Kidoreka

Privacy Policy

Last updated: July 14, 2026

Kidoreka is in active development, so the Service changes often. This document describes how it works today; we announce material changes before they take effect.

This document is provided in English only. If a translation is ever offered, the English version is the binding one.

The short version

  • Your family's media stays private to your account.
  • No advertising, no data sale, no tracking of children.
  • Anonymous usage analytics on the website and Studio run only if you allow them in the consent banner — and you can change your mind at any time.
  • When you use an AI feature, what you submit for it (and only that) is sent to our AI providers to generate the result — AI never runs in the background over your library.
  • We never use your content to train AI models, and everything Kira generates is marked as AI-made — see AI Transparency.
  • You can delete any content — or your entire account — yourself, at any time, and deletion is immediate and permanent.

1. Who is responsible for your data

Kidoreka operates Kidoreka Studio (web) and Kidoreka Play (mobile). The data controller within the meaning of Art. 4(7) GDPR is:

Germany

Full provider details: Legal Notice. Privacy questions: support@kidoreka.com.

2. What we collect

Account data

  • Email address and name — from your Google/Apple sign-in or your email signup. Passwords are handled by our authentication provider and stored only as secure hashes.
  • Language preference and app settings.

Optional child profile

  • You may add a nickname, date of birth, and interests for your child to personalise creations (for example age-appropriate story suggestions). This is optional, entered by you, editable, and deletable at any time.

Your content

  • Photos, drawings, audio recordings (including narration in your own voice), text, and the play-sets you build from them.

Technical data

  • Standard server logs (IP address, timestamps, requests) and security events, kept for operating and protecting the Service. We do not use third-party advertising or cross-site tracking, and we do not build behavioural profiles.

Usage analytics (only with your consent)

  • If you allow it in the consent banner, we use Google Analytics 4 to understand how the website and Studio are used: pages visited, features used (for example "a story was saved" or "a Kira request succeeded"), coarse device and country information, and a pseudonymous account identifier. We configure it conservatively: no advertising features, no Google signals, page addresses are stripped of identifiers and query parameters before sending, and none of your content (titles, text, photos, audio, prompts) is ever included. Nothing is collected before you consent, and declining changes nothing about how the Service works.

Beta-testing data

  • If you test the Kidoreka Play app through Apple TestFlight or a Google Play testing track, Apple or Google may share with us crash logs, device and usage diagnostics, and — on TestFlight — any feedback and screenshots you choose to send. We use this only to find and fix problems during the beta. See section 6 for how Apple and Google handle this data themselves.

3. Children's privacy

Kidoreka is designed so that we do not collect personal data from children:

  • Children have no accounts. The Play app runs under the parent's account; children never provide an email, name, or password to us.
  • Any information about a child (nickname, birthday, interests, photos) is provided by the parent, under the parent's control, and used only to show and personalise the family's own content.
  • The Play app contains no advertising, no in-app purchases, no social features, no public content, and no analytics that profile the child.
  • Parents can review and delete everything at any time from Studio Settings.

This design is intended to satisfy GDPR's protections for children and the principles of the US COPPA rule. Kidoreka is offered to parents and guardians, who must be adults; we do not knowingly create accounts for children.

4. How we use your data

  • To provide the Service — storing and streaming your content to your signed-in devices, generating thumbnails and mobile variants, syncing to the Play app.
  • AI features you invoke — when you ask Kira to draw, write, narrate, or compose, the inputs relevant to that request are transmitted to the AI providers listed in section 6 so they can generate the result. Depending on the feature, this can include story text, character names and descriptions, reference images or photos you selected, audio you provided, and — if you enabled personalisation — details from your child's profile (such as age range and interests). AI runs only on your explicit action — never in the background over your library — and only the material needed for that request is sent.
  • Transactional email — account confirmation, password reset, and a welcome message. No marketing email without your separate consent.
  • Security and abuse prevention.
  • Product improvement — if you consented to usage analytics, we look at aggregate statistics (which pages and features are used, where flows are abandoned) to improve the product.

