Privacy Policy

1. Personal Information Collected

(Parent account)

• Email, password (stored as an encrypted hash)
• For social sign-in: your Google or Kakao account identifier, email (optional consent for Kakao), and nickname
• Push notification token (FCM), payment receipts (Google Play)

(Child information — entered by the parent)

• Nickname, character selection
• Mission, reward, warning, and penalty records
• Verification photos (stored after removing EXIF data such as location)

(Automatically generated)

• Access times, device model, and other logs needed to operate the Service

2. Purpose of Collection and Use

Member identification and authentication; providing child mission, reward, and combined ranking features; sending push notifications; processing payments and refunds; reviewing reported content and blocking inappropriate users; improving the Service and statistical analysis.

3. Information About Children Under 14 (Special Provisions)

In accordance with Article 22-2 of Korea's Personal Information Protection Act and the U.S. COPPA, the following applies:

• All information about a child is entered directly by the parent, who is the child's legal guardian. There is no process for a child to sign up or enter information themselves.
• Kid Mode operates under the parent's account without a separate account, and no additional personal information is collected from the child.
• