The short version
- Your family's media stays private to your account.
- No advertising, no data sale, no tracking of children.
- When you use an AI feature, what you submit for it (and only that) is sent to our AI providers to generate the result — AI never runs in the background over your library.
- We never use your content to train AI models.
- You can delete any content — or your entire account — yourself, at any time, and deletion is immediate and permanent.
- Kidoreka is pre-launch and in active development: this policy is a working draft and will be refined — including through formal legal review — before launch.
1. Who is responsible for your data
Kidoreka operates Kidoreka Studio (web) and Kidoreka Play (mobile). The data controller is: [Legal entity name, registered address, and contact details — to be completed before launch.] Privacy questions: support@kidoreka.com.
2. What we collect
Account data
- Email address and name — from your Google/Apple sign-in or your email signup. Passwords are handled by our authentication provider and stored only as secure hashes.
- Language preference and app settings.
Optional child profile
- You may add a nickname, date of birth, and interests for your child to personalise creations (for example age-appropriate story suggestions). This is optional, entered by you, editable, and deletable at any time.
Your content
- Photos, drawings, audio recordings (including narration in your own voice), text, and the play-sets you build from them.
Technical data
- Standard server logs (IP address, timestamps, requests) and security events, kept for operating and protecting the Service. We do not use third-party advertising or cross-site tracking, and we do not build behavioural profiles.
Beta-testing data
- If you test the Kidoreka Play app through Apple TestFlight or a Google Play testing track, Apple or Google may share with us crash logs, device and usage diagnostics, and — on TestFlight — any feedback and screenshots you choose to send. We use this only to find and fix problems during the beta. See section 6 for how Apple and Google handle this data themselves.
3. Children's privacy
Kidoreka is designed so that we do not collect personal data from children:
- Children have no accounts. The Play app runs under the parent's account; children never provide an email, name, or password to us.
- Any information about a child (nickname, birthday, interests, photos) is provided by the parent, under the parent's control, and used only to show and personalise the family's own content.
- The Play app contains no advertising, no in-app purchases, no social features, no public content, and no analytics that profile the child.
- Parents can review and delete everything at any time from Studio Settings.
This design is intended to satisfy GDPR's protections for children and the principles of the US COPPA rule. [Jurisdiction-specific review pending.]
4. How we use your data
- To provide the Service — storing and streaming your content to your signed-in devices, generating thumbnails and mobile variants, syncing to the Play app.
- AI features you invoke — when you ask Kira to draw, write, narrate, or compose, the inputs relevant to that request are transmitted to the AI providers listed in section 6 so they can generate the result. Depending on the feature, this can include story text, character names and descriptions, reference images or photos you selected, audio you provided, and — if you enabled personalisation — details from your child's profile (such as age range and interests). AI runs only on your explicit action — never in the background over your library — and only the material needed for that request is sent.
- Transactional email — account confirmation, password reset, and a welcome message. No marketing email without your separate consent.
- Security and abuse prevention.
We do not sell personal data, show ads, or use your content to train AI models.
5. Legal bases (GDPR)
- Contract — providing the Service you signed up for.
- Consent — optional child-profile personalisation and any future marketing communications.
- Legitimate interests — service security, abuse prevention, and product improvement based on aggregate, non-content data.
6. Who processes data for us
We use a small set of processors, each bound by data-processing agreements and used only for the purpose listed:
- Supabase (on AWS, EU region) — database, authentication, and private file storage.
- Vercel — web application hosting.
- Microsoft Azure (OpenAI Service) — text generation for Kira's writing help, and fallback image rendering.
- Google (Gemini) — image generation for scenes and card art you request.
- OpenAI — alternative text-generation provider we may enable for Kira's writing help.
- ElevenLabs — narration voices, sound effects, and music you request.
- Brevo — transactional email delivery.
AI providers receive only the inputs needed to fulfil the specific request you made (see section 4) and act on our instructions. We do not use your content to train AI models, and we use provider offerings whose terms do not permit training on data submitted through them. [Provider training-terms verification pending legal review.]
Where a provider processes data outside the EEA, transfers are covered by appropriate safeguards such as the EU Standard Contractual Clauses. [Transfer-mechanism review pending.]
App marketplaces (beta and store distribution)
The Kidoreka Play app is distributed through Apple (App Store / TestFlight) and Google (Google Play). When you install or beta-test the app, Apple and Google process data about you (such as your marketplace account, device information, crash reports, and — on TestFlight — tester feedback) as independent controllers under their own terms and privacy policies (Apple's TestFlight and App Store terms; Google's Play terms). That processing is not under our control; we receive from them only aggregated or pseudonymised diagnostics and the feedback you choose to submit.
7. Storage and security
- Media is stored in private buckets; devices access it through short-lived signed URLs tied to your session.
- Every database table enforces row-level security scoped to your account — one family's data is not readable by another's.
- Data is encrypted in transit (TLS) and at rest.
8. Retention and deletion
- Your data is kept for as long as your account exists, so your play-sets stay available to your family.
- Deleting an asset or play-set removes it immediately; deleting your account (Settings → Danger zone) permanently removes your content, uploads, profile, and login. Residual copies in encrypted backups expire within [30] days.
- While Kidoreka is in its pre-launch development phase, we may occasionally need to migrate, convert, or reset data as the product evolves. Where reasonably possible we will tell you before that happens.
9. Your rights
Under the GDPR (and similar laws) you can ask for access, correction, deletion, restriction, portability, and can object to processing based on legitimate interests. Most of this you can do directly in the app; for anything else, email support@kidoreka.com. You can also complain to your local data-protection authority.
10. Cookies
The Studio uses only the cookies required to keep you signed in (authentication/session cookies) and remember basic preferences. There are no advertising or cross-site tracking cookies, so there is no cookie-consent banner to click.
11. Changes to this policy
Kidoreka has not launched yet, so this policy is a working draft and will change — we expect to update it at least once, following formal legal review, before commercial launch. If we change it in a meaningful way — for example adding a processor or a new data use — we will notify you before the change takes effect.
12. Contact
support@kidoreka.com — a human reads it.