie consent which campaign, the click came from, for their install reports (see "Links to the app stores" in Section 13); nothing about a child is included.

• Sentry (error monitoring and diagnostics): Sentry receives error context — stack traces, device information (device model, operating system version, app version), and our internal account and family identifiers (neither is attached while a child is using the app) — used only to diagnose and fix problems. From an adult's own session in the app, Sentry also receives performance data about how the app runs (such as how long screens, network requests and downloads take), with the same account and family identifiers, used only to find and fix problems; no performance data is sent while a child is using the app. Our servers also send Sentry the details of a payment that needs our review (such as a dispute, a fraud report, a refused or duplicate purchase, or a refund we must check by hand), with Stripe's reference numbers and, for a purchase refused because of its billing country, that country, so we are alerted to review it (see Section 3). Each error report also carries the app's state when the error occurred, such as which mode the app was in and its connection status, with no names or content. Sentry does not record the screen: session-replay capture is disabled in our configuration, so no screen recording, masked or otherwise, is ever captured or transmitted. Alongside each error we attach a short trail of recent app events ("breadcrumbs"); in child mode this trail is filtered to structural events only (navigation, timing, and app-lifecycle entries), and identifiers are scrubbed before transmission — no child names, messages, or personal content are sent. This data collection is performed under COPPA's support for internal operations exception (16 CFR section 312.5(c)(7)) as the sole personal information collected is a persistent identifier used for maintaining and debugging the app. Sentry processes data in accordance with its Privacy Policy.

  How we make sure that identifier is never used for anything else. An error report from a parent's own session carries that parent's account id. A report from your child's session carries no account id at all -- not yours, and not that of any other adult signed in on the device, such as a specialist or a relative you gave Kids Login. When your child is using the app we also clear the family identifier from the report entirely and discard the record of what was happening before they started, and we keep only three kinds of structural event (which screen, app start and stop, and timing), with any account or profile identifier stripped out of those before anything is sent. No screen recording is ever captured. We do not run an advertising network or an analytics SDK anywhere in the KudoKids app, so there is nothing in the app that could receive this identifier for advertising, and no system of ours joins it to a child's profile, activity, or messages. We do not use it to send, or to cause anyone else to send, any message to a child. It cannot be used to contact your child, to build a profile of your child, or to target advertising, because none of the systems that would do those things exist here.

• Resend (email delivery): We use Resend to deliver email notifications to parents and to adults who write to us through our website forms (e.g., approval requests, security alerts, weekly reports, and form confirmations). Resend receives only the recipient's email address and the notification content. No child data is sent to Resend. A gift note is included in the gift email we send the buyer through Resend, for the buyer to pass on, without removing names or other details, so anything the buyer types in it, such as a child's name, reaches Resend too. Resend processes data in accordance with its Privacy Policy.

• Anthropic, PBC (Claude — staff-operated support and operations tooling): KudoKids staff use Anthropic's Claude as an internal tool to help answer support requests and carry out day-to-day operations. When our staff work on your support request or an operational task, the content of that request and the account records they are working with — which can include a child's profile or activity records, and, during engineering operations, results of queries our staff run against our own database — may be processed by Claude during that work. This tooling is operated only by KudoKids staff — it is never a user-facing feature, and children never interact with it. We use Anthropic under commercial terms that prohibit Anthropic from training its models on this data. Anthropic processes data in accordance with its Privacy Policy.

• Google Gemini (AI features for parents): When a parent uses KudoKids AI — our optional, subscription-only assistant — when a parent imports a chore chart while setting up KudoKids, or when an AI-generated title is created for a support ticket, we send content to Google's Gemini API. For KudoKids AI this includes the parent's message, any photo the parent chooses to attach (for example, a chore chart), and the family's parent-written task, routine, and reward names and coin values, with each child shown only as an anonymous label. For a chore-chart import — a free, optional step of parent setup — this includes up to three photos the parent chooses, any description the parent types, and the same anonymous family context sent for KudoKids AI, so Gemini can read the chart and suggest routines and tasks. For a support request a parent sends us, this is the request's text, which Gemini uses to suggest a title. Before anything is sent, we automatically replace children's profile names in the text we send with anonymous placeholders, and we never add your children's ages, coin balances, activity history, or messages ourselves, but anything a parent types or shows in a photo, such as a child's age, is sent as written. Photos are sent as they are: a photo you attach to KudoKids AI, or a chore-chart photo you import, reaches Google unchanged, so a child's name or face that appears in it is sent to Google too. A name we don't recognize in what you type is also sent as written. Please review what you share. We use Google's paid API tier, whose terms prohibit Google from using this data to train its AI models; Google may retain prompts briefly solely for abuse monitoring. KudoKids does not store your KudoKids AI conversations or photos, or the photos you import — only the changes you review and approve in the app are saved to your family account, plus, if you choose to submit feedback on an AI response, a short excerpt of that response together with your comment (see the KudoKids AI row in Section 9). A chore-chart import is the one exception to reviewing first: the routines and tasks read from your chart are added when setup finishes, replacing the starter chores we would otherwise add for each child the chart covers, and you can edit or delete them at any time. When an adult in your family uses Companion Studio (see Section 4l), we also send Gemini: the adult's request for the companion — the picker choices the draft was built from (including the cards a child picked, when the draft started from a child's idea card) and, if the adult wrote one, a short description — so Gemini can generate the flat concept images to choose from; any reference picture the adult uploads, so Gemini can check it and, when the adult asks for a companion close to a child's drawing or a pet, use it to shape those images (the picture is sent as it is, so anything written or drawn on it reaches Google too); the companion's name, so Gemini can speak it in one of our existing cast voices; the chosen images, the backstory and the written lines, so Gemini can suggest lines for the adult to pick from and edit, and check everything for safety before anyone else sees it; and, if we make a trailer clip for a listed companion, its images and backstory. We never add a child's name, profile, age or activity to any of these, and an automatic check on our systems compares a companion's name against your own children's profile names before it is used, so a companion never carries a child's name. AI features are available only to parents and guardians; children can never use them. Google's privacy policy: https://policies.google.com/privacy

• Google Cloud Vision (picture checks in Companion Studio): When an adult uploads a reference picture in Companion Studio, we send the picture to Google's Cloud Vision service, which reports whether it looks unsafe and whether it shows a person or a face, so we can refuse it. We keep only those yes-or-no answers, never where in the picture anything was found, and nothing about your family or a child is sent with the picture. The picture itself can show a child: a child's drawing, or a photo that breaks our no-people rule, which we then refuse and do not keep. Google's privacy policy: https://policies.google.com/privacy

• Tripo (VAST AI Research — 3D companion model generation): When an adult in your family builds a companion in Companion Studio (see Section 4l), we send the concept image that adult chose — an image Gemini generated from the adult's request — to Tripo, which turns it into the 3D companion model your family sees in the app. Tripo receives that image and nothing else: no child data, no family data, no name, no email address, and no account identifier of any kind. Tripo handles what it receives under its own terms and Privacy Policy.

• Google LLC / YouTube (video playback in the child web browser): If a parent enables KudoKids' built-in web browser and approves video sources for their child, videos from those approved channels play through YouTube's privacy-enhanced embed (youtube-nocookie.com). When your child browses the approved videos, their thumbnails load from Google's servers, and during playback Google receives the standard technical data any embedded video player receives, such as which approved video is playing; either way, Google receives the device's network address. We never send Google the child's name, profile, or anything the child types in KudoKids, and we designate this playback as child-directed — a designation we maintain in our Google API and app-store configurations — which turns off personalized advertising in the player. YouTube's rules do not let apps block the ads YouTube serves, so YouTube can still show ads matched to the video, and a creator can promote products in a video. Playback happens only for sources a parent has approved. Google processes this data under its Privacy Policy.

The KudoKids app uses no advertising network or analytics SDK, and we do not use data brokers or any service that monetizes user data. The kudokids.org website uses two analytics services — Google Analytics 4 for aggregate statistics on page visits and site actions (such as clicks, video plays, and starting or completing a purchase — never what you typed) and Microsoft Clarity for session analytics — each loaded only while analytics consent is active for that visitor: the visitor's own choice, or, for US visitors, the on-by-default setting described in Section 13, which can be switched off at any time. Separately from cookies, purchases paid through Stripe — on kudokids.org or in the KudoKids app — are counted server-side in our own Google Analytics property as strictly first-party measurement (see Section 13). Website analytics never load on any child-reachable page — including the child login, pairing, referral-landing, and school-join pages — and do not track children. On a school's join page we do keep one simple count of our own: how many times the page was opened, and how many families went on to enter an email address, so we can tell the school how its link is doing. That count is recorded in our own database with no analytics service involved, and it holds no name, email address, network address, cookie, or other identifier — only the school's join code, which of those two things happened, whether the short film on the page had been played and how far, and the time.

