Kids&Coo Privacy Policy

Kids&Coo (hereinafter the "Service") values the privacy of its users and strictly complies with Google Play policies and applicable laws and regulations. This policy explains what information is collected, used, and shared within the app.

1. Personal Information Collected and Permissions Requested

The Service requires the following data and device permissions, and will never use them for any purpose other than those specified below.

Account and Device Information

• Email address: Collected for member identification, login, and account management (including integrations such as Google OAuth).
• Device identifiers (including Advertising ID): Collected for push notification delivery, personalized advertising, and app crash/error analysis.

User-Generated Content (Input Data)

• Child information: Name (nickname), date of birth, and gender (voluntarily entered by parents or other guardians).
• Mood log data: Text, tags, photos, and similar entries.
• Voice recording data: Conversation recording files generated when using the Chat Time feature and the corresponding STT (speech-to-text) results.

Required / Optional Permissions

• Camera and Photos/Media (Optional): Accessed only to take photos directly or upload them from the device library for attachment to mood logs. Collected photos are used solely for in-app service delivery and for the user's own storage.
• Microphone (Optional): Accessed to record conversations with the child when using the Chat Time feature. Recorded audio is encrypted and stored in Supabase Storage, converted to text via OpenAI Whisper, and used only within the app. The microphone is activated only when the user explicitly taps the record button; no background recording is performed.

2. Purposes of Collection and Use

The data and permissions collected are used solely for the following purposes:

• Member identification, login security, and provision of core services.
• (Including camera/microphone permissions) Uploading and storing family mood logs, calendar features, and conversation recording support.
• AI-based conversation topic generation, weekly parent action suggestions, and long-term emotional pattern analysis.
• Service improvement such as bug fixes and performance enhancements (using error reporting tools such as Sentry and the PostHog product analytics tool).
• Display of personalized and non-personalized advertisements in the free version (Google AdMob).

3. Advertising and Use of the Advertising ID

The Service displays advertisements (via Google AdMob) to users of the free version. In order to deliver more relevant advertisements and measure ad performance, the Service may collect and share the Android device's Advertising ID with third parties (advertising partners).

Users may at any time reset their Advertising ID or opt out of personalized advertising via their device settings (Settings > Google > Ads).

4. Children's Personal Information (Target Audience and Content)

• Target age and primary users: The Service (Kids&Coo) is an app used by adults aged 18 or older, such as parents or teachers, to observe and record children's emotions.
• Direct child targeting: This Service is not a Children's app intended for direct operation by infants or young children.
• Children's information entered by adult users during use of the Service is used solely for delivery of this Service. Profiles of children are not processed or sold for external marketing purposes.

Consent for Collection of Personal Information of Children Under 14

Parents or legal guardians who use this app are deemed to have consented, upon signing up and entering their child's profile, to the collection and entry on the child's behalf of personal information (name, date of birth, gender, mood logs, etc.) for children under 14 years of age. Parents may at any time edit or delete their child's profile via [Settings > Account Management] in the app, and upon account deletion all related data is destroyed immediately.

5. Notice Regarding Non-Access to Financial, Health, and Government Services

• Not a health/medical app: The mood logs and statistical charts provided by the Service are for parental reference only and are not professional medical diagnosis, prescription, or health management (Health/Medical) features.
• Not a government/financial app: This app does not represent any government agency and does not provide regulated financial features (Financial Features) such as payment, remittance, or lending.

6. Data Security and Transmission (Data Safety)

• Encryption in transit: All information entered by users (photos, text, voice) and personal information is encrypted via secure protocols (HTTPS) when communicated with our servers.
• Encryption at rest: Stored data is protected by industry-standard encryption such as Supabase's AES-256.
• Collected data is securely stored in databases through the security infrastructure of global cloud services (Supabase, Google, etc.).

7. International Transfer of Personal Information

The Service transfers personal information across borders as follows.

All transfers are encrypted using secure communication protocols such as HTTPS, and each service provider manages the data in accordance with its own privacy policy.

8. Provision to Third Parties (Including Processing on Our Behalf)

As a general rule, we do not share personal information with external third parties without the user's consent. However, in order to operate the Service (authentication, database, advertising, AI), we transmit and store the minimum necessary data with the following services.

• Google (Authentication and AdMob): Login integration and in-app ad delivery.
• Supabase: Secure storage of accounts (email authentication), mood log text, photos, and voice databases (Storage).
• Anthropic (Claude API): To provide AI features such as Chat Time conversation topic generation, weekly parent action reports, and auto-reply drafting, the child's name and age, portions of mood logs, and voice recording transcripts are transmitted. Transmitted data is not used to train Anthropic models per its API policy and is deleted within 30 days of processing.
• OpenAI (Whisper API): To convert Chat Time voice recordings into text (STT), voice recording files are transmitted. Transmitted data is not used to train OpenAI models per its API policy and is deleted within 30 days of processing.
• Sentry (Crash Reporting): Debugging information (device model, OS version, error stack traces) is collected when the app crashes or encounters errors and is used to improve app stability. No personally identifiable information is included.
• PostHog (Product Analytics): We use the product analytics tool PostHog (provided by PostHog Inc., hosted in the United States) to collect statistics for service improvement and usage analysis. The items collected are device identifiers (anonymous ID and IP), app usage events (such as install, sign-up, and subscription start/completion), and device model, OS, and app version. Sensitive information and content data such as email, child information, mood logs, and voice are not transmitted to PostHog, and only an anonymous ID (UUID) is used for user identification.

9. Rights of EU Residents (GDPR)

For users residing in the EU, EEA, or the United Kingdom, the Service complies with the General Data Protection Regulation (GDPR) and the UK GDPR.

• Legal bases for processing (GDPR Article 6): user consent (Art.6(1)(a)) · performance of a contract to provide the Service (Art.6(1)(b)) · legitimate interests (Art.6(1)(f), service improvement and security).
• Your rights: right to access (Art.15), right to rectification (Art.16), right to erasure (Art.17), right to restriction of processing (Art.18), right to data portability (Art.20), right to object (Art.21), right not to be subject to automated decision-making (Art.22), right to withdraw consent (Art.7), and right to lodge a complaint with a supervisory authority (Art.77).
• Exercising your rights: Please send requests to [email protected]. We will respond within 30 days.
• Safeguards for transfers to third countries: Transfers to countries without an adequacy decision (such as the United States) are made under the Standard Contractual Clauses (SCC, 2021/914/EU) or based on the user's explicit consent.
• Automated decision-making and profiling: AI conversation topic generation and weekly reports do not constitute automated decisions producing legal or similarly significant effects on users.
• EU representative: As a small operator that does not engage in regular processing of data within the EU, the Service is exempt from the obligation to designate an EU representative under GDPR Art.27(2).

10. Destruction of Personal Information and the Right to Request Deletion

• Data retention period: Data is retained while the user's account remains active and is permanently destroyed immediately upon account withdrawal. However, information that must be retained under applicable laws (for example, payment records required for 5 years under the Korean Act on the Consumer Protection in Electronic Commerce) is securely stored separately for the relevant period and then destroyed.
• Account withdrawal: Users may request deletion of their account and related data at any time via [Settings > Account Management > Withdraw Membership] within the app.
• Once the withdrawal is completed, the mood log text, photos, voice, and child profile information stored in the database are permanently destroyed immediately, unless legally required to be retained.

11. Changes to this Privacy Policy

If this Privacy Policy is changed, we will provide advance notice at least 7 days before the change takes effect, via an in-app announcement or the email address registered for the account. If a user does not agree to the changes, they may discontinue use of the Service by withdrawing their account.

12. Business Information and Contact