Privacy Policy

Version 2.2 · Effective August 10, 2026 · Last updated August 10, 2026

KiddieGPT is designed to collect as little information as reasonably necessary and keep information on the user's device when practical. This Policy explains what KiddieGPT collects and processes through the web app, browser extension, website, and related services (the "Service"), how that information is used, and the choices available to parents and users.

1. A quick summary

• Many learning-tool settings and a short recent-activity tally are stored locally on your device; some activity is also saved to your KiddieGPT account so a parent can see progress.
• When a learning tool is used, the prompt and any page text, file, screenshot, or image deliberately submitted with it must be sent to our systems and our AI provider (OpenAI) to generate a response.
• We do not show targeted ads, sell personal information, or build advertising profiles of children.
• We do not use a child's prompts or AI responses to train our own AI models.
• A parent or legal guardian must create and manage the account for a child.

This Policy is also our online notice of information practices for personal information collected from children. It should be read together with any direct notice presented to a parent before consent.

2. Information stored on your device

Depending on the device and feature, the following may be stored in browser or extension storage rather than in a KiddieGPT account:

• learning-tool preferences, such as grade level, explanation style, math mode, and read-aloud settings;
• a rolling activity tally covering roughly the last seven days — counts of tool use and "stars" earned, not saved prompts or answers;
• the current math session and cached per-tool usage limits;
• the parent PIN in hashed form (a one-way SHA-256 hash), never as readable PIN digits; and
• the sign-in token and account email used to keep the parent signed in.

On-device information remains until it is cleared through the Service, removed through browser or device settings, or deleted when the extension is uninstalled, depending on the browser. Deleting an account does not necessarily clear local data on every device, and uninstalling does not automatically cancel a subscription or delete server-side account records.

3. Information processed through our systems

3.1 AI requests and learning content

When a learning tool is used, KiddieGPT processes the prompt and any source material deliberately provided with it, such as active-page text, selected text, a pasted question, local file, screenshot, worksheet image, or phone scan. The content is routed through KiddieGPT's systems as needed and forwarded to an AI provider to generate a response. We may also process safety signals, tool type, grade setting, and technical metadata needed to apply safeguards, prevent abuse, and return the result. KiddieGPT does not keep request content as a permanent prompt archive unless a feature clearly says it will be saved.

Read-aloud and Tutor features send text and voice-selection settings to generate synthetic audio. KiddieGPT does not need to record a child's voice or use the device microphone for these features. If a future feature records or uploads voice, video, or a child's image, we will give the parent a specific notice and obtain any additional consent required before collection.

3.2 Account, subscription & usage data

When a parent creates an account, we collect the parent's name and email address, authentication and security records (such as a hashed password, a Google sign-in identifier, and email-verification status), billing identifiers from our payment processor, subscription or plan status, and sign-in and last-use timestamps. Each family may have up to three child profiles, which include the student name, grade level, reading level, and learning goals a parent enters, together with learning activity for that profile. Learning activity can include daily counts of tool use and per-lesson or per-quiz progress, which may contain quiz questions and the answers a child missed. Because a child's name is stored, we recommend using only a first name or nickname, not a full legal name.

3.3 Device, website & log data

When you use the Service, we and our hosting providers may automatically receive IP address, browser and device type, operating system, timestamps, requested pages, referring pages, and error information. We use this data for authentication, security, debugging, reliability, and basic service measurement—not for behavioral advertising.

3.4 Payment data

Subscriptions are processed by Stripe. KiddieGPT does not receive or store your full card number; we retain only Stripe identifiers and the amount and currency of a payment. Stripe handles payment details under its own privacy policy.

3.5 Where information comes from

We receive information directly from a parent or child using the parent-managed account, automatically from the device and Service, and from providers involved in sign-in, payment, email delivery, hosting, and AI processing. If a school or other organization arranges access, we may also receive authorized roster or account information from that organization, but we will provide additional terms or notice before enabling organization-managed student accounts.

4. Information we do not seek

• We do not ask a child to provide a full legal name, home address, phone number, precise location, government identifier, or personal profile photo.
• We do not use third-party advertising trackers, retargeting pixels, or behavioral-advertising profiles.
• We do not sell, rent, or trade personal information.
• We do not use a child's prompts or responses to train our own AI models.
• We do not use facial recognition, voiceprints, or other biometric identification.

