Privacy Policy

Data about adults

• Account: email address, name, password (stored only as a hash), language and role (family, teacher, school, district).
• Usage: the plans, evaluations and notes you record, notifications, library downloads and access audit logs.
• Device (mobile app only): push notification identifier, platform (iOS or Android) and language, used to deliver the alerts you turn on.

Data about children: as little as possible

A child is registered only with a first name or nickname, a 6-character code, their program tier and an age band. There is no field, log or file holding a child's last name, date of birth, photo, email, phone or address, and the platform is built to prevent it.

Evaluations record skill levels (not observed, emerging, achieved) and notes from the teacher or family. Evidence consists of photos of the work (drawings, models, screens); the app explicitly asks you never to photograph people.

When a certificate is issued, the child's full name is used only in memory during issuance and only a salted hash is kept. The name travels inside the diploma's QR code and is never sent to our servers during verification.

Why we use the data

• To provide the service: plan sessions, evaluate, show progress, issue certificates and notify families.
• To operate licenses and payments for schools, districts and families.
• Security: authentication, auditing of access to children's data and abuse prevention.
• Support: answering your requests at our contact email.

What we do not do

• No third-party analytics, pixels, advertising SDKs or cross-app tracking. We show no ads.
• We do not sell or share personal data, and we do not use it to train artificial-intelligence models.
• The platform's AI features (mapping skills in documents and drafting suggestions) never receive children's personal data.

Providers

Data is stored on servers we manage (our own database and file storage, not third-party services). We use Resend to send transactional email to adults, Stripe to process payments (we never receive or store card numbers) and the Apple, Google and Expo push services to deliver alerts to your device. None of them receives children's data.

Mobile app permissions

• Camera and photos: only when you choose to attach evidence of the work or scan a school or linking QR code. Nothing is uploaded without your action.
• Notifications: for evaluation, achievement and request alerts; you can turn them off in your system settings at any time.

Retention and deletion

Each school or district sets its retention period; an automatic job deletes expired evaluations and evidence. Families can export all their data or delete the family and the account from Privacy and data, on the platform or in the app. Signing out of the app clears the device's local cache.

Schools and districts

When a school or district uses KidGeeniers, it is the controller of its student records and we act as a service provider under its instructions, in line with applicable law (for example FERPA and COPPA in the United States). Access or deletion requests about a school's students are handled through that school.

Security

Encryption in transit (TLS), hashed passwords, encrypted secrets, row-level access control in the database, permissions by role and scope, and an audit log of every access to children's data.

Your rights and contact

You can access, export, correct or delete your data from the platform or by writing to hi@kidgeeniers.com. We answer within 30 days. If we change this policy, we will publish the new version here with its date.