Privacy Policy

Version 1.0 · Effective May 20, 2026 · Last updated May 20, 2026

KiddieGPT was built around one privacy principle: keep data on the child's device whenever possible, and collect as little as we can. This policy explains, in plain language, what we collect, what we deliberately don't, how the limited data we do handle is used, and the choices you have.

1. A quick summary

• The large majority of data — your child's questions, history, vocabulary, settings — never leaves your device.
• We do not show ads and do not use advertising or profiling trackers.
• We do not sell or rent personal information to anyone.
• We do not use your child's questions or AI responses to train AI models.
• On paid plans, AI requests pass through our relay to verify your subscription, then go to the AI provider — they are not stored by us afterward.

2. Information stored only on your device

Most of what KiddieGPT records lives in your browser's local storage, on your own computer. It is not transmitted to us. This includes:

• Your child's questions, prompts, and AI conversation history
• The activity log — which tools were used, when, and on which topics
• Saved vocabulary words
• The parent PIN, stored only as a salted SHA-256 hash — the actual PIN digits are never written to disk
• Parent-control settings: time limits, safe-mode level, content categories, custom blocked words
• The child profile you create: display name and grade level
• Usage statistics such as time spent per day and AI-call counts

If you uninstall the extension, this on-device data is removed with it. You can also clear it any time from Parent Controls → Account → Reset All Data.

3. Information that reaches our servers

3.1 Paid-plan AI requests (transient)

On Premium and Family plans, your child's prompts are routed through the KiddieGPT relay so we can verify your subscription before forwarding the request to the underlying AI provider. We do not persistently store these prompts or the responses; they pass through and are discarded.

3.2 Subscription & license data

We keep the records needed to operate paid plans: your license code, subscription status, and an aggregate monthly count of AI calls per license used to enforce fair-use quotas.

3.3 Website & waitlist data

When you visit kiddiegpt.com or submit the waitlist form, we collect the email address you choose to provide and standard server logs (IP address, browser type, pages visited, timestamps), retained briefly for security and debugging.

3.4 Payment data

Subscriptions are handled by Stripe. We never see or store your full card number; Stripe processes payment data under its own privacy policy.

4. What we deliberately do NOT collect

• We do not collect a child's real name, age, home address, phone number, photo, or precise location. The only child detail we touch is the optional display name a parent types (for example, "Alex"), which stays on the device.
• We do not use third-party advertising trackers, retargeting pixels, or behavioural-profiling analytics.
• We do not sell, rent, or trade personal information — ever.
• We do not build advertising profiles of children or parents.
• We do not train our own or third parties' AI models on your child's questions or the AI's answers.

5. Children's privacy (COPPA & similar laws)

KiddieGPT is offered as a Family & Education product, designed to be installed and supervised by a parent or guardian on a child's behalf. Account setup, subscription, and the parent dashboard all require an adult.

Consistent with the U.S. Children's Online Privacy Protection Act (COPPA) and comparable laws elsewhere:

• We do not knowingly collect personal information directly from children under 13.
• The child profile (display name, grade) is entered by the parent and is optional.
• All settings are controlled by the parent through a PIN-protected dashboard.
• Children cannot publicly post, share, or broadcast personal information through the Service.
• Parents can review, edit, and delete all on-device data at any time.

If you believe a child has provided us personal information without parental consent, contact privacy@kiddiegpt.com and we will delete it promptly.

6. How we use information

We use the limited information we collect only to:

• operate the Service — verify subscriptions, route AI requests, enforce fair-use quotas;
• process payments through Stripe;
• send essential account messages — receipts, security notices, material changes to these policies;
• send one launch notification if you joined the waitlist (we will not add you to ongoing marketing without your explicit consent);
• diagnose technical problems and keep the Service secure and reliable.

7. Service providers we rely on

We use a small set of processors, each bound by data-protection terms:

• OpenAI / Anthropic — the AI models behind the learning tools. Paid-plan requests are forwarded to them via our relay; each has its own privacy and retention policy. We do not permit use of this data for model training where that setting is available to us.
• Stripe — payment processing.
• Hosting provider (currently Cloudflare) — for the website and relay.
• Email provider — to send transactional email and the one-time launch notification.

8. Data retention

• On-device data — kept until you delete it or uninstall the extension.
• Subscription records — kept while your subscription is active, plus a period afterward for tax and accounting compliance.
• Server logs — kept briefly (about 30 days), then deleted.
• Waitlist email — kept until you unsubscribe or until a reasonable period after launch.

9. Security

We use industry-standard safeguards: TLS encryption for data in transit, salted-hash storage of the parent PIN, narrowly scoped extension permissions (the extension reads page content only on the active tab and only when invoked), and minimal server-side retention. No system is perfectly secure; if a breach affecting personal data occurs, we will notify affected users as required by applicable law.

10. Your rights & choices

10.1 Access & deletion

You can view, edit, or delete on-device data anytime from Parent Controls → Account. For server-side data (license records, waitlist email), email privacy@kiddiegpt.com and we will respond within 30 days.

10.2 EU / UK residents (GDPR)

You have the right to access, correct, port, restrict, or delete your personal data, and to object to certain processing. Contact privacy@kiddiegpt.com to exercise these rights; you may also lodge a complaint with your local data-protection authority.

10.3 California residents (CCPA/CPRA)

You have the right to know what personal information we collect, to request its deletion, and to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information. Contact privacy@kiddiegpt.com.

11. International transfers

KiddieGPT is operated from the United States. If you use the Service from elsewhere, your information may be processed in the U.S. or wherever our processors operate. By using the Service you consent to this transfer, carried out with appropriate safeguards where required.

12. Changes to this Policy

We may update this Policy from time to time. For material changes we will give at least 14 days' notice by email (if we have one on file) and/or via a notice in the extension. We will not retroactively reduce your privacy protections without your explicit consent.

13. Contact us

Privacy questions & data requests — privacy@kiddiegpt.com
General support — support@kiddiegpt.com
See also our Terms of Service.