KIDLENA — PRIVACY POLICY
Version 2026-08-20

This Privacy Policy explains what personal data Kidlena collects, why, and
what rights you have over it. It should be read together with our Terms &
Conditions. "We", "us", "our" means Lucidforce OÜ (registry code 17561122),
a company registered in Estonia, of Paadi tn 14a-10, 15151 Tallinn, Estonia
(the data controller for this service) unless stated otherwise.

1. WHO KIDLENA IS FOR
Kidlena accounts are created and used by parents/legal guardians (18+), not
by children. Children never create an account, log in, or interact with
Kidlena directly — all information about a child is entered by their
parent/guardian. If we become aware that a child has registered their own
account, we will delete it and the associated data.

2. WHAT WE COLLECT
(a) Account data: your name, email address, locale, timezone, and — if you
register with a password — a bcrypt hash of it (we never store your password
in plain text). If you register or sign in with Google or Apple, we receive
your name and email address (which may be a private relay address Apple
generates for you) from Google/Apple to create and identify your account; we
never receive your Google or Apple ID password.
(b) Child data you provide: your child's name, birth date, avatar, and any
free-text notes you add.
(c) Child facts: structured facts about your child (e.g. interests,
routines, temperament, screen time, siblings) either entered by you during
onboarding or inferred from your chat messages with the guide, always
grounded to what you actually wrote. You can view, correct, or delete any
fact at any time.
(d) Conversations: the text of your chats with the AI guide. Each parent's
conversations are private to them — not shared with a co-parent, even
within the same family.
(e) Growth moments and narratives: short qualitative observations you or
the app record about your child's development. By design we never generate
or store a numeric score, rating, or ranking of a child (no IQ/EQ score,
no leaderboard) — see Section 6.
(f) Plans and activities: suggested and completed activities, and any
feedback or skip reasons you provide.
(g) Technical/usage data: login timestamps, rate-limiting counters tied to
your email/IP (to block brute-force and spam), and token/cost metering for
AI usage tied to your account.
(h) Push notification token: if you turn on notifications, a device push
token so we can send you the optional "today's ideas are ready" reminder.
Notifications are off unless you enable them, and the reminder never contains
your child's name or any activity detail.
(i) We do not use cookies, third-party analytics, advertising SDKs, or
tracking pixels, and we do not run any behavioral advertising. On the web
app we use your browser's local storage for one purpose only — keeping you
signed in — which is strictly necessary to provide the service.

3. WHY WE PROCESS IT (LEGAL BASIS)
- Providing your account and the features you use: necessary to perform our
  contract with you (GDPR Art. 6(1)(b)). This covers your own personal data
  as the account holder.
- The information you enter about your child: because the child is not the
  account holder, we rely on our and your legitimate interest (Art. 6(1)(f))
  in providing the parenting guidance you have asked for about your own
  child. We keep this balanced by collecting only what the feature needs,
  never scoring or profiling the child (Section 6), and giving you full
  control to view, correct, or delete every item at any time.
- Security, fraud/abuse prevention, and rate-limiting: our legitimate
  interest in keeping the service safe and available (Art. 6(1)(f)),
  balanced against your rights — we keep this data minimal and short-lived.
- Sending you a password-reset code: necessary to perform our contract /
  your explicit request (Art. 6(1)(b)).
- Push notifications: optional and off by default; we send them only after
  you turn them on, and you can turn them off again at any time in Profile or
  in your device settings (Art. 6(1)(a), consent).
- Anything else we ask you to separately opt into in the future: your consent
  (Art. 6(1)(a)), which you can withdraw at any time without affecting the
  lawfulness of processing before withdrawal.
We do not process any category of special/sensitive data (e.g. health,
biometric data) as a matter of policy; please avoid entering such details
in free-text notes or chat beyond what's needed for parenting context, and
never enter data for medical decision-making — see our Terms, Section 2.