We do not sell personal information. We do not rent, trade, or share personal information with third parties for their own marketing purposes.

Websites a parent approves in Safe Browser (not our providers)

Websites a parent approves in Safe Browser — other than YouTube and YouTube Kids, which play through the privacy-enhanced embed described in the Google LLC / YouTube entry above — are not service providers we have retained: a parent chooses each one, and each handles what it receives under its own privacy practices, not ours. If a parent turns on Safe Browser and adds a website to the approved list, that website loads inside the app and receives, directly from the device, what any website receives from a visiting browser — the device's network address and the technical details any browser sends, such as its type and version. It can keep its own cookies and site data on the device, which KudoKids does not clear when the session ends, when the child exits, or when Safe Browser is turned off, and which stay available to that site whichever child profile on the device opens it next. It can run advertising and analytics code, including code from other companies: KudoKids does not filter the scripts, images, fonts, or tracking pixels a page loads, and the services they come from receive the same technical data. KudoKids does block navigation to, and embedded frames from, any site other than the one the child is on, which stops advertising delivered as a frame from another site — except that, so pages display, every approved site may load supporting content, frames, and pages from a fixed list of hosts we chose: Google (gstatic.com, ggpht.com, ytimg.com, googlevideo.com, accounts.google.com, consent.youtube.com), Amazon CloudFront (cloudfront.net), jsDelivr (cdn.jsdelivr.net), and Cloudflare's cdnjs (cdnjs.cloudflare.com). When a page uses one of them, that host receives the same technical data — so Google can receive a child's device address from an approved site that is not YouTube. KudoKids never sends any approved site the child's name, profile, or anything entered in KudoKids. The parent chooses every site and can remove any of them at any time in Safe Browser settings, under Sites (see Section 4k).

Affiliate and Partner Application Data

If you apply to our affiliate or partner program, we collect your name, email address, primary platform URL, audience size, platform types, and optional notes about your interest. This data is stored in Supabase and used solely to evaluate your application and manage the partnership. Affiliate application data is retained for the duration of the partnership plus 3 years for tax and legal compliance purposes. You may request deletion of your affiliate data by emailing privacy@kudokids.org.

Web-app hosting (including child mode) and providers for adults visiting kudokids.org

• Meta Platforms, Inc. (advertising — sharing of adult website-visitor data): The KudoKids website uses the Meta Pixel and Meta Conversions API (CAPI) to measure and optimize our advertising on Facebook and Instagram. Only while advertising consent is active for you (an adult website visitor — a parent or prospective customer) — your own choice, or for US visitors the on-by-default setting described in Section 13 unless you opt out — the Meta Pixel sets _fbp/_fbc cookies and sends event data about your visit (such as page views, content views, checkout starts, purchases, and clicks through to the KudoKids app or an app store) to Meta — which, like any request from your browser, reaches Meta with your network address and browser details — and when you complete a gift purchase on the website our server sends that purchase — the only event it sends to Meta — to Meta's Conversions API with a hashed email address and a hashed account identifier, together with the _fbp/_fbc cookie identifiers, for matching. The email address and account identifier are hashed before they are sent. This disclosure of hashed adult identifiers to Meta to build and optimize advertising audiences is a "sale" and a "share" of personal information under the CPRA and similar state laws (see Section 16). Meta may use this data to measure conversions, build retargeting audiences, and optimize ad delivery. You can stop this sharing at any time — withdraw advertising consent in the cookie-preferences panel, send a Global Privacy Control signal, or use our Do Not Sell or Share My Personal Information page (Section 16). Meta processes data under its Data Policy. No child data is ever shared with Meta — the Pixel and CAPI fire only on the public marketing website, never inside the child-facing app, and never on any child profile.

• Google LLC (website analytics): The KudoKids website uses Google Analytics 4 (GA4) to understand aggregate website traffic patterns while analytics consent is active for you (see Section 13). IP anonymization is enabled, and no advertising, remarketing, or demographic features are activated in our GA4 configuration. Google processes this data in accordance with its Privacy Policy. Separately, when you pay through Stripe on kudokids.org or in the KudoKids app, our server reports the completed purchase to this same GA4 property regardless of your cookie choices, marked as not for advertising use — see Section 13 for exactly what is sent.

• Microsoft Corporation (website session analytics — Microsoft Clarity): The kudokids.org website uses Microsoft Clarity to understand how visitors use the site through heatmaps and session replays (recordings of scrolling, clicking, and page navigation). Clarity loads only while analytics consent is active for you (your explicit choice, or — for US visitors — the on-by-default setting described in Section 13 unless you opt out), never loads on any child-reachable page, and text you type into forms is masked before it leaves your browser. We instruct Microsoft to deny advertising storage for every visitor — Clarity is used for analytics only. Microsoft collects this data as an independent controller and processes it in accordance with the Microsoft Privacy Statement. No child data is collected — Clarity runs only on the public marketing website, never in the app.

• Netlify, Inc. (website and web app hosting): Netlify hosts and serves the KudoKids website and the KudoKids web app. When you visit kudokids.org or use KudoKids in a web browser, child mode included, Netlify's servers receive the device's network address and the standard request details any browser sends, such as the page address and browser type, and keep them in server logs as part of standard web hosting. On kudokids.org, Netlify also estimates your approximate region from the request, which the site uses to apply the right consent defaults (Section 13). Netlify processes data in accordance with its Privacy Policy.

• Calendly LLC (scheduling): When you choose to book a call with us, a booking window from one of our scheduling providers (Calendly, or a Google Calendar appointment schedule, next entry) opens on top of our page or in its own tab. Nothing from either loads until you choose to book. Where the provider supports it, details you already typed into one of our forms (such as your name and email address) may be filled in for you, along with a tag naming the page you booked from; the button on our investor page passes no details about you. Calendly receives what is entered on its booking form (such as your name, email address, the time you pick and any answers you give) and the standard connection information any website receives, such as your network address and browser, and it sets its own cookies inside that window under its own Privacy Notice. We use bookings only to hold the meeting and follow up with you. No child data is sent to Calendly.

• Google LLC (scheduling and video calls): Schools, people applying to or working with our partner program, and other adults can book a call with us on our website, in the KudoKids app or from a link we send them; a booking window can be a Google Calendar appointment schedule (see the Calendly entry above for how a booking window opens and what it can carry), and nothing from it loads until you choose to book. Google receives what you enter on its booking page (such as your name, email address, the time you pick and any answers you give) and the standard connection information any website receives, such as your network address and browser, and its booking page also collects what it needs to run and protect itself. Google sets its own cookies inside its booking page and keeps a record of the bookings made through it, under its Privacy Policy. We hold booked calls, and the drop-in office hours and live sessions we link to in the app and in our materials, on Google Meet: Google creates the meeting link, hosts the call and receives what participants share in it, under its own privacy policy. We use bookings only to hold the meeting and follow up with you. No child data is sent through booking.

The website and adult-side vendors above are also listed, with what each receives and why, on our dated Subprocessors page. Every provider we retain that receives children's personal information is named in this Section 7 itself — the subprocessor page never substitutes for this list.

Additional providers (bundled assets and on-device-only — no user data processed)

The following providers and SDKs appear in the KudoKids app or website but do not transmit any user, family, or child data to those providers at runtime. They are disclosed here for completeness:

