Private testing with made-up profiles only
Draft Children’s Privacy Notice
Draft—counsel review required. For the closed adult test only; do not use this version for public launch or real child data. Operator identity/contact, launch jurisdictions, final vendor disclosures, and the legally required parental-verification method remain open.
Document version: privacy-draft-private-test-2026-09-08
Information in V1
- Parent or legal guardian email and passwordless Supabase Auth session.
- Parent Setup document versions, status, action times, timezone, and factual action method.
- Child screen name—not a real name—optional age 2–6, up to five favourite-topic slugs, and one learning-style preference.
- Structured topics, visit counts, progression, summaries, and emerging interests inferred from Chimpal use.
- If a grown-up asks Chimpal to remember an off-screen mission: the activity and keepsake IDs, saved/expiry time, and—after the grown-up says the family did it together—the first completion date and a retry-safe request ID.
- If someone chooses Yes or No on an unfinished activity: a random browser token is hashed, then stored with the activity, choice, and timestamps on the service for up to 90 days. It is not linked to a caregiver or child profile. The browser stops using its local copy after 90 days and removes expired values when the activity catalog next opens or when browser data is cleared.
Chimpal does not ask for a child’s email, password, precise location, photo, contacts, or real name. The bounded active conversation transcript remains in browser memory during a session and is not retained as a transcript.
Why it is used
The information authenticates the adult, personalises age-appropriate learning, remembers reviewed interests, provides Parent Zone insights, applies safety/spend controls, and supports export, correction, and deletion. Separate anonymous Yes/No activity votes help decide what to build next and do not affect learning or recommendations.
Service providers and disclosure
Current architecture uses Supabase for adult authentication/database storage, Vercel for hosting/serverless delivery, and Anthropic for server-side AI generation during the closed adult test with made-up profiles. Adult email delivery uses Resend through Supabase. Private membership stores the approved adult email/UUID and bounded mail counters until account deletion or operational removal. Production contracts, child-data terms, subprocessors, locations, and disclosures require final review. Chimpal is not designed to sell child data or use it for targeted advertising.
Retention and security
Detailed learning records and summaries are generally retained for 90 days; operational request, telemetry, budget, and abandoned-session metadata are generally retained for 30 days. A remembered mission expires after 30 days unless it is completed or removed sooner. An earned Buddy Moment and its first shared-activity date remain until the grown-up corrects the record or deletes the profile/account. Chimpal asks for no proof and stores no answer, location, child photo, video, audio, route, score, or buddy snapshot for this feature. Current caregiver-approved aggregates remain until correction or profile deletion. RLS binds child data to the adult’s Supabase UUID. Hosted backup retention and security statements require production approval.
Parent rights
A parent or legal guardian may review, export, correct, stop future collection, delete a profile and its learning graph, or delete the account. Refusing Parent Setup prevents a child profile from being created. An incomplete, graph-free Auth account can be deleted from Parent Setup while recent authentication is valid.
Operator and contact
Required before launch: [legal operator name], [postal address], [privacy email/phone], and jurisdiction-specific parent-rights instructions.