Privacy Policy

1.1. The data controller (the person who decides how personal data is processed) is Aleksei Chekunin, an individual based in Dubai, United Arab Emirates (the “Operator”).

1.2. Contact: alexey.chekunin@gmail.com · Telegram: @alexey_chekunin. We do not have a separate data-protection officer or an EU/UK representative.

1.3. This Policy applies to KidMind: the Site (kidmind.xyz / kidmind.ru), the KidMind apps for iPhone, iPad and Android, and related services, including the waitlist, accounts, lessons and conversations. In this Policy, “the Site” includes the apps.

1.4. Using the Site means you have read this Policy. Use of KidMind is also subject to the Terms of Use. KidMind is currently free: nothing can be bought in the apps or on the Site.

2.1. Depending on how you use KidMind, we may process:

• account data: email address, Telegram account identifier and, if you send it via Telegram, display name and avatar; if you sign in with Google, the name, email address and account identifier from your Google account; if you sign in with Apple, the name you choose to share, the email address (or an Apple private relay address) and an Apple user identifier;
• authentication data: session cookies and a refresh token needed to keep you signed in;
• waitlist data: email address, the plan you are interested in, and survey answers (including an age range for the child you are signing up for, and a short description of the situation);
• usage data: progress through levels, energy and similar game-state, timestamps, and technical logs;
• the child’s profile, filled in by the parent: the child’s first name (or a nickname) and age range;
• messages typed in conversations with Anna, Robbie or similar characters, and text transcripts of voice calls with them — these may include things a child writes or says while using your account. We do not store the audio of calls;
• records of the safety filters and of reports about AI replies (see 3.6);
• purchase data, only once paid plans are offered (none are on sale now): the plan, period, price, currency, the store it was bought in (App Store, Google Play or the Site through Paddle), purchase receipts and subscription status, received through RevenueCat. We do not receive card numbers or other payment details; Paddle, Apple or Google process those;
• the device’s push token, only if the parent turns on reminders in the app;
• support messages you send by email, Telegram or the on-site chat widget;
• cookies and similar technical data, including approximate device and browser information.

2.2. We do not require a child’s legal name, school, address, photo or date of birth to create an account. A parent may still type personal details into a conversation or a survey. Please do not send documents, health records or other sensitive data unless we ask for them in writing.

2.3. We do not show third-party advertising on the Site, and we do not sell personal data.

2.4. Sign in with Google. If you choose to sign in with Google, Google shares with us your name, email address, whether Google has verified that address, and your Google account identifier. We ask only for this basic profile information: we get no access to your Gmail, contacts, Google Drive or any other Google data. We use it only to create your account or sign you in, to connect it to an existing KidMind account that has the same verified email address, and to address you by name in the app. We do not use it for advertising, we do not sell it, and we share it only with the providers in section 5 that host the service.

2.5. KidMind’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

2.6. Sign in with Apple. If you choose to sign in with Apple in the iPhone or iPad app, Apple shares with us a user identifier for KidMind and, the first time only, the name you choose to share and an email address: your real one or, if you choose “Hide My Email”, a private relay address that forwards our emails to you. We get no other data from your Apple Account. We use this information only to create your account or sign you in, to connect it to an existing KidMind account that has the same verified email address, and to address you by name in the app. We do not use it for advertising, we do not sell it, and we share it only with the providers in section 5 that host the service.

3.1. KidMind is built for children ages 5–10, but the account and the contract are with the parent or guardian. We ask you not to let a child create their own account.

3.2. We do not use children’s data for marketing to children, for profiling aimed at children, or for sale to advertisers.

3.3. Children use KidMind through their parent’s account; a child cannot create an account of their own. The child’s profile is filled in by the parent, conversations with the AI characters start only after the parent agrees to them (see 3.5), and the parent can review and delete the child’s conversations, withdraw that consent or delete the account at any time. If you think a child has given us personal information without a parent’s involvement, contact alexey.chekunin@gmail.com and we will delete it.

3.4. You are responsible for supervising your child’s use and for what is typed in conversations.

3.5. Anna, Robbie and the other characters are AI: their replies are generated by a computer program, and the app says so to the child. In the iOS and Android apps, before a child can chat or talk with them, we ask a parent to agree, on a screen behind a check only an adult can pass, that the child’s messages and voice are sent to OpenAI to produce the replies. The parent can withdraw this at any time in the app’s “For parents” area; lessons keep working without the conversations.

3.6. Automated safety filters check what the child writes and says and what the AI answers. Phone numbers, email addresses, links, street addresses and school numbers in typed messages are hidden before the message is sent to OpenAI or stored. Unsuitable AI replies are replaced with a safe one, and a call may be ended. If a child says something suggesting they may be hurt or in danger, the AI answers with a fixed supportive message and our team is alerted. A child or parent can report a reply or a call with “Something’s wrong”; our team reviews reports.