• Higgsfield, Inc. (static art-asset generation — internal use only): KudoKids uses Higgsfield's image and video generation APIs as an internal tool to produce companion character art, splash assets, and celebration loops for the rewards store. Generated assets are uploaded once to KudoKids' own Supabase Storage bucket or bundled with the app binary. No user-generated content, child data, or family data is ever sent to Higgsfield. Prompts sent to Higgsfield describe generic art assets only and do not contain any user-identifying information.
• Apple Inc. / Google LLC (on-device speech recognition): Voice-based educational features use the speech recognizer built into the device's operating system (Apple on iOS, Google on Android). For these features, the app requires on-device recognition — the spoken audio is processed entirely on the device, and no audio or transcript is ever transmitted to Apple, Google, or KudoKids. A parent can also dictate a message to KudoKids AI. The device recognizes the speech on the device, no audio leaves it, and the resulting text is sent as the parent's message, as described in the Google Gemini entry. On a device that cannot recognize speech on the device, the activities are still offered but the app does not listen for words; there is no cloud fallback. KudoKids does not keep any audio: the optional microphone level meter holds audio briefly on the device only to measure loudness and deletes it when the meter stops. See Section 4f.
• Apple Inc. (Quick Look AR viewer, iOS): On iOS, augmented-reality companion previews are rendered by Apple's Quick Look AR viewer (ARKit). All camera frames, world-tracking data, and rendered content remain on the device — nothing is transmitted to Apple or KudoKids. AR screenshots are saved to the device gallery only when you explicitly tap the save button.
• Google LLC (Google Workspace — company email and calendar): Google Workspace hosts our company email, including messages to privacy@kudokids.org, support@kudokids.org and our other addresses, and the calendar for calls booked with us, so it processes what you send us, which can include information about your child that you choose to include. Google processes this data under its Workspace terms, which do not allow Google to use it for advertising.
• Google LLC (Scene Viewer AR viewer, Android): On Android, augmented-reality companion previews are rendered by Google's Scene Viewer (ARCore). All camera frames, world-tracking data, and rendered content remain on the device — nothing is transmitted to Google or KudoKids.
• Apple Inc. (LocalAuthentication framework — Face ID / Touch ID): When you approve a cross-device sign-in via QR pairing or perform other sensitive parent actions, KudoKids prompts Apple's LocalAuthentication framework for Face ID or Touch ID. The biometric template is processed by Apple's Secure Enclave on the device only; it is never transmitted to Apple or KudoKids, and is never readable by KudoKids. Children are never prompted for biometrics.
• Google Fonts (typefaces bundled at build time): Some of the typefaces the app uses come from Google Fonts. Like all of the app's fonts, they are bundled into the app at build time. The app makes no network call to Google Fonts, and no user data, telemetry, or identifiers are sent. The fonts are used for visual styling only (e.g., streak banner display text and rank pill).
• Google LLC (on-device face detection — ML Kit and MediaPipe): KudoKids' optional wellness camera features (the wellness-break eye-rest "peek" detection — see Section 22b; the exercise movement mirror is a plain on-screen preview and uses no face detection) perform face detection on the device. On iOS and Android this uses Google's ML Kit on-device face detector; on the web it uses Google's MediaPipe face-landmark model, which KudoKids self-hosts and serves from its own website domain — it is not loaded from any Google or third-party content-delivery network. These components estimate only whether a face is present, roughly how the head is oriented and whether the eyes appear open; no image, video frame, facial measurement, landmark, or detection result is transmitted to Google, to KudoKids, or to any other party. One thing does leave the device on iOS and Android: ML Kit sends Google technical usage and performance metrics about the detector, including device and app information and a device identifier that is not linked to any account, used only to maintain and improve the component. They carry no image, no video frame and no face data, and nothing that names your child or your family. The web MediaPipe path sends nothing at all. These components perform face detection, never face recognition — they build no faceprint, face template, or biometric identifier, and cannot be used to identify anyone. See Section 22.

Beyond the service providers listed above, personal information may be visible to other users in the following circumstances. Some are on by default — family chat, sibling cheers and game leaderboards — and you can turn each off; friends outside your family start only when you choose a friends setting for that child, and friends of friends and linking a child across households each also record a separate consent:

• Friend discovery: If you enable friends for a child, someone signed in to KudoKids who types that child's complete code can find that child and send a friend request. Whether a parent has to approve that request depends on the friend-approval setting each family has chosen: one of the options, "auto-approve new friends", lets a child add and accept friends without asking a parent, and where both families have chosen it a friendship can form with no adult step. There is no partial-match search, no browsing, and no way to list codes in bulk; codes shorter than three characters are refused outright. Whoever has the complete code sees the child's avatar and their friend name before anything is approved — a nickname your child chose, or otherwise the words of their friend code; once a friendship is accepted, the other family sees the friend card described below -- see Section 4d, and turn friends off for that child if you would rather they were not findable at all.
• Messaging: A message, and the name of the chat it is in, is visible to the people in its conversation; a message between friends is also visible to the parents, guardians and admins of both children's families (for safety monitoring).
• Group chats with a friend's friend (optional, off by default): A parent can turn on "friends of friends" for a child, which records a separate consent before it takes effect. Only if the other child's parent has turned it on too, and only when a friend both children share is in the group, can the two children join the same group chat without either family approving the other. That child and the adults in their family then see your child's friend card -- the name on your child's profile if it passes our safety screen (otherwise a screened stand-in, such as the words of their friend code), their friend name — a nickname your child chose or the words of their friend code, which the friends list shows in place of the name — and the friend code, age, companion (avatar), color theme and current streak, and whether messaging and leaderboards are turned on for your child -- and the messages your child sends in that group. If the shared friend leaves, the two children stay in the group and can still read its earlier messages, but can no longer send messages there. Accepted friends see the same friend card. A parent can turn the setting off at any time.
• Caregiver access a parent can grant ("Kids Login"): Adults you invite as a parent, guardian or admin can, by default, use the app as your children and read all of your children's messages, including chats with friends in other families. Other invited adults, such as grandparents, nannies and extended family, cannot open a child's account unless a parent grants them Kids Login. You can turn either on or off for any invited adult in Settings → Family & members → Customize permissions. A parent who manages the family's permissions can grant a specific invited adult Kids Login access, which lets that adult use the app as the family's children — completing tasks and spending Kudo Coins as them, and reading a child's conversations and sending, editing, and deleting messages as the child, including in friend chats with children in other families. The grant is confirmed in a dialog before it takes effect, and a parent can revoke it at any time in Settings → Family & members → Customize permissions.
• Specialist access a parent can grant (a speech therapist, tutor, or occupational therapist): A parent or guardian can invite an outside adult to help with a child's practice. We do not check who that adult is or what they are qualified to do; you choose them. You choose which of your children that adult may work with, which activities they may open with them (drawing, speech practice, reading, fun games, learning games, and the Safe Browser sites and YouTube you have approved), and how long the access lasts; a parent can renew it for up to a year at a time. Outside a practice session, the specialist sees, for each child you named, their name as it appears in your family, avatar, age in whole years, speech-practice progress and targets, and — if you granted drawing — the drawings that child has saved. To practise, the specialist starts a session and hands your child the device: your child's own app opens, limited to the activities you allowed, with a banner naming the specialist and an End button. In that session the specialist works inside your child's own app, under your child's own name: anything saved is saved as your child's own work; practice targets also record who set them. A session cannot spend your child's Kudo Coins, and speech practice done in a session earns none. In the app, a specialist never sees your other children, your child's messages or friends, real-money purchases, or your billing, and cannot change your child's settings. During a session their device receives only what the activities need: your child's name as it appears in your family, avatar, age in whole years, display and activity settings, progress and coin balance. It never receives your child's last name, date of birth, sign-in PIN, notification tokens, your answers about your child, or their saved check-in history. During a session they can also see that child's Kudo Coin history (amounts, what coins were earned or spent on, and when) and their app-use record (which parts of KudoKids they used, when and for how long). They cannot type notes or health information about your child — KudoKids is not a medical record and provides no health services. Before the invitation is sent, you choose the children, the activities and the period, and tick an acknowledgment naming the children it covers; the specialist accepts a notice of their own before their access begins. A parent can change what they can use, change which children they see, or remove them at any time in Settings → Family & members, and the access ends by itself when the period you chose runs out.
• Multiplayer games: While friends are on, a child can play a game with a friend the parent has accepted, including a friend in another family; that friend sees the child's friend card and how the child plays and scores in that game, and we keep the game, including its moves, for the period in Section 9.
• Another household you link a child to: if a parent links a child to another family on KudoKids (for example, a co-parent's household), that family receives the child's name, age, date of birth and theme, sees the child's Kudo Coin balance, streak and activity from then on, and can receive the routines, rewards and settings a parent chooses to send. Everyone in that family can see the child as a member of it. Before the link is made, the parent who enters the code sees only the first initial of the child's name and of the sharing family's name.
• Leaderboards: Unless a parent turns off Leaderboards for a child in Settings → Kid features → Friends & Messaging, while Friends & Messaging is on for the family that child's game scores and rankings appear on the global game leaderboard, which anyone signed in to KudoKids can view — not only the child's own friends. The child's name is shown only to their own family and accepted friends; every other viewer sees the entry as "Anonymous."
• Shared screen-time sessions: If the parent enables Shared screen-time, a child starting a shared session can see each sibling’s available screen-time minutes and Kudo Coin balance (see Section 4i). This visibility stays within the family.
• Guardian contact sharing (adult data): When an adult in each family has approved a friend connection between their children, the two families become linked (a friendship that was auto-approved does not link families). The owner and admin guardians of each linked family can then see each other's family name, display name, first and last name, and phone number (if one has been added in Settings → My Profile), so the grown-ups can reach each other about their kids. They can also message each other in KudoKids and send each other game invites, which arrive as a notification and an inbox item. Only owners' and admins' details are shared — never those of other family members such as grandparents or caregivers — and this sharing is disclosed on the approval screen before you approve.

Theme Worlds rooms. Inside a theme-world room, the children in the room see each other's companions move, the set gestures and stickers they send, and the name and emoji shown for each child (Section 4m). Today a room holds only children from one family; a child from another family can join only after each child's parent gives a separate consent we record.

