KIDSCIENT
Privacy Policy
Product: Kidscient
Last updated: 2026-08-02
Operator: Yogaforce Consultancy LLC
Contact: privacy@kidscient.com
Audience
Kidscient is a learning companion for children, including children under 13. We comply with COPPA (US), GDPR-K (EU), and the UK Age Appropriate Design Code. The primary user is the child; the legal data subject is the parent or guardian.
What we collect
Required for the service
| Data | Source | Why | Where it lives |
|---|
| Parent email + Clerk user id | Parent at signup |
Account, parental consent | Postgres (users) |
| Child first name + grade level | Parent at child setup |
Personalize tutor responses | Postgres (child_profiles) |
| Child voice utterances (raw audio) | Microphone during session |
Speech-to-text transcription, or streamed live voice conversation / role-play |
Not persisted for transcription flows (buffered, sent to the speech provider, discarded after the request). For live-voice modules (Real World, Curio Time, Tutor Pack, Roots) audio is streamed to the realtime provider for the live session; see the processors list for which provider each module uses and the Retention section for what is stored. |
| Child voice transcripts | Speech-to-text output (OpenAI Whisper by default, or Azure) / realtime-model output (OpenAI or Google Gemini depending on module) |
The tutor needs to know what the child said | Postgres (session_turns.transcript_text and per-module transcript tables) |
| Tutor messages | Anthropic Claude output |
Show the kid the conversation; let the parent review |
Postgres (session_turns, neat_work_outputs) |
| Session signals (hint count, app-overhelped flag, parent takeaway) |
Computed from the conversation |
Parent dashboard | Postgres (sessions) |
| School documents (report cards, IEP progress reports, MAP score reports, Lexile letters) |
Parent voluntarily uploads via Compass |
Extract measured skills + map to a personalized practice project |
Azure Blob Storage (encrypted at rest, parent-owned). Extracted skills + scores in Postgres (compass_documents, compass_skill_extractions). |
| Extracted skill labels + scores + dates |
Anthropic Claude vision extraction of the uploaded document |
Build the personalized Compass project + generate IEP evidence pack PDFs on demand |
Postgres (compass_skill_extractions) |
| Photos of the child's schoolwork / canvas |
Child takes or picks a photo during a tutoring, Home Crew, or Project session |
Let Curio see and help with the work in front of the child |
Azure Blob Storage (encrypted at rest); a short-lived link is sent to Anthropic Claude vision so Curio can read the work. Referenced by Postgres (session_uploads, ask_curio_messages, home_crew_completions, tutor_sessions, project_logs). |
What we do NOT collect
- No precise location.
- No advertising identifier (IDFA / GAID).
- No contact list, photo-library scanning, or calendar access. (We do let a child take or pick a photo of their schoolwork within a session — see "What we collect" — but we never read the photo library beyond the images the child explicitly captures or selects for a task.)
- No third-party analytics SDKs (no Firebase, no Mixpanel). We use Sentry only for crash and error diagnostics, configured with
sendDefaultPii: false so it does not attach user identifiers, emails, or IP-derived personal data — see the processors list below.
- No behavioral or interest-based ad targeting — ever.
- No cross-app tracking.
Third-party processors
Data is shared only with the following processors, and only for core service operation:
- Anthropic (Claude API) — receives tutor prompts including the child's transcript, and performs vision extraction of uploaded schoolwork/canvas photos and Compass documents. Anthropic does not train on API customer data. Data is processed in the US.
- OpenAI — receives the child's voice and/or transcripts across several flows: (a) Whisper speech-to-text is the default transcription provider for general tutoring; (b) the Realtime API streams the child's live voice via WebRTC for Real World role-play, Curio Time, and Tutor Pack, returning transcripts and synthesized voice. OpenAI does not train on API customer data per the enterprise terms. Data is processed in the US.
- Azure Speech Services (Microsoft) — receives the child's audio for transcription (when Azure is the selected speech-to-text provider) and for reading-fluency pronunciation assessment, and receives tutor text for voice synthesis. Audio is processed ephemerally (no Microsoft retention beyond request lifetime per the customer-managed key configuration).