3.7. In the apps’ “For parents” area a parent can read the child’s conversations with the characters, including transcripts of voice calls, and delete one or all of them.

4.1. We process data to:

• create and run your account, provide lessons and conversations, and keep progress — this is needed to perform the contract with you;
• send the parent sign-in codes and, unless they turn it off, a weekly progress email, and send reminders in the app if the parent turns them on;
• once paid plans are offered, take payment and keep records we are required to keep for tax and accounting;
• run the waitlist and tell you when access opens, if you asked us to;
• answer support requests;
• keep the Site secure and prevent abuse;
• understand how the landing pages are used (see section 7);
• comply with law, including personal-data, tax and accounting rules.

4.2. Where a privacy law such as the EU/UK GDPR applies to you, the typical legal bases are: contract (account and paid access); legitimate interests (security, basic product improvement, defending legal claims); consent (non-essential cookies/analytics, waitlist messages beyond what is needed to deliver the request); and legal obligation (tax records). You may withdraw consent without affecting processing that does not rely on consent.

4.3. Where the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Russian Federal Law No. 152-FZ “On Personal Data” or a similar law applies to you, we process data to perform the contract with you, on the basis of your consent to this Policy, and to meet legal obligations.

5.1. We share data only as needed to run KidMind, and with:

• Expo (650 Industries, Inc., USA), Apple Push Notification service and Google Firebase Cloud Messaging — deliver reminders in the app, only if the parent turns them on: they receive the device’s push token and the text of the reminder;
• once paid plans are offered: Paddle.com Market Limited (United Kingdom) — our reseller and the Merchant of Record for purchases on the Site: it receives your email address, country and payment details to take payments, charge taxes and issue refunds;
• once paid plans are offered: RevenueCat, Inc. (USA) — keeps track of subscriptions across the app and the Site: it receives a random account identifier and the purchase receipts from the App Store, Google Play or Paddle; it does not receive your name or email address;
• once paid plans are offered: Apple and Google — for purchases in the app, under their own privacy policies;
• Telegram — if you sign in or write to us that way;
• Google — if you sign in with Google; Google confirms who you are and sends us the account details listed in 2.4;
• Apple — if you sign in with Apple; Apple confirms who you are and sends us the account details listed in 2.6;
• hosting and infrastructure providers, including Cloudflare, which delivers the Site and sends our emails, such as sign-in codes;
• OpenAI (USA), which generates the characters’ replies and checks messages for safety: typed messages (with the details listed in 3.6 hidden) and the audio of voice calls are sent to OpenAI to produce a reply. Under OpenAI’s API terms this data is not used to train its models and may be kept by OpenAI for up to 30 days to monitor abuse;
• ElevenLabs (USA), which turns the characters’ replies into speech in some voice calls: it receives the text of the reply, never the child’s voice;
• the on-site support widget (Chatwoot), if you open it;
• Yandex Metrica, for the analytics described in section 7;
• Meta Platforms (the Meta Pixel), to measure our advertising, as described in section 7;
• PostHog Inc. (USA), for the analytics described in section 7;
• professional advisers, such as lawyers and accountants, bound by confidentiality;
• authorities, if we are legally required to disclose data.

5.2. We do not sell your data and we do not share it with advertisers. A provider acts on our instructions or as its own controller under its own policy (for example, Telegram, Paddle, Apple or Google).

6.1. We use cookies and similar storage that are required to sign you in (including a refresh token) and to keep the Site working. These are necessary for the service you asked for.

6.2. We also use analytics cookies as described in section 7. You can block cookies in your browser; if you block necessary cookies, sign-in and some features will not work.

7.1. On the Site’s public marketing pages — the home page in each language — we use Yandex Metrica (counter 112785098). It records visits, clicks and, in its current configuration, session replay (Webvisor). That means a recording of how a page was used may be stored by Yandex. Fields where you type an email address or a sign-in code are hidden from these recordings. Yandex Metrica does not run in lessons, in conversations with Anna, Robbie or similar characters, or in the admin area. This is marketing analytics for the Operator, not advertising to children inside the lessons.

7.2. On the same public marketing pages we use the Meta Pixel, provided by Meta Platforms. It tells Meta that a page was viewed and that certain steps were taken on it — for example, that the lesson demo was started or that a button to open a lesson or the app store was tapped — together with technical details of the step: which page, button, plan or question it was, and which option was picked in the lesson demo. We do not tell Meta which answers were chosen in the questionnaire, including your child’s age. Meta may connect this with its own cookies and, if you use Facebook or Instagram, with your account there. We use it to measure and improve our advertising on Facebook and Instagram. We do not send Meta your email address, sign-in codes or anything you type, and the Meta Pixel does not run in lessons, in conversations or in the admin area. When a parent creates an account, our server also tells Meta that an account was created, together with technical identifiers: the Meta cookies set in your browser on these pages, your IP address, your browser type and a hashed (coded) account number. We do this only to measure our advertising; we do not send Meta your email address or anything about your child. Meta processes this data under its own privacy policy.