Can your child make their own information public? No. KudoKids has no public posting, no public profile, and no open comment area. Nothing your child writes, draws, or records is published to the open internet. Outside the situations above, a child's information is visible to someone who is not a signed-in KudoKids user only when a parent chooses it: a parent testimonial you allow us to publish can show your child's first initial (or first name) and age (Section 21), and, a companion an adult chooses to list publicly in Companion Studio never names a child (Section 4l). Each of the situations above is controlled by a parent, and shared screen-time sessions stay inside your own family.

If your family joined through a partner's link or code, that partner sees, for each payment it earns a commission on, the amount paid and when, so it can check its commission. We do not show a partner your name, email address or account, or anything about your child.

We may also disclose personal information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect the safety of a child.

We retain children's personal information only for as long as reasonably necessary to fulfill the specific purposes for which it was collected, and never indefinitely. This section is our written data-retention policy. Each category below is collected for the purposes described in Sections 4 and 5 — to run the feature that produces it and to let parents review their child's activity, progress, and wellbeing — and that is also the business need for retaining it: family-facing records stay available for as long as they remain useful to the family, up to the period shown, while technical records (access logs, push tokens, notifications) are kept only long enough to operate and secure the Service. Activity records that show a child's growth — messages, saving-helper records, game sessions, the assessments you complete, streak adjustments, Kudo Coin transactions, device-timer sessions, and Safe Browser sessions — are kept until the child's profile is deleted or after 24 months of family inactivity, so that you can understand and support your child's growth over time. Deletion works one of four ways: categories marked "(automatically deleted)" are removed by scheduled purge jobs when their period expires; every other period is the maximum we will retain that data; if your family stops using KudoKids altogether, everything in the table is deleted after 24 months of inactivity regardless of the period shown (see "If your family stops using KudoKids" below the table); and in every category, deleting the child's profile — or emailing privacy@kudokids.org — deletes the data sooner. Apart from the companion records described below the table, the only exceptions are your parent login account and the campaign tags stored with it, which you can delete yourself at any time by deleting your account, records of emails we sent you (which follow their own row), and records about adults' purchases and our consent records, which we must keep to meet tax, accounting, and other legal obligations and to handle refunds and disputes: purchase, billing, refund, and dispute records; referral records; Stripe payment records we review by hand; App Store purchase notifications while a partner commission is pending; and consent records. Each of these keeps the period shown in its row, even after inactivity or a deletion request. The table also covers the parent- and family-level records we keep alongside children's data, so your whole family's data is in one place.

Two companion records are the exception to the table's periods: a companion another family has already added stays with that family, and our record that a listing existed is kept 3 years. Neither carries your child's name, profile, or anything your child typed or picked.

When a parent deletes a child's profile, all associated personal information is permanently removed from our systems. We do not retain copies after deletion except for consent records, which are retained for compliance documentation purposes.

When a parent deletes the whole family (Settings → Delete Family), the family is removed right away; for 30 days we can restore it if you ask us, and then, unless a legal hold applies, we permanently delete everything the family held, including all of your children's personal information, except the records this section says we keep (such as consent and purchase records). When you delete a family, we ask you to pick a reason from a short list that includes "Prefer not to say"; we use it to improve KudoKids, and after the family is permanently deleted we keep only an anonymous count of reasons by month, with no link to your family or to you. If a subscription you pay for as the account owner (or one whose payer no longer has an account) can still charge — including a card plan we set to end at its paid period's end, or an App Store plan, which only you can cancel through Apple — we delete your children's information on schedule but keep the family's other records until that subscription ends; we email you how to cancel an App Store plan. A subscription another adult pays for becomes theirs and does not delay this deletion.

If the account owner deletes their own KudoKids account instead of using Delete Family, the family and all of the children's personal information are deleted permanently at once and cannot be restored. When you delete your own KudoKids account, we keep the records we still need, with the link to your account removed: purchase and billing records, referral records and the rewards they earned, and the record of changes you made in a family, partner, or school account that continues. Records of emails we sent you keep no address or subject once your account is deleted, and are deleted 24 months after sending (emails about an investor-interest submission follow Section 14 instead). A purchase record keeps the details we received at checkout (see "Purchase and billing records" in Section 16). The support requests you filed, and your own messages in other support requests, are deleted with your account, even when the family continues; a support request another adult filed stays with that family, partner, or school account.

Scheduled purge processes enforce every period marked "(automatically deleted)" above. For every other category, the period shown is a commitment — the longest we will retain that data — and you never have to wait for it: deleting the profile, or emailing us, removes the data at any time, except the adult purchase and consent records listed as exceptions above, which keep the period shown.

If your family stops using KudoKids

We are not permitted to keep a child's personal information indefinitely simply because nobody has asked us to delete it. So if no one in your family uses KudoKids (opening the app, choosing a profile, using screen time, earning or spending Kudo Coins, or updating a task) for 24 months, we permanently delete your children's personal information and the rest of your family's records — everything in the table above except the exceptions listed above the table, including the categories whose period would otherwise read "until profile deletion." A lifetime purchase stays on the purchaser's account, and if a subscription the account owner pays for (or one whose payer no longer has an account) can still charge, including one already set to end at the close of its current billing period, we keep your family's other records (not your children's information) until it ends; a subscription another adult pays for becomes theirs and does not delay this deletion.

We look at your household, not at each child separately. Anyone on the account using the app — you, another parent or guardian, or any of your children — keeps the whole family active and starts the 24 months over. A child who has not used KudoKids in a while loses nothing while the rest of the family is still using KudoKids.

We warn you twice first. We email the parent who holds the account 30 days ahead, and again 7 days ahead. If that email address can't receive our messages, we still delete the data at the end of the 24 months. Each email carries a one-click link that resets the clock for another 24 months — you can use it as often as you like, and clicking it more than once is safe. Any use of KudoKids by someone in your family — opening the app, choosing a profile, using screen time, earning or spending Kudo Coins, or updating a task — resets the clock too. If nobody in your family does any of these and nobody clicks the link, we delete your children's personal information.

What is kept afterward. Before deleting, we add your children's activity and age group to anonymous running totals (counts of families and of children by age group, tasks completed, Kudo Coins earned and spent, games, screen time, stories, drawings, wellness activities, and messages). Those totals carry no family, profile, or child identifier and no dates, and we do not report any of them until at least five families have been combined into them, so a reported number can never describe a single household.

What stops this from running. We do not delete your children's information while there is a legal hold on your account (a preservation obligation such as litigation or a regulatory inquiry), or while your family is part of an active school program. A founding or lifetime membership does not stop it: we keep your membership and your parent account, but your children's information follows the same 24-month rule.

What this does not delete. Your parent login account, your purchase and payment records, and our consent records are kept (see the exceptions above the table); a subscription that can still charge keeps your family's other records until it ends.

One limit: deletion is not instant everywhere at once. When the job runs it removes your children's information from our live systems, but our database backups are written on their own schedule and expire on their own schedule, so a copy can remain in a backup until that backup expires.

We use reasonable administrative, technical, and physical safeguards to protect the confidentiality, security, and integrity of the personal information we collect, appropriate to its sensitivity and to the size and nature of our business. We review those safeguards as our systems change.

We do not publish the details of our security controls. Describing specific mechanisms publicly would help anyone trying to defeat them, and any list we published would go out of date the first time we improved something. If you are a school, district, or partner evaluating KudoKids and need specifics, write to privacy@kudokids.org and we will answer in writing under the terms of our agreement with you.

No system is perfectly secure. While we implement reasonable safeguards, we cannot guarantee absolute security. If we discover a data breach affecting children's personal information, we will notify affected parents without unreasonable delay, and in no event later than 72 hours after discovery, and report to applicable authorities as required by law.

Parents and guardians have the following rights:

• Access: Review all personal information we hold about your child, either in-app or by contacting us.
• Correction: Update or correct any inaccurate information through the app or by contacting us.
• Deletion: Request permanent deletion of your child's profile and the information associated with it, except the consent records Section 9 says we keep.
• Refuse collection: Opt out of any optional data collection category at any time without affecting access to core features.
• Revoke consent: Withdraw consent for data collection, which will result in deletion of the associated data, except the records Section 9 says we keep.
• Data export: Export your family's data in JSON format from the parent dashboard.

To exercise any of these rights, use the parent dashboard in the app or email us at privacy@kudokids.org. We will respond within 30 days.

We may update this Privacy Policy to reflect changes in our practices or legal requirements. When we make material changes, we will:

• Post the revised policy on this page with an updated effective date.
• Send notice via email to the address associated with your account.
• Display a notice within the app.

If we make material changes to how we collect, use, or share children's personal information, we will obtain new verifiable parental consent before implementing the changes.

A change is material when it changes what we collect, how we use or share it, or the rights and choices you have. When a change is material, the app asks you to review and accept the updated policy. Corrections and clarifications that do not change our practices or your rights are published without asking you to re-accept. We archive every version of this policy we have published.