We do not sell personal data, show ads, or use your content to train AI models.

5. Legal bases (GDPR)

  • Contract — providing the Service you signed up for.
  • Consent — usage analytics, optional child-profile personalisation, and any future marketing communications. Consent can be withdrawn at any time, as easily as it was given (see section 10).
  • Legitimate interests — service security, abuse prevention, and product improvement based on aggregate, non-content data.

6. Who processes data for us

We use a small set of processors, each bound by data-processing agreements and used only for the purpose listed:

  • Supabase (on AWS, EU region) — database, authentication, and private file storage.
  • Vercel — web application hosting.
  • Microsoft Azure (OpenAI Service) — text generation for Kira's writing help, and fallback image rendering.
  • Google (Gemini) — image generation for scenes and card art you request.
  • OpenAI — alternative text-generation provider we may enable for Kira's writing help.
  • ElevenLabs — narration voices, sound effects, and music you request.
  • Brevo — transactional email delivery.
  • Google Analytics — anonymous usage statistics for the website and Studio, only if you consented (see section 10). Data may be processed by Google in the United States under the EU–US Data Privacy Framework.

AI providers receive only the inputs needed to fulfil the specific request you made (see section 4) and act on our instructions. We do not use your content to train AI models, and we select provider offerings whose terms do not permit training on data submitted through them (Azure OpenAI Service, the Google Gemini API on paid terms, and the ElevenLabs API with zero-retention settings where available).

Where a provider processes data outside the EEA, transfers rely on the EU Standard Contractual Clauses, or on an adequacy decision where one applies (for example the EU–US Data Privacy Framework, to which Google and Microsoft are certified). You can request a copy of the safeguards used for a specific provider.

App marketplaces (beta and store distribution)

The Kidoreka Play app is distributed through Apple (App Store / TestFlight) and Google (Google Play). When you install or beta-test the app, Apple and Google process data about you (such as your marketplace account, device information, crash reports, and — on TestFlight — tester feedback) as independent controllers under their own terms and privacy policies (Apple's TestFlight and App Store terms; Google's Play terms). That processing is not under our control; we receive from them only aggregated or pseudonymised diagnostics and the feedback you choose to submit.

7. Storage and security

  • Media is stored in private buckets; devices access it through short-lived signed URLs tied to your session.
  • Every database table enforces row-level security scoped to your account — one family's data is not readable by another's.
  • Data is encrypted in transit (TLS) and at rest.

8. Retention and deletion

  • Your data is kept for as long as your account exists, so your play-sets stay available to your family.
  • Deleting an asset or play-set removes it immediately; deleting your account (Settings → Danger zone) permanently removes your content, uploads, profile, and login. Residual copies in encrypted backups expire within 30 days.
  • While Kidoreka is in its pre-launch development phase, we may occasionally need to migrate, convert, or reset data as the product evolves. Where reasonably possible we will tell you before that happens.

9. Your rights

Under the GDPR (and similar laws) you can ask for access, correction, deletion, restriction, portability, and can object to processing based on legitimate interests. Most of this you can do directly in the app; for anything else, email support@kidoreka.com. You can also complain to your local data-protection authority.

10. Cookies and analytics consent

The Studio always uses the cookies required to keep you signed in (authentication/session cookies) and to remember basic preferences — these are strictly necessary and need no consent. There are no advertising or cross-site tracking cookies.

Analytics cookies are optional. Google Analytics (and its _ga cookies) loads only after you choose "Allow" in the consent banner. You can change your choice at any time — via "Privacy settings" in the website footer, or the Privacy section of Studio Settings. Withdrawing consent stops collection immediately and removes the analytics cookies from your browser. If your browser sends a "Do Not Track" signal, analytics stays off by default.

11. Changes to this policy

The Service is in active development, so this policy will change as it does. If we change it in a meaningful way — for example adding a processor or a new data use — we will notify you before the change takes effect.

12. Contact

support@kidoreka.com — a human reads it.