7.3. On the same public marketing pages we use PostHog, an analytics service provided by PostHog Inc. (USA), which processes the data on our behalf. It records page views, clicks and session replays (recordings of how a page was used); everything typed into fields is hidden from these recordings. PostHog does not run in lessons, in conversations, in the parents’ area or in the admin area. From the Site’s lesson pages, our server sends PostHog only anonymous usage events — for example, that a lesson was started, that an age range was chosen or that an account was created — linked by a random identifier set on the marketing pages. We do not send PostHog your email address, names, messages or anything you or your child type.

7.4. We may also send anonymised or pseudonymised events to a browser data layer for the same purpose.

7.5. If you open the support chat, Chatwoot processes the conversation in order to deliver it to us.

7.6. If you want analytics cookies limited, use your browser settings or write to alexey.chekunin@gmail.com. We will not pretend a third-party analytics tool is off if it is still loading.

7.7. The iPhone, iPad and Android apps contain no third-party analytics, advertising or tracking tools and do not use the advertising identifier. Yandex Metrica, the Meta Pixel and PostHog run only on the public pages listed in 7.1, not in the apps and not on the pages the apps open, and our server sends PostHog nothing about the use of the apps.

8.1. The Operator is in the United Arab Emirates. Personal data is processed there and in the countries where our providers operate, including Cloudflare’s global network, the United States (OpenAI, RevenueCat, Google, Meta, PostHog), the United Kingdom (Paddle) and the Russian Federation (Yandex Metrica).

8.2. The United Arab Emirates does not currently benefit from an EU adequacy decision. If you are in the EEA, the UK or Switzerland, this is an international transfer. We transfer data because the Operator and the service are based there, and because you chose to use the Site. We do not claim that EU Standard Contractual Clauses are in place with every provider.

8.3. If you are not comfortable with that transfer, do not create an account and do not submit the waitlist form.

9.1. Account and progress data are kept while the account exists. If you ask us to delete the account, we delete or irreversibly anonymise personal data within 30 calendar days, except records we must keep by law (for example, payment and tax records, which may be kept for the statutory period — typically several years).

9.2. If you signed in with Google, your Google account identifier is kept with your account and deleted together with it. You can disconnect KidMind from your Google account at any time at https://myaccount.google.com/connections. This stops Google sign-in but does not delete your KidMind account; to delete it, contact alexey.chekunin@gmail.com. If you signed in with Apple, your Apple user identifier and Apple’s sign-in token are kept with your account; when the account is deleted, we delete them and revoke the token at Apple. You can stop using Sign in with Apple for KidMind at any time in your Apple Account settings (on iPhone: Settings → your name → Sign-In & Security → Sign in with Apple).

9.3. Waitlist emails are kept until we have written to you about launch, you ask to be removed, or we close the list.

9.4. Support correspondence is kept as long as needed to handle the request and any related dispute.

9.5. Conversations with the characters and transcripts of voice calls are kept until a parent deletes them in the app, or until the account is deleted. Records of the safety filters and reports are kept until the account is deleted. We do not store the audio of voice calls.

9.6. You can delete the account yourself in the app (“For parents” → “Delete account”). How to ask for deletion without the app: https://kidmind.xyz/delete-account.

10.1. We take technical and organisational measures we consider appropriate for a small educational service (access control, encrypted transport, limited staff access). No method of transmission or storage is fully secure. We do not claim certification (ISO, SOC or similar).

10.2. We are not responsible for a breach at a provider we do not control (Paddle, RevenueCat, app stores, Telegram, hosting, analytics), except where mandatory law says otherwise.

11.1. You may ask us to:

• tell you whether we process your data and provide a copy;
• correct inaccurate data;
• delete data or close the account;
• restrict or object to certain processing, where the applicable law gives you that right;
• withdraw consent, where processing is based on consent;
• receive data in a portable form, where the applicable law gives you that right.

11.2. Write to alexey.chekunin@gmail.com from the address on the account. We may need to verify that it is you. We will respond within 30 days, or sooner if the law requires.

11.3. If you are in the EEA or the UK, you may also complain to your local data-protection authority. If you are in the United Arab Emirates, you may complain to the UAE Data Office; in the Russian Federation, to Roskomnadzor.

12.1. We may update this Policy by publishing a new version on the Site. The new version applies from the “Last updated” date unless a later date is stated.

Operator: Aleksei Chekunin, an individual

Location: Dubai, United Arab Emirates

Email: alexey.chekunin@gmail.com

Telegram: @alexey_chekunin