Which optional cookies are active on kudokids.org depends on where you are visiting from:

• Visiting from the United States: analytics and advertising cookies are on by default. We show a notice on your first page view (our "notice at collection" — see Section 16), and you can switch either category off at any time with one click — from that notice, from the Do Not Sell or Share My Personal Information page, or from Cookie Settings in the website footer. An opt-out never expires: once you switch a category off, we keep it off unless you yourself later switch it back on.
• Visiting from anywhere else — including the European Economic Area, the United Kingdom, and Switzerland: analytics and advertising cookies stay off until you affirmatively turn them on in the cookie banner. If we cannot determine your region, we treat you the same way (opt-in).
• Global Privacy Control: a GPC signal from your browser automatically opts you out of analytics and advertising cookies in every region (see Section 16). Advertising stays off for as long as the signal is present. Analytics also switches off the first time we see the signal in your browser, even if it was on for you before; because analytics is not a sale or share, an analytics choice you make yourself in Cookie Settings after that is honored, even while the signal is on.

To decide which model applies, we look up your approximate region (country level) once per visit from your network address. Only a coarse region bucket (US / Europe / other) is kept, in your browser's session storage for the current tab; the country code is not stored with any data about you. We do not use cookies in the KudoKids mobile app.

Analytics cookies (on by default for US visitors; opt-in elsewhere)

Advertising cookies (on by default for US visitors; opt-in elsewhere)

Essential cookies and local storage (always active)

Alongside these we keep a few small first-party items in your browser that make the site work — for example a link token while you manage your email preferences, a checkout reference while a confirmation page loads, flags that stop us counting the same purchase twice or re-showing a banner you dismissed, a flag marking our own team's visits so they are left out of our analytics, and your signed-in session. They stay on your device or go only to us, and are never used for advertising.

While advertising consent is active for you — your explicit grant, or the US default unless you opt out — the Meta Pixel records the pages you view and the actions you take on our website, such as viewing content, starting a checkout, completing a purchase, or clicking through to the KudoKids app or an app store — which, like any request from your browser, reaches Meta with your network address and browser details — and when you complete a gift purchase on the kudokids.org marketing website our server sends that purchase — the only event it sends to Meta — to Meta's Conversions API with a hashed email address and a hashed account identifier, together with the _fbp/_fbc cookie identifiers, for improved event matching. This is a "sale"/"share" of personal information under the CPRA and similar state laws (see Section 16). You can withdraw advertising consent at any time via the cookie-preferences panel in the website footer; a Global Privacy Control (GPC) signal from your browser will also automatically suppress both the Meta Pixel and the server-side Conversions API send (see Section 16). Advertising cookies and CAPI never fire on a child profile or inside the app — they exist only on the public marketing website and process adult-visitor data only.

Links to the app stores. A link on our website to the App Store or Google Play tells Apple or Google which part of our site the click came from, so their install reports show us which pages lead families to the app. While analytics or advertising cookies are on for you, the link also carries campaign tags you arrived with (the source, and for Google Play also the medium and campaign name). Apple and Google handle this under their own privacy policies, and nothing about a child is included.

Server-side purchase measurement (Stripe checkouts — no cookies required)

When you complete a checkout with us through Stripe, on kudokids.org or in the KudoKids app — a Premium subscription or lifetime purchase, a lifetime gift purchase, or a founding purchase while that campaign was open — our server reports the completed purchase to our own Google Analytics property. For a subscription, only the first payment is reported, never a renewal. Purchases are made by adults, and nothing about a child is included in what is sent. This happens regardless of your cookie choices, because it is first-party measurement of our own sales: our Google Analytics property is not linked to Google Ads, and each report always marks its advertising signals as denied, so it is not used for ad personalization or cross-context behavioral advertising.

What is sent to Google: what was bought, the amount paid and the currency (and any tax, where it is shown separately); a transaction reference; the campaign tags that came with your visit; and a pseudonymous identifier — the Google Analytics identifiers already in your browser if analytics consent was active for you, otherwise a random-looking identifier derived from the checkout that is not linked to any cookie on your device. Your name, email address, and payment details are never sent to Google. To make this measurement work, those pseudonymous identifiers (and Meta's _fbp/_fbc values while advertising consent is active for you) and the campaign details described for kk_attr_v1 (earlier founding_attribution) above travel with your checkout through Stripe, which already processes your payment and holds these values for us as part of that checkout. Our server sends a purchase event to Meta only for gift checkouts completed on the kudokids.org marketing website, and only while advertising consent is active for you (see Section 7); no purchase event is sent to Meta from inside the KudoKids app.

Booking a call (scheduling windows)

If you choose to book a call with us, a booking window or page from one of our scheduling providers (Calendly or a Google Calendar appointment schedule) opens on top of the page or in its own tab, on our website, in the KudoKids app, and in links we send. Nothing from either loads until you choose to book, and closing it ends it. Inside it the provider sets its own cookies and applies its own settings (Calendly also shows its own cookie notice), so the analytics and advertising categories above do not cover them. Section 7 lists what each provider receives. While analytics consent is active for you, Google Analytics records that a booking window was opened and from which page, never what you enter in it.

The KudoKids website (kudokids.org) collects information from adults in several places, each described below. The website is not where we collect children's information -- that happens only inside the KudoKids app. The one thing the website records that can involve a page a child might open is the browser type on a referral link, described under "Referral link visits" below.

Information collected via the waitlist (closed)

We no longer run a waitlist: families now sign up directly in the KudoKids app, and the waitlist form has been removed from the website. This is what the form collected while it was open:

• Name: First and last name (required)
• Email address: Used for authentication and waitlist communication (required)
• Phone number: Country code and number (optional)
• Location: Country and state/province (optional)
• Interest level: How interested you are in KudoKids (required)
• Referral source: How you heard about us (optional)
• Feature preferences: The three features you are most excited about (required)
• Early-access interest: Whether you would like early (alpha or beta) access, and — only if you ask for early access — a short note on why (required in that case)
• Referral tracking: If you arrive via a referral link, we store the referrer's code (referred_by URL parameter) to credit the referring user
• Marketing consent: Whether you agreed to receive product updates, tips, and offers from us by email
• Age and legal confirmation: Your confirmation that you are 18 or older and agree to this policy and our Terms of Service, and when you gave it (required)
• Advertising identifiers: if advertising cookies were active for you, the Meta _fbp/_fbc values in your browser (see Section 13); these have since been deleted.

Information collected via the school and district inquiry form

If you work at a school or district and use the form on our schools page to ask about a pilot or about pricing, we collect:

• School or district name: The school or organization you are asking on behalf of (required)
• Your name and role: Your name, and the role you pick from the list — principal, superintendent or district leader, business manager, counselor or teacher, PTA or PTO, or other (required)
• Work email address: How we reply to you (required)
• State: The US state your school is in (required)
• Approximate students enrolled: A size band. This is the number that sets your quote (required)
• What you are exploring: A pilot for one grade or school, funding the year for every family, or gathering information for a board packet (optional)
• Notes: Anything you choose to tell us, such as a deadline, a board meeting date, or a question you want answered before the call (optional)
• Your acknowledgement: That you ticked the box confirming your information would be handled in line with this policy and our Terms of Service, and the date and time you ticked it

We usually send a confirmation to the email you gave. If the form cannot reach us, the page offers to open your own email program with your answers filled in, so you can send them yourself.

We use this to reply to you with pilot or package pricing, to answer what you asked, and to set up the partnership if your school decides to go ahead. We do not use it for advertising. We never ask you for information about a student, and no student list or student record ever passes from your school to us. If you book a call from this form, the name and email you typed may be filled in on the scheduling provider's booking form for you, and the provider receives what is entered there — see Sections 7 and 13.

School program parent surveys

If your family joins KudoKids through a school program — a school pilot or a school-sponsored annual licence — we ask parents — never children — to answer short surveys about your household's routines: one when you join and, during a pilot, a check-in about a week in, again at about a month, and a last one at about three months that closes the pilot out (an annual licence asks the join survey only). Your answers are labeled with your family's pass code rather than your name; because that code is also your family's access code, we can connect your answers to your account, so treat them as identified to us rather than anonymous. Your child's school never sees any individual family's answers — it receives only combined results across participating families. Raw survey responses are kept for 24 months and then deleted, and you can request deletion of your responses at any time by emailing privacy@kudokids.org.

Gift names and notes

If you buy a lifetime membership as a gift (including a founding membership bought as a gift while that campaign was open), you can add a "from" name (up to 40 characters) and a personal note (up to 280 characters) — either one note shared across the purchase, or a different note for each family you are gifting. Gift purchases can only be made by buyers who confirm they are 18 or older. If no KudoKids account uses the buyer's email address, we create one with that address and the buyer's name so the purchase is linked to an account the buyer can sign in to. We store the name and note with your purchase record and show them to each receiving family in their gift email, on the gift claim page, and on the gift keepsake page. You can edit or remove your name and any note at any time from your founding dashboard, or by emailing privacy@kudokids.org.

