Privacy Policy

Last updated: 5 September 2026

1. Introduction

KidsFocus ("we", "our", or "us") is a productivity and wellness application designed for children with ADHD, managed by their parents or guardians. We are committed to protecting the privacy of all our users, particularly children. This Privacy Policy explains how we collect, use, store, and protect personal information.

2. Information We Collect

2.1 Parent/Guardian Information

  • Account information (name, email address) provided via authentication
  • Subscription and billing information processed securely through Stripe
  • Communication preferences and notification settings

2.2 Child Information

  • First name and avatar selection (we do not collect surnames or full names of children)
  • Task completion data, focus session records, and goal progress
  • Health-related data: sleep duration logs and outdoor play duration logs
  • Stars earned, badges unlocked, streaks, and reward redemption history
  • Colour theme and avatar preferences

2.3 Information We Do Not Collect

  • We do not collect children's email addresses, phone numbers, or physical addresses
  • We do not collect precise geolocation data
  • We do not use advertising or ad-measurement cookies without your consent — the optional Meta Pixel (see Sections 5 and 6) loads only if you choose "Accept all" in the cookie banner
  • We do not collect photographs or video of children

3. How We Use Information

We use collected information solely for the following purposes:

  • Providing and improving the KidsFocus application features
  • Tracking task completion, focus sessions, and goal progress for the child and parent dashboard
  • Generating insights and suggestions using AI to assist with ADHD management
  • Managing subscriptions and processing payments
  • Sending notifications about achievements, streaks, and important updates
  • Fulfilling gift card reward redemptions requested by parents

4. Parental Consent

In compliance with Australian privacy law, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles, we require verifiable parental consent before collecting any information about children under 13. Parents must create an account, review our privacy practices, and provide explicit consent before creating a child profile. Parents have full control over their child's data and can review, modify, or delete it at any time through the parent dashboard.

5. Data Sharing and Third Parties

We share personal information only with the following third-party service providers, strictly as necessary to operate the application:

  • Stripe — for secure payment processing. Stripe processes parent billing information; child data is never shared with Stripe.
  • OpenAI — for AI-powered coaching features (task suggestions, routines, progress insights, and the kid coach chat). Only de-identified data is sent: your child's age band (for example "8-10") and aggregate statistics such as Stars earned and tasks completed. Child names are never sent to OpenAI. OpenAI processes this information on servers located overseas, including the United States; by using the AI features you consent to this overseas disclosure.
  • Reloadly — for gift card fulfilment when parents approve and purchase rewards. Only the parent's payment and order information is shared.
  • Resend — for transactional email delivery to parents. Child information is not included in emails.
  • Meta (Facebook and Instagram) — only if you accept analytics cookies in the cookie banner. The Meta Pixel then sends Meta page-view and sign-up events together with standard browser identifiers (such as IP address and Meta's own cookies), so we can measure whether our Facebook and Instagram ads lead to sign-ups. No names, email addresses, or child information are sent to Meta, and nothing is sent on child-facing screens. If you choose "Essential only", the pixel never loads and nothing is shared with Meta.

AI suggestion ratings. When you rate an AI suggestion (thumbs up or down), we store that rating — and your optional short note — against your child's profile so future AI suggestions for that child can learn from what works for them. Ratings and notes are never sent to OpenAI in a form that includes your child's name, and one child's ratings never influence another child's suggestions. You can delete this data at any time by deleting the child profile or your account (see Section 8), or by contacting us.

We do not sell, rent, or trade personal information to any third parties. We do not share data with data brokers. The only advertising-related disclosure is the optional, consent-gated Meta Pixel described above — it sends usage events to Meta for our own ad measurement and is never used to share your child's information.

6. Cookies and Tracking

We use a small number of cookies, in two categories:

  • Essential cookies — required for the app to work: sign-in and session cookies (set by Clerk, our authentication provider), and the cookie that remembers your cookie choice itself. These are always on and do not require consent.
  • Analytics cookies (optional) — Google Analytics 4 (GA4) helps us understand how families use KidsFocus, using anonymous usage statistics only: pages visited, features used, and approximate region. The Meta Pixel helps us measure whether our Facebook and Instagram ads lead to visits and sign-ups, using page-view and sign-up events plus Meta's own cookies (_fbp and _fbc). No names, email addresses, or child information are sent to GA4 or Meta.

GA4 and the Meta Pixel load only after you choose "Accept all" in the cookie banner. Until then they are fully blocked — no analytics cookies are set and no usage data leaves your browser. Choosing "Essential only" keeps analytics and ad measurement off entirely.

To change or withdraw your consent at any time, use the "Privacy settings" link in the footer of any public page and pick a new option, or clear your browser's cookies for this site. Withdrawing consent stops GA4 and the Meta Pixel from tracking further (via Meta Consent Mode) and deletes the analytics cookies that were set.

7. Data Storage and Security

  • All data is stored in encrypted PostgreSQL databases with TLS encryption in transit
  • Access to data is restricted through authentication and authorisation controls
  • Parent accounts support optional two-factor authentication (TOTP-based MFA)
  • We conduct regular security reviews and follow industry best practices
  • Data may be stored and processed on servers located in the United States and Australia

8. Data Retention

We retain personal information only for as long as necessary to provide our services. When a parent deletes a child profile, all associated data (tasks, goals, progress, health logs, rewards, and session data) is permanently deleted within 30 days. When a parent deletes their account, all child profiles and associated data are permanently deleted. Parents may request a full data export at any time through the settings page.

9. Your Rights

You have the right to:

  • Access all personal information we hold about you and your child
  • Request correction of inaccurate information
  • Request deletion of your data (right to erasure)
  • Export your data in a portable format
  • Withdraw consent at any time
  • Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) or relevant data protection authority

To exercise any of these rights, use the data management features in the parent dashboard settings page or contact us at the details below.

10. Child Access Links

Parents may generate a permanent access link for their child to use the app independently on their own device. These links do not require the child to create an account or provide any personal information beyond what the parent has already entered. Parents can deactivate these links at any time through the parent dashboard, immediately revoking the child's independent access.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of any material changes via email and in-app notification. Continued use of the application after changes take effect constitutes acceptance of the updated policy. We will always post the date of the most recent update at the top of this page.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us via our contact page.