Because learning content is supplied by users, a prompt, file, screenshot, or scan could still contain personal information. Parents should teach children not to submit personal, confidential, or identifying information.

5. Children's privacy & the parent's role

KiddieGPT is a family learning product designed for school-age children in grades K–12 (roughly ages 5–18), but the account must be created and managed by a parent or legal guardian. A parent chooses the grade setting, establishes parent controls, and permits the child's use of the Service.

For a child under 13, we provide the parent or guardian with direct notice of the child information we intend to collect, how we will use it, and the providers to which it is disclosed as an integral part of the Service. We require the parent to complete parent setup, verify the parent account, and affirmatively consent before a child profile or child learning activity is enabled. Depending on the feature and applicable law, we may require an additional verification step reasonably designed to confirm that consent comes from the parent or guardian. We record the date, policy version, and scope of consent. Do not allow a child to create an account independently or submit personal information before that process is complete.

• Child profiles are created and managed by a parent and should use a nickname.
• Parent settings are protected through the parent account and available PIN controls.
• Children cannot publicly post or broadcast personal information through the Service.
• Parents may review or delete available child-profile and account information and withdraw permission for future use.
• We do not condition participation on providing more child information than is reasonably necessary for a feature.

A parent may request access to, correction of, or deletion of a child's personal information, or refuse further collection or use, through our contact form. We may verify the requester's identity and relationship to the child. If you believe a child has used the Service without appropriate parent permission, contact us and we will investigate and take appropriate action.

A parent may consent to collection and internal use while refusing disclosure to third parties that are not integral to the Service. KiddieGPT currently does not offer non-integral disclosure of child personal information. AI processing, hosting, authentication, email, security, and similar providers are integral to operating the requested features; if a parent does not consent to those disclosures, the affected child features cannot be provided. A parent may withdraw consent at any time, but doing so may require us to disable or delete the child profile.

5.1 School and educator use

The family Service is not an official school record system. An educator may not create or manage a child account unless authorized by the child's parent or by a school legally permitted to consent on the parent's behalf. If KiddieGPT separately contracts with a school, we will use student information only for the authorized educational purpose, not for targeted advertising or an unrelated commercial purpose, and the school agreement and school notice will control where they provide stronger protections. Schools should contact us before deploying KiddieGPT to students.

6. How we use information

• provide learning tools, generate responses, and apply grade and safety settings;
• create and secure parent accounts, verify subscriptions, and enforce plan limits;
• process payments and maintain transaction records;
• send authentication messages, receipts, security notices, service updates, and material policy notices; and
• prevent abuse, diagnose problems, and keep the Service secure and reliable;
• comply with legal obligations, enforce our terms, and establish, exercise, or defend legal claims; and
• create aggregate or de-identified statistics that do not reasonably identify a child or family, while maintaining measures designed to prevent re-identification.

7. Service providers

We use providers that process information for us to operate the Service:

• OpenAI — to process submitted learning content (including active-page text, selected text, files, screenshots, and scans), generate text or synthetic speech, and run automated content moderation. We use business/API settings intended to prevent request content from being used to train provider models, subject to the provider's applicable service terms.
• Stripe — payment processing and billing services.
• Vercel and contracted database or infrastructure providers — to host, run, secure, monitor, and store data for the Service.
• Google — to provide Google sign-in if a parent chooses it.
• Postmark and other contracted email infrastructure — to send essential account communications, including verification and one-time sign-in codes.

We limit provider access to information reasonably needed for their function, require appropriate confidentiality and security protections in our contracts where applicable, and assess providers that handle child personal information. Providers may process information only to perform services for KiddieGPT or as otherwise permitted by their agreements and applicable law. We do not disclose a child's personal information for targeted advertising.

We may also disclose information when reasonably necessary to comply with law or valid legal process; protect a child, another person, our rights, or the security of the Service; investigate fraud or abuse; or complete a financing, merger, acquisition, reorganization, or sale of assets. In a business transfer, the recipient must continue to handle child information consistently with this Policy and applicable law, and we will obtain new parental consent before a material change where required.