Other information collected on the website

• Founding page email capture (closed): While the founding campaign was open, you could enter your email address on the founding page to be kept informed about founding availability. We no longer collect this, and we are deleting the addresses collected earlier.
• Referral link visits: When you open a referral link (kudokids.org/r/...), we record the referral code from the link and your browser's user-agent string so the referring family gets credit if you sign up.
• Support requests: If you send a support request from the website while signed in, we store your message, the page you sent it from, and your browser type with your family's account so we can reply. Your message may include details you choose to share about your child; we use them only to answer your request. If you are not signed in, the form hands you off to email instead.

Retention

Waitlist data is retained until the waitlist campaign concludes or 24 months from signup, whichever is sooner. The waitlist has now closed. We are deleting waitlist information — including forms that were started and not finished — that a KudoKids account does not need. If you were still waiting when it closed, the sign-in you created already works, and we may email you once to say so. If you joined the waitlist and use KudoKids, the information your account needs, including any email opt-in you gave on the waitlist, is kept as account information under Section 9 instead, unless you have since chosen otherwise; Section 3 explains your email choices and how to change or withdraw them. You may request deletion of your waitlist data at any time by emailing privacy@kudokids.org.

School and district inquiries are kept for 24 months from our last contact with you if the conversation does not become a partnership. If your school or district does go ahead with a pilot or a partnership, we keep the inquiry alongside the partnership record for as long as the partnership lasts plus 3 years, for tax and legal compliance — the same as the partner records described in Section 7. You may request deletion at any time by emailing privacy@kudokids.org.

Purchase records — including gift names and notes, and the campaign details that came with a gift purchase (its campaign tags, referring site and landing page) — are kept for as long as we need them for tax, accounting and legal compliance. Founding-page email captures, referral-link visit records, and website support requests are kept only as long as needed for their purpose, and you may request deletion of any of them at any time by emailing privacy@kudokids.org.

Information collected via the investor-interest form

If KudoKids is considering an offering of securities, we may publish a page describing the company and inviting you to tell us whether you would be interested. Submitting that form is not an investment, and no money is requested or accepted through it. We collect:

• Name: First and last name (required)
• Email address: Used to reply to you about the round (required)
• Location: Country, and state if you are in the United States (required). We ask because the rules that would apply depend on where you live
• Interest level: How interested you say you are (required)
• Indicated range: A non-binding range you say you might consider if a round opened. The form asks everyone to answer, and "Not sure yet" is one of the choices — choosing it records nothing. This is an indication of interest only. It is not an amount owed, not a commitment, and creates no obligation of any kind
• Self-reported investor status: Whether you describe yourself as an accredited investor (the form asks everyone to answer, and "Not sure" is one of the choices; we never infer an answer either way). This is your own statement. We do not verify it and we do not use it to make any determination about you — any such determination, if a round ever opens, is made by the registered intermediary, not by us
• Your relationship to KudoKids: For example whether you are a parent, a user, or neither. The form asks everyone to answer, and "Prefer not to say" is one of the choices — choosing it records nothing
• Whether you could open a door for us, and how: The form asks everyone whether they could help beyond money — an introduction to your child’s school, spreading the word, or advice and testing — and "Not right now" is one of the choices; choosing it records nothing. If you pick one of the ways to help, an optional box lets you describe it in your own words
• What you tell us in your own words: Why the company matters to you, if you choose to write anything (optional)
• Referral source: How you came across the page. The form asks everyone to answer, and "Prefer not to say" is one of the choices — choosing it records nothing
• Consent record: That you agreed to this notice, and the date and time you did
• Age and legal confirmation: Your confirmation that you are 18 or older, and when you gave it (required)
• Update preference: Whether you separately opted in to a monthly written update. This is a separate choice from submitting the form — you can submit without it, and it is never pre-selected
• Page version and page address: An identifier for the version of the page you read and the address of the page you submitted from, so our records can show which description of the company you actually saw

What we do not keep with your submission: we do not store your network address, your browser type, or how long you spent on the page alongside the answers above. Your network address is used for a moment, to limit how often the form can be submitted, and is not written to your record (our hosting provider's own request logs record it briefly, as any web server's do — see Section 7). Website analytics are a separate matter and are described in Section 13.

Who sees it: Your submission is stored in our own systems — on the infrastructure described in Section 7 — and is visible only to KudoKids administrators. No new third party receives it beyond the email provider described in Section 7, which delivers the two messages described above. It is not sold, and it is not shared with advertisers. If a round proceeds, we may need to share your contact details with the registered intermediary that runs it, and U.S. securities rules would then also require us to file the page you read with the Securities and Exchange Commission as part of the offering paperwork — that filing is a copy of what we published, and it does not contain your submission or your name.

After you submit: we attempt one automatic confirmation email to the address you gave. It restates the required notice, asks for nothing, and at most one is sent to the same address in a day — and it may not be sent at all if your address has previously bounced or asked us not to be emailed, or if our own sending limits are reached. KudoKids is also notified of your submission so a person actually reads it. Both messages are delivered by the email provider described in Section 7, and our email delivery log keeps the fact that each was sent; that log entry is deleted or de-identified on the same basis as the submission itself — the three-year nightly deletion, and the on-request deletion described below. If the confirmation never arrives, your answer is still recorded.

If the form does not go through: if our server cannot be reached, the page offers to open your own email program with your answers already written out, so you can send them to us by hand. That is your choice, and it is a different route: an email you send travels through your own email provider and arrives in a KudoKids mailbox, rather than going straight into the system described above. You can always simply not send it.

Children: This form is for adults. We do not knowingly collect investor-interest information from anyone under 18.

Analytics on this page: While analytics consent is active for you, Google Analytics records that the form was sent (with the version of the page) and, if you open the booking calendar, that it was opened. Neither record carries your answers, your name or your contact details, and your answers on this form are never sent to Meta.

Retention — investor-interest form

We keep investor-interest information for three years from the date you send it, and then we delete it — a scheduled job runs every night and removes anything older. We keep it that long because U.S. securities law treats the page you responded to as an offer of securities, and the period for bringing a claim about an offer runs from when the offer was made — that is, from when you read the page — rather than from when any round later ends.

If your answers arrived by email instead — the send-by-hand route described above — that email lives in a KudoKids mailbox, which the nightly job does not reach. We delete it on the same three-year basis ourselves, and sooner if you ask us to.

You can ask us to delete your investor-interest information at any time by emailing privacy@kudokids.org. Two things you should know.

What we delete when you ask: everything that identifies you or that you wrote — your name, email address, location, interest level, indicated range, self-reported investor status, your relationship to KudoKids, whether and how you offered to help, anything else you wrote in your own words, and how you came across the page. We also stop sending you the monthly update.

What we keep after that: the fact that a submission was made, the date and time, the record that consent and the 18-or-older confirmation were given and when, and which version of the page it came from, together with the page address — with everything that identifies you removed, so the record can no longer be traced back to you. We keep that much so our record of the offering stays complete.

KudoKids is operated from the United States and the Service is directed to residents of the United States. We do not market or target the Service to residents of any other country. The Service and our website are technically accessible from outside the United States, and we do not currently restrict foreign access; if you access or purchase the Service from outside the United States, you do so on your own initiative and are responsible for compliance with your local laws.

Our servers and data infrastructure are located in the United States. If you access KudoKids from outside the United States, your data will be transferred to and processed in the United States, where data protection laws may differ from those in your country. The sections that follow provide additional information for residents of particular places.

If you write to us from outside the United States about a possible offering of securities. The page described in Section 14 is open to readers anywhere, and we would rather collect an honest answer about where our readers are than pretend the question does not arise. If you are outside the United States — including in the European Economic Area, the United Kingdom, Switzerland or Canada — and you submit that form, we process your details on the basis of our legitimate interest in replying to people who ask us about a possible offering and in keeping a complete record of that offering, where those interests are not overridden by your rights — and, for the monthly written update, on the basis of your separate consent, which you can withdraw at any time. We use them only for the purpose described in Section 14. You can object to this processing, or ask us to delete your details, by emailing privacy@kudokids.org. None of this means the Service is offered where you live.

State privacy laws — including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and the Texas Data Privacy and Security Act — give residents of those states rights over their personal information. Rather than run a different process for each state, we extend one baseline of rights, on the terms below, to every United States resident.

