Privacy Policy — Kivra Kids

1. Who we are

Kivra Kids is an educational platform that helps parents discover and curate safe, enriching content — videos and books — for their children. Accounts are held by parents or guardians, not by children directly.

2. What we collect

Account information — your email address, display name, and a hashed password (we never store your password in plain text).
Google sign-in data — if you sign in with Google, we receive your email and name from Google. We do not receive your Google password.
Kid profiles — names, age ranges, and avatar emoji you create for each child. These are stored under your parent account.
Watch history and progress — which videos your family has watched and how far through each video you are, so you can resume where you left off.
XP and streaks — learning activity data (XP points, daily streaks) associated with each kid profile.
Content submissions — videos or books you submit for review, including any URLs and descriptions you provide.

3. How we use your data

To operate your account and authenticate you securely.
To personalise content recommendations based on watch history.
To send transactional emails — welcome messages, submission status updates, PIN and password resets. We do not send marketing emails.
To review content you submit for safety and age-appropriateness.

4. Third-party services

Supabase — our database host. Your data is stored on Supabase-managed PostgreSQL servers with encryption at rest.
Brevo — used to deliver transactional emails. Only your email address and first name are shared with Brevo for this purpose.
Google — if you use Google sign-in, your authentication is handled by Google OAuth. We receive only your email and name.
YouTube — video content is embedded from YouTube. When a video plays, YouTube's own privacy policy applies to that stream.

We do not sell your data. We do not share your data with advertisers.

5. Children's privacy

Kivra Kids is designed for parents and guardians to manage. We do not knowingly collect personal information directly from children. Kid profiles contain only a name (which need not be a real name), an age range, and an emoji avatar — all entered by the parent. If you believe a child has created an account directly, please contact us and we will delete it promptly.

6. Data retention and deletion

Your data is kept for as long as your account is active. You may request deletion of your account and all associated data at any time by emailing us at the address below. We will action deletion requests within 30 days.

7. Security

Passwords and PINs are stored as cryptographic hashes — they cannot be reversed. API access requires a signed JWT token. Parent Mode actions require a separate short-lived token issued only after PIN verification. All connections to our servers use HTTPS.

8. Your rights

You have the right to access, correct, or delete the personal data we hold about you. To exercise any of these rights, contact us at the email below.

9. Contact

Questions about this policy? Email us at salahudeentope@gmail.com