8. Cookies & local storage

The website and app may use cookies or similar storage necessary for sign-in, security, saved preferences, subscription status, and core functionality. The extension uses browser storage for settings and learning features. We do not use cross-site advertising cookies. Blocking essential storage may prevent parts of the Service from working.

Because we do not sell personal information or use it for cross-context behavioral advertising, the Service does not offer a sale/share opt-out. We do not currently respond differently to browser "Do Not Track" signals. Where legally required, we will honor recognized opt-out preference signals for processing to which such a signal applies.

9. Data retention

• On-device data is kept until you clear it or remove it through the browser, device, or extension.
• AI request content is processed to return the result and is not kept by KiddieGPT as a permanent prompt archive unless a saving feature clearly says otherwise. Infrastructure and AI providers may retain limited copies for security or legal purposes under their applicable service terms.
• Account and child-profile data is kept while needed to provide the account. After a verified deletion request, we delete or de-identify it within a reasonable operational period unless a record must be retained to prevent fraud, resolve disputes, enforce agreements, or meet legal obligations.
• Child usage and progress data are pruned on a rolling basis — usage counts after about 30 days, and lesson or quiz progress after about 120 days.
• Subscription and transaction records are kept as needed for billing, tax, accounting, fraud prevention, and legal compliance.
• Security and server logs are generally kept for a short operational period unless an event requires longer retention for investigation or legal compliance.

Retention periods are based on the feature's purpose, the amount and sensitivity of the information, security and fraud risks, backup cycles, and legal obligations. Backup copies may persist until overwritten in the ordinary backup cycle and are isolated from routine use. We keep personal information only as long as reasonably necessary for the specific purpose for which it was collected, then delete or de-identify it using reasonable measures designed to protect against unauthorized access or use.

10. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the information we process. Measures may include encryption in transit, protected authentication records, access controls, narrowly scoped extension permissions, service monitoring, and data minimization. No online service is completely secure, so we cannot guarantee absolute security. We provide notices of qualifying data incidents as required by law.

11. Your rights & choices

11.1 Access, correction & deletion

You can manage available account and child-profile information in the Service and clear local data through the extension or browser. Account deletion is handled as a request: when you ask us to delete an account, we lock it and complete removal of personal information after review. You may also request access, correction, a portable copy, deletion, withdrawal of child-data consent, or an appeal through our contact form. An authorized agent may submit a request where applicable. We may verify your identity, authority, and relationship to the child before completing a request, and some records may be retained where permitted or required by law.

11.2 EEA / UK residents

Where applicable, we process information to perform our contract with the parent account holder, comply with law, protect our legitimate interests in securing and improving the Service, and based on consent where required. You may have rights to access, correct, delete, port, restrict, or object to processing and to withdraw consent. You may also complain to your local data-protection authority.

11.3 U.S. state privacy rights

Depending on where you live and whether the relevant law applies to KiddieGPT, you may have rights to know the categories and specific pieces of information collected, access, correct, delete, or obtain a portable copy of personal information and to appeal a denied request. You will not receive discriminatory treatment for exercising a privacy right. KiddieGPT does not sell personal information, share it for cross-context behavioral advertising, or use sensitive personal information to infer characteristics. Use our contact form to make a request or appeal.

12. International transfers

KiddieGPT is operated from the United States. If you use the Service elsewhere, information may be processed in the United States and other countries where our providers operate. Where required, we rely on appropriate transfer mechanisms and contractual safeguards.

13. Legal bases for processing

Where a law requires a legal basis, we process information as necessary to provide the Service and perform our contract with the parent account holder; based on verifiable parental or other valid consent where required; to comply with legal obligations; and for legitimate interests such as securing, troubleshooting, and preventing misuse of the Service, provided those interests are not overridden by applicable rights. Consent may be withdrawn prospectively. We do not use solely automated decision-making to make legal or similarly significant decisions about a child.

14. Changes to this Policy

We may update this Policy as the Service or law changes. For material changes, we will provide reasonable advance notice through email, the app, or another appropriate method. If a change requires new parental consent, we will request it before applying the changed practice to a child's personal information.

15. Contact us

Operator — KiddieGPT, United States
Privacy questions & data requests — contact us
General support — contact support
See also our Terms of Service.