- Google (Gemini Live API) — used by the Roots v2 heritage-language module. The child's live voice is streamed bidirectionally to Gemini for the session. Data is processed under Google's paid Gemini API terms, which do not permit using the data to train Google's models.
- ElevenLabs — receives text only (Curio's story-time narration passages) for voice synthesis; never receives the child's voice or other personal data.
- Sentry — crash and error diagnostics only. Configured with
sendDefaultPii: false, so it receives stack traces and non-PII breadcrumbs but no user identifiers, emails, or transcripts.
- Clerk — handles parent authentication only. Stores parent email and password / OAuth tokens; never receives child data.
- Azure Postgres — stores everything in the table above. Located in East US, encrypted at rest.
- Azure Blob Storage — stores Compass document uploads (report cards, IEP progress reports, etc.) for as long as the parent keeps the child profile. Encrypted at rest, parent-owned via the same Postgres FK chain.
- Resend — transactional email delivery for parent notifications (Compass extraction outcomes, project readiness). Receives parent email + child first name only; never receives child practice data or transcripts.
Real World module — voice role-play specifics
Real World lets the child practice real-life situations (ordering at a restaurant, negotiating bedtime, talking to a coach, etc.) by voice-role-playing with our cheetah character "Curio." The child speaks; Curio plays the other person; afterwards Curio gives a short reflection grounded in what the child actually said.
- Voice flow. The child's voice is streamed directly to OpenAI's Realtime API via WebRTC for the in-character role-play. Our servers are in the signalling path only (we never receive raw audio).
- Transcripts. Each turn's transcript is captured (PII auto-redacted server-side — street addresses, phone numbers, school names, family contact info) and stored for up to 90 days by default. Parents can extend or shorten this per-child in Real World settings.
- Audio recordings. Some sessions capture an audio archive of the role-play. Where captured it is stored encrypted, is deleted when the parent deletes the child's profile, and parents can shorten retention per-child in settings. Automatic time-based deletion (target retention: 60 days) is being rolled out.
- Parent visibility. By default, parents can read every Real World transcript their child completed. Parents can opt out per-child in Real World settings (kid-only privacy mode).
- Safety filter. Every Curio turn (and every child turn) passes through a safety-classification pass before being persisted or spoken. Flagged turns are blocked and the session is gracefully closed.
- Curated content. All scenarios in the library are server-curated. The child cannot type or invite a custom role-play. Parents can request custom scenarios for situations specific to their child; those drafts go through the same safety + critique pipeline and require parent approval before the child sees them.
- Voice never used for AI training. Per our enterprise contracts with OpenAI + Anthropic.
Retention
- Parent account: kept until the parent deletes it.
- Child profile + sessions + turns + neat-work outputs: kept until the parent deletes the child profile (cascades automatically).
- Raw audio for speech-to-text transcription: not persisted (buffer-only during the request).
- Transcripts (Real World and other modules): kept up to 90 days by default (parent-configurable per-child) and removed when the parent deletes the child profile.
- Live-voice session audio archives (where captured): removed when the parent deletes the child profile. Automatic time-based deletion (target: 60 days) is being rolled out.
- Schoolwork/canvas photos: stored in Azure Blob (container lifecycle purges after ~30 days) and removed when the parent deletes the child profile.
- Compass document uploads + extracted skills: kept until the parent deletes the child profile (cascades automatically).
- Logs: 30 days, no PII other than session ids.
Note: automatic time-based purge for audio archives and Home Crew photos is in the process of being wired; until then those files are removed reliably through the parent-initiated deletion path below.
Right to deletion
A parent can delete a child profile (and all associated data) directly from the app's Profiles screen. The cascade wipes sessions, session_turns, neat_work_outputs, and parent_reviews in a single transaction, and deletes the child's uploaded files from storage — photos of their work, voice clips, whiteboard snapshots, and uploaded documents — not just the database records.
For the parent's own account (and all children under it), deletion is via the app's account-deletion flow → triggers the cascade.
Parental consent
The parent creates an account with a verified email address. By creating the account, the parent confirms they are the parent or legal guardian of the child(ren) added to the account. Account creation is the verifiable consent moment.
Contact for privacy questions
Email privacy@kidscient.com — the
inbox monitored by the Kidscient team. We respond within 7 days for
data-deletion or access requests.