Your rights

• Know and access: ask us what personal information we collect, use, disclose, sell, or share, and receive a copy of your personal information.
• Correct: ask us to correct inaccurate personal information.
• Delete: ask us to delete your personal information, subject to legal exceptions, which include the purchase, billing, refund, and dispute records and the consent records we must keep (see Section 9).
• Portability: receive your personal data in a portable, machine-readable format. The parent dashboard's JSON export does this for your family's data at any time.
• Opt out of sale, sharing, and targeted advertising: opt out of the one data flow that qualifies (described below) and of any processing for targeted advertising. We do not profile anyone in furtherance of decisions that produce legal or similarly significant effects.
• Limit sensitive personal information: limit our use of sensitive personal information to what is necessary to provide the Service (we already do this for everyone — see below).
• Appeal: appeal any decision we make on a privacy request.
• Non-discrimination: exercise any of these rights without being discriminated against.

How we handle requests

To exercise any of these rights, email privacy@kudokids.org, or use the parent dashboard for access, correction, deletion, and export. We will verify your identity before acting on a request; if you are an authorized agent, include proof of authorization with the request. For every request, wherever in the United States you live:

• We acknowledge your request within 10 business days.
• We respond substantively within 45 calendar days of receiving it. If we reasonably need longer, we may take one extension of up to 45 additional days — and we will tell you within the first 45 days, with the reason.
• An opt-out of sale, sharing, or targeted advertising takes effect within 15 business days, and we will not ask you to opt back in for at least 12 months.
• If we decline a request, our response explains why and how to appeal.

Right to appeal

You may appeal any decision we make on a privacy request by replying to it, or by emailing privacy@kudokids.org with the subject line "Privacy Request Appeal" — appealing is never harder than making the original request, and every denial notice tells you how. We respond to appeals in writing within 45 days, with the reasons for our decision. If we deny your appeal, our response includes how to contact your state attorney general to submit a complaint.

Sale and sharing of personal information — and how to opt out

KudoKids does share certain personal information of adult website visitors (hashed identifiers and event data) with Meta Platforms for advertising measurement, audience-building, and optimization. Under the CPRA this is a "sale" and a "share" for cross-context behavioral advertising, and under other state laws it is processing for targeted advertising. We never sell or share any child's personal information, and this advertising sharing never occurs inside the app or on any child profile — only on the public kudokids.org website. For US visitors, this advertising sharing is on by default (see Section 13) unless and until you opt out. You can opt out at any time via our Do Not Sell or Share My Personal Information page, by declining advertising cookies in the cookie-preferences panel, or by enabling Global Privacy Control (which we honor as a valid opt-out — see "Global Privacy Control" below).

Notice at Collection for Website Visitors (Cal. Civ. Code §1798.100(a))

When you visit kudokids.org we collect, via the cookies described in Section 13: identifiers (pseudonymous cookie and device identifiers such as _ga, _clck, and _fbp) and internet or other electronic network activity information (pages viewed, clicks and scrolling, session interactions, and ad-click identifiers). We use them for two purposes: website analytics (understanding aggregate traffic and improving the site) and advertising measurement and optimization (measuring whether our Facebook and Instagram ads work). For visitors in the United States, both categories are collected by default, and the advertising portion is "shared" with Meta Platforms for cross-context behavioral advertising unless and until you opt out. We do not sell personal information for money, we do not use or disclose sensitive personal information to infer characteristics, and we never sell or share children's personal information. Separately from these cookie-derived categories, the forms on this site collect the information you type or select in them — identifiers such as your name, email address, and phone number, your general location (country and state), professional or employment-related information (your school or organization and your role), the answers you choose on a form (for the investor-interest form, including your self-described investor status and a non-binding range), and any free text you choose to write — for the purposes described with each form in Section 14; each page with a form links to this policy, at least in the page footer. When you buy on kudokids.org or in the KudoKids app, we also collect commercial information (what you bought and what you paid), the contact details the checkout collects, and the campaign details described in Section 13, to complete and account for the purchase and to learn which channels lead to purchases. That includes the purchase report to our own Google Analytics property that is made regardless of cookie choices; it is not a sale or share. The Meta purchase event is part of the advertising sharing described above and follows the same opt-out. When you create a parent account in the KudoKids web app after following a link that carries campaign tags, we also collect those tags with your new account (internet or other electronic network activity information) to learn which channels and campaigns bring families to KudoKids; they are not sold or shared. Retention: per-cookie lifetimes are listed in Section 13 and the Cookie Policy; information you submit through a form on this site is kept for the period stated with that form in Section 14 (for the affiliate and partner application, in Section 7); purchase records and the campaign details kept with a gift purchase are described in Section 14; campaign tags stored with a new parent account are kept until the account is deleted (Section 9); how long our providers retain the corresponding server-side data is governed by their own policies (Section 7). You can opt out at any time via any of three surfaces: the first-visit notice banner, the Do Not Sell or Share My Personal Information page, or Cookie Settings in the website footer.

Purchase and billing records

When you buy a plan, we collect commercial information (the plan, amounts, dates, billing country, and payment, refund, and dispute records) and identifiers (the buyer's email address, Stripe's reference numbers for the purchase, and, for founding and gift purchases, the buyer's name and any gift name and note), and, for every purchase through Stripe, the record of the confirmations the buyer gave at checkout (that they are an adult, which we ask on our website, and, for a subscription, that they agreed to automatic renewal), with when they were given and the browser or app details the buyer's device sent, to process the purchase and meet our legal obligations. Retention: as long as we need them to meet tax, accounting, and other legal obligations and to handle refunds, disputes, and chargebacks, including after account deletion (with the link to your account removed). A record of a payment or subscription we have to review by hand is kept, with only Stripe's reference numbers for it, for the same period. Section 9 lists every other retention period. When you make a gift purchase on kudokids.org while advertising consent is active for you, your hashed email address and account identifier, the _fbp/_fbc identifiers, and what you bought are shared with Meta Platforms (see Section 13) to measure our advertising; this is a "sale" and "share" under the CPRA, and you can opt out as described in "Sale and sharing of personal information — and how to opt out" above.

Sensitive personal information

KudoKids does not use or disclose sensitive personal information for any purpose other than providing and securing the Service; we do not "sell" or "share" sensitive personal information.

Financial incentive notice (referral program)

KudoKids offers a referral program: when someone signs up for KudoKids using your referral code or link, we grant one free month of premium access to your family — and one free month to the new family as well. Because the reward is tied to providing personal information — the referral relationship — this is a "financial incentive" program under California law. Its material terms:

• Summary of the incentive: one free month of the premium subscription for your family, granted when a person you refer signs up using your code or link; the family that signs up with your code also receives one free premium month. Referral months are capped at three per family, on each side. Two further rewards follow from the same referral relationships: at five referrals you receive an exclusive companion skin and a discount on the lifetime plan, and at ten qualifying referrals you receive a free lifetime premium pass.
• Material terms and the personal information involved: the program uses your referral code (which identifies you as the referrer) and the fact that the person you referred created an account with it, and, for the ten-referral lifetime pass, the payments made by the person you referred (net of refunds and lost payment disputes) and whether that person still has a paid Premium plan 90 days after their first qualifying payment. No information about children is used. The categories implicated are identifiers (your referral code and the account created with it) and commercial information (that person's payments, refunds, lost payment disputes, and whether that person still has a paid Premium plan); no other category of personal information is implicated. The premium-month reward is granted at signup — the person you refer does not need to become a paying subscriber. The two milestone rewards count differently: the five-referral reward counts signups, while the ten-referral lifetime pass counts a referral once the payments made by the person you referred — subscription payments, one-time purchases, and App Store payments alike — net of any refunds and lost payment disputes, reach a minimum amount we set (currently $10), and that person still has a paid Premium plan 90 days after their first qualifying payment (a free or gifted pass does not count). The referred person's payments count net of any refunds and lost payment disputes, so a refund or a lost dispute can stop that referral from counting. Those caps and thresholds are the complete set of limits that apply.
• How to opt in: you opt in by sharing your referral link or code. Having an account does not enroll you by itself.
• Your right to withdraw: you can stop participating at any time — stop sharing your link, or email privacy@kudokids.org and we will remove you from the program. Withdrawing never affects your access to the Service.
• Value of the incentive and how we calculate it: our good-faith estimate of the value of the data provided is the cost of the premium months, companion skin, plan discount, or lifetime pass we grant, calculated from the retail price of each. The incentive is reasonably related to that value because each referral introduces approximately one new subscribing family to us.

Global Privacy Control

We honor the Global Privacy Control (GPC) signal. If your browser or browser extension enables Global Privacy Control, we treat it as a valid opt-out of sale and of cross-context behavioral advertising under applicable state laws (including the CCPA/CPRA and the Colorado CPA), and we will automatically suppress both our advertising tags — the Meta Pixel and the server-side Meta Conversions API send — and our analytics cookies. Because GPC suppresses the advertising tags, no advertising-related sharing of your data with Meta occurs while GPC is active, and the advertising control stays switched off for as long as your browser sends the signal. The first time we see the signal in your browser, analytics is switched off too, even if it was on for you before; because analytics is not a sale or share, an analytics choice you make yourself in Cookie Settings after that is honored, even while the signal is on.

