What we collect, and what we never do

Voice chat between children

When you allow it, your child can talk out loud with the other players in a room — and only in a room created from an invite link your household sent. There is no friend list, no search and no profile discovery, so a child cannot end up talking to a stranger the matchmaker put there.

The audio passes through our server and is never written to disk, never recorded, and never passed to anyone else. Video is never requested and our server does not carry it at all: a camera stream is refused rather than declined.

For children under nine the microphone is push-to-talk only, never continuously open.

To keep the platform safe, our safety specialists may listen to a room live when needed. That listening is not recorded either, and while it lasts everyone in the room sees it on their screen. To tell when it is needed, the device automatically checks whether a voice belongs to a child or an adult; the audio does not leave the device.

• Off by default. It needs your explicit permission, per child.
• One tap to withdraw, from the parent area. After that the microphone does not open again.
• Your child can silence any voice themselves, instantly, without asking you.

Watching a session live

Two different things share one name here, and they are worth separating. The first is a list: who is online and which game or lesson they are on. That is a short-lived copy of something already measured for your own screen-time report, it lives for two minutes, and it is never written anywhere permanent.

The second is detail — the level, the second in a video, the answers given, the state of the game board, and optionally a small picture of the screen twice a second. That is only collected while somebody is actually watching, it lives for between ten seconds and a quarter of an hour, and while it is being collected there is a notice on your child’s screen that cannot be dismissed.

Nothing about a watched session is recorded. A permanent log records that somebody looked, when, and for how long; it never records what they saw.

• The child is always told. Not in a setting — on the screen, while it is happening.
• You may ask us for the log of who has ever watched your child.
• A watcher can never play for your child. They can only point at something, and your child’s game draws the same hint it uses for its own tutorial.

Spoken answers in lessons

When a lesson pauses and asks a question, your child may answer by speaking. That short clip is turned into text and the answer is marked, and then the audio is deleted. It is not kept, not used to train anything, and not used to build a profile.

Without this permission lessons still work: questions are answered by tapping instead.

• Off by default, and separately revocable from the other permissions.

Where AI is used

KidseAI is an AI tutor. The questions in a lesson are asked by our software, not by a person, and the answers are marked by AI.

AI does three jobs: it turns a spoken answer into text, decides whether an answer is right, close or wrong, and chooses the headline, the tip and one short sentence for your weekly parent report. These jobs run on AI providers we contract with. Each receives only what its job needs: the short answer clip or its text with the lesson’s question, or learning counts for the report. They never receive your child’s name or account, and under their terms they do not use it to train their models.

The model never writes free text to your child. In a lesson it can only return a fixed verdict (right, close or wrong), so nothing a model produces is shown to a child as its own words.

• If your child says they are scared, hurt or in danger while answering, that answer is marked and shown to you in your report. It never changes the verdict.

Game files and the content network

Games are served from a content delivery network so they load quickly. What reaches that network is an encrypted game package and your device’s IP address. Your child’s name, profile, voice and answers do not.

A licence key is stored on the device so a downloaded game still opens with no connection. That key cannot be exported from the device.

Guest invitations

Someone who opens an invite link gets a temporary, restricted session: only the room they were invited to. They cannot spend points, cannot use the AI features, and cannot see any parent screen. The link is single-use, binds to the first device that opens it, and expires.

How permission is asked for, and why a PIN is not enough

Your parent PIN shows that a parent is holding the tablet right now. It does not show that the person who chose it is the child’s parent — it was chosen at signup and nothing about it was verified. So the PIN guards the parent screens, and permission is verified separately.

For voice chat we need a payment method on the account. The reason is not money: the payment provider notifies each transaction separately, which is one of the verification methods a regulator accepts. Because your child’s live voice reaches another household, an email check alone is not enough for this one.

For watching a session and for spoken answers an email check is enough: a code to your address, and a second confirmation a minute later. Two steps, because a child who found the message could complete one.

The body of that email is the explanation itself — what is collected, what for, how long, and how to refuse. A message that only carried a code would verify an address and consent to nothing.

• Each permission is asked for, recorded and withdrawn separately. There is no single “I agree”.
• Every recorded permission stores the version of the text it was given against, so it is always answerable what exactly was agreed to.
• Withdrawal is one press, behind the same PIN, and takes effect immediately.

How long anything is kept

Live supervision data lives in memory with an expiry measured in seconds: two minutes for “online now”, one minute for the level, thirty seconds for the game board, ten seconds for a screen picture, fifteen minutes for recent answers. None of it is written to a database.

Delivery links last five minutes. A room invite lasts thirty minutes and a guest session one hour. An offline game licence lasts thirty days and renews quietly whenever the device is online.

Your account’s own data — profiles, progress, reports, answers — is kept while the account exists.

Closing the account

There is no soft delete. The rows go, and your household’s encryption key goes with them — which means the copies in last night’s backup can no longer be decrypted either. Deletion is cryptographic, not a flag.

One exception: payment records are kept because we are legally required to keep them. They are split across two tables so that the amount can remain while the address is removed.

What we never do

• No advertising, no sponsored content, no affiliate links inside sessions.
• No third-party analytics or advertising trackers.
• No profiling of children, and no recommendation feed.
• No selling or sharing of family data.
• No video of a child, ever — the server does not carry it.

The laws we follow

We process personal data under Turkey’s Personal Data Protection Law (KVKK, Law No. 6698). Where they apply to a family using KidseAI, we also follow the EU General Data Protection Regulation (GDPR), the US Children’s Online Privacy Protection Act (COPPA) and the UK Age Appropriate Design Code.

In practice: data about a child is used only for the feature a parent turned on, each permission is recorded with the text it was given against, nothing is used for advertising or profiling, and everything except legally required payment records is erased when the account closes.

Your rights

You may ask what we hold about your household, receive a copy of it, have it corrected, have it erased, withdraw any permission, and object to a use of it. Most of these are a button in the parent area; for the rest, write to us and we will answer.

Asking us something

Any question about this notice, any request about your data, or anything on this page that does not match what you see in the app.