4. WHO WE SHARE DATA WITH
We do not sell your personal data or your child's data, and we do not share
it for third-party advertising. We use a small number of processors, strictly
to operate the service:
- Anthropic, PBC — receives your chat messages and relevant child context
  (never your raw account credentials) to generate the AI guide's main
  responses, your daily activity plan, and growth narratives. Anthropic is
  based in the United States.
- Groq, Inc. — receives a smaller slice of the same kind of chat/child
  context to power a quick clarifying step ahead of the main guide
  response. Groq is based in the United States.
- Amazon Web Services (AWS) — hosts our application server and database.
- Expo (650 Industries, Inc.) — only if you enable notifications: receives
  your device push token and the fixed reminder text (never your child's name
  or any activity detail) to deliver push notifications. Based in the United
  States.
- Google LLC — only if you choose "Sign in with Google": Google authenticates
  you and provides us your name and email address; we never receive your
  Google password. Based in the United States.
- Apple Inc. — only if you choose "Sign in with Apple": Apple authenticates
  you and provides us your name and email address (or a private relay
  address, if you choose to hide your email from us); we never receive your
  Apple ID password. Based in the United States.
- Our transactional email provider — sends password-reset emails only
  (your email address and a one-time code; no marketing).
Embeddings used for retrieving knowledge-base content are computed locally
on our own server and are not sent to any third party.
We may also disclose data if required by law, to enforce our Terms, or to
protect the safety of a user or the public.

5. INTERNATIONAL DATA TRANSFERS
If you are located in the EEA, UK, or another jurisdiction with data-
transfer restrictions, your data may be transferred to and processed in the
United States (by Anthropic, Groq, AWS, Expo, Google, and Apple, and
depending on our email provider). For each such transfer we rely on an appropriate
safeguard: the EU–US Data Privacy Framework where the provider holds an
active certification, and Standard Contractual Clauses otherwise. Contact us
(Section 10) for details of the safeguards used for a specific transfer.

6. NO PROFILING OR SCORING OF CHILDREN
We deliberately never produce or store a numeric assessment, score, rating,
or ranking of a child (no IQ/EQ score, no leaderboard, no percentile). We do
not carry out automated decision-making that produces legal or similarly
significant effects concerning a child, within the meaning of GDPR Art. 22.
Growth narratives are qualitative, generated to help you reflect — not to
evaluate your child.

7. DATA RETENTION
We retain your account and child data for as long as your account is
active. Deleting a child profile immediately and permanently erases all
data tied to that child (facts, plans, conversations about them, growth
moments/narratives, nudges, and any cached AI answers about them). Deleting
your account permanently erases your account and personal data as described
in Section 9; if you are the sole member of your family, this also erases
your family's children and their data. After deletion, any residual copies
in our encrypted backups are purged on the normal backup rotation, within 30
days. Our token/cost metering records are kept for billing and abuse control,
but once your account is deleted they are held only in de-identified form,
with the link to you removed. Push notification tokens are deleted when you
turn notifications off or delete your account. Password-reset codes expire
and are purged automatically. Rate-limit counters are short-lived (minutes)
and not retained.

8. SECURITY
Passwords are hashed with bcrypt and never stored or logged in plain text.
Traffic to our servers is encrypted in transit (TLS). Access tokens are
short-lived; refresh tokens are long-lived but revocable by changing your
password. We apply rate limiting to slow credential-stuffing and brute-force
attempts. No method of transmission or storage is 100% secure, and we
cannot guarantee absolute security.

9. YOUR RIGHTS
Depending on your location, you may have the right to: access the personal
data we hold about you; correct inaccurate data; erase your data ("right to
be forgotten"); restrict or object to certain processing; receive your data
in a portable format; and withdraw consent at any time. In the app, under
Profile, you can already: edit or delete any child fact, delete a child
profile (erasing all of that child's data), and request a full account
deletion and a data export. For anything the app doesn't yet self-serve,
email us (Section 10) and we will respond within 30 days. If you are in the
EEA/UK, you also have the right to lodge a complaint with a data protection
supervisory authority. Our lead authority is the Estonian Data Protection
Inspectorate (Andmekaitse Inspektsioon, www.aki.ee); you may also complain to
the authority in your own country of residence.

10. CONTACT
Questions about this policy, or to exercise a privacy right not yet
available in-app: lucidforce33@gmail.com

11. CHANGES TO THIS POLICY
We may update this policy. When we make material changes, we will publish a
new version and ask for your consent again before continued use, the same
way we do for our Terms & Conditions.