Do Not Track

Our website does not currently respond to Do Not Track (DNT) browser signals, as there is no industry-standard protocol for DNT. However, you can manage your tracking preferences through our Cookie Settings (available in the website footer) or by enabling Global Privacy Control in your browser.

Not currently applicable. KudoKids is not offered in, directed to, or marketed in the European Economic Area, the United Kingdom, or Switzerland, and we do not knowingly collect personal data from individuals located there in connection with the Service. That is a statement about the Service. It does not cover business correspondence that is not part of the Service: if we publish a page inviting people to tell us whether they would be interested in an offering of securities, that page is open to readers outside the United States, and someone located in the EEA, the United Kingdom or Switzerland may choose to submit their contact details through it. What we do with those details is described in Section 14 and in Section 15. This annex describes the terms that will apply if we begin offering the Service there; before doing so we will appoint an EU/UK representative (GDPR Art. 27), establish lawful bases including Article 8 parental-consent handling at each member state's age of consent, and update this Policy. If you believe you have accessed the Service from the EEA or UK, contact privacy@kudokids.org and we will address your request, including deletion.

If we begin offering the Service in these regions, the following will apply:

• Lawful bases for processing: parental consent for child data (GDPR Article 8, at each member state's age of digital consent); performance of a contract when you create an account and use the Service; and legitimate interests for website analytics and security, where those interests are not overridden by your rights.
• Additional rights: the right to lodge a complaint with your local data protection authority, to request restriction of processing, and to object to processing based on legitimate interests.
• International transfers: your data would be transferred to and processed in the United States, where our servers and service providers are located, under appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.
• Contact: privacy@kudokids.org.

KudoKids is not offered in, directed to, or marketed in Canada, and we do not knowingly collect personal information from individuals located there in connection with the Service. As with the previous section, that is a statement about the Service and does not cover business correspondence that is not part of it: the page described in Section 14 is open to readers in Canada, and what we do with a Canadian reader's details is described there and in Section 15. If we begin offering the Service in Canada, we will update this Policy with the information required under Canadian privacy law (including PIPEDA) before doing so. If you believe you have accessed the Service from Canada, contact privacy@kudokids.org and we will address your request, including deletion.

In accordance with the April 2025 COPPA amendments, we provide a separate, simplified direct notice for parents that summarizes our children's data practices. You can view this notice at our Parents' Notice: Children's Data Practices page.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Kudo Kids, LLC 4030 Wake Forest Road, STE 349 Raleigh, NC 27609 Email: privacy@kudokids.org Phone: (910) 593-7070

We will respond to all privacy-related inquiries within 30 days.

If you believe we have collected personal information from your child without your consent, please contact us immediately and we will delete the information promptly.

Parents may opt in to submit a public testimonial about their family's experience with KudoKids — either about the family as a whole, or specifically about one of their children. Testimonials are written inside the parent's account at Settings > Support > Share your story.

What we collect: the testimonial text you write, a display name you choose, and (optionally) a parent-only photo you upload or a companion image from your family's catalogue. We never publish photos of children. By default, a child you mention appears publicly only as a first initial plus age (for example, "E, age 7"); you can opt up to first name plus age. The snapshotted first name and age are stored at write time so a later rename or birthday does not silently change already-approved public text.

Consent and review: the editor surfaces an explicit consent acknowledgment before the form unlocks, captures an acknowledgment timestamp plus version (2026-05-v1), and routes every testimonial through KudoKids staff review before it appears on kudokids.org or on a referral landing page. When you write about one of your children, you confirm that you are their parent or legal guardian and consent to publishing the version you submit.

Where it appears: approved testimonials may be shown publicly on kudokids.org and on referral pages you share with friends. We do not use testimonials in paid advertising without separate written permission from you.

Your controls: you can unpublish or delete a testimonial at any time from the same screen where you submitted it. Either way it comes off the public site within a few minutes and is deleted; your photo is deleted once none of your testimonials uses it, usually within a day. Activity-log audit entries tied to that testimonial are deleted at the same time. We do not give any incentive, coupon, free product, or other compensation in exchange for submitting a testimonial through this feature. (Separately, people in our partner and referral programs may be compensated under those programs and may also write about KudoKids; where that happens, they are required to disclose the relationship.)

Data flow: testimonial text, parent display name, and any uploaded photo are stored in our Supabase database and our public asset bucket; no new third-party recipients are introduced by this feature.

KudoKids uses your device's camera and microphone only for a small number of optional features, and only ever on the device itself. In every case described below, no audio or camera image leaves the device, and nothing is used to identify anyone; the one exception is that the words a parent dictates to KudoKids AI are turned into text on the device and sent as that parent's message (see Section 22c). Camera readings are processed in real time on the device and immediately discarded; the loudness meter holds audio briefly on the device and deletes it when the meter stops (see Section 22c). Your device's own system permissions ultimately control camera and microphone access, and — for the wellness features described below — KudoKids never triggers the system camera or microphone permission prompt without first showing a one-time explanation written for a parent or guardian.

22a. Augmented Reality (AR) companions

KudoKids includes optional AR features that display 3D companions in your real environment using your device's camera. AR processing happens entirely on-device via Apple ARKit (iOS), Google ARCore (Android), Apple Quick Look (iOS web), or Google Scene Viewer (Android web). Camera frames are never transmitted, stored, or processed by KudoKids. The 3D companion models themselves are served from our content delivery network. Camera screenshots are saved to your device's photo gallery only when you explicitly tap the screenshot button in the native AR viewer. AR is enabled by default rather than as an opt-in feature because it is 100% on-device and no camera frames are ever transmitted, stored, or collected — so it does not "collect" personal information under COPPA — but parents can turn it off for the whole family or for each child at any time in Companion settings. Device system permissions ultimately control camera access.

22b. Wellness-break "peek" detection (eye-rest step)

During a wellness break's short "look far away" eye-rest step, KudoKids can use the front camera so a child's companion can playfully encourage them to rest their eyes — for example, gently calling out "No peeking!" if the child keeps looking at the screen, and cheering them on when the rest is complete. To do this, the app performs face detection on the device and uses only whether a face is present, roughly which way the head is turned, and whether the eyes appear open; everything else the detector computes is discarded immediately.

This is not facial recognition. KudoKids does not create a faceprint or face template, does not store facial geometry, and never attempts to identify who the child is or match them against any other image. No camera frame, measurement, landmark, score, or result is recorded, saved, transmitted, or written to our servers — each reading powers only the companion's in-the-moment reaction and is then immediately discarded. The feature is playful only: it never affects Kudo Coins, timers, break completion, or any other outcome, and a break can always be finished with the camera off. A visible on-screen indicator appears whenever the camera is active, and a child's face is analyzed only during the eye-rest step of a wellness break — never elsewhere in the app.

The on-device face detection is provided by the device's built-in machine-learning components (Google's ML Kit on iOS and Android, and a self-hosted Google MediaPipe model on the web that KudoKids serves from its own domain — never a third-party content-delivery network). The detection itself runs entirely on the device: no image, video frame, facial measurement, landmark, or result is sent to those vendors or to us. On iOS and Android, ML Kit sends Google technical usage and performance metrics about the detector, including device and app information and a device identifier that is not linked to any account, used only to maintain and improve the component — never what the camera sees, and nothing that names your child or your family. The web MediaPipe path sends nothing (see Section 7).

Because this feature processes facial data momentarily on the device, KudoKids adds an extra layer of parental control. Before the camera is ever used, the app shows a one-time explanation written for a grown-up (reached behind the parent passphrase, or the grown-up check when no passphrase is set) describing exactly what the camera does and this privacy promise; the device's own camera-permission prompt appears only after that. If a parent declines, the device does not support the feature, or camera permission is denied, the feature is simply absent and the break works exactly as it otherwise would. Peek detection can be turned on or off per child at any time in Family Settings under Kids Access → Movement Breaks.

22c. Exercise "movement mirror" and microphone level meter (wellness exercises)

Some wellness exercises offer an optional movement mirror — a live on-screen camera preview a child can see of themselves as they move — and an optional microphone level meter that shows how loudly a child is speaking or making sounds during a spoken exercise. Both are off by default and are turned on per child by a parent. Like the features above, they run entirely on the device: the camera preview is displayed on screen only and is never recorded or transmitted, and the microphone is used solely to measure sound loudness in real time. Audio is held briefly on the device only to measure loudness and is deleted when the meter stops; it is never kept, transmitted, or converted to text, and no video frame, pose, accuracy score, or measurement is saved. (Separate voice-based educational features that recognize spoken words are described in Section 4f; those are processed only on the device, with no cloud fallback. A parent's dictation to KudoKids AI is different: the speech is recognized on the device, no audio leaves it, and the resulting text is sent as the parent's message (see the Google Gemini entry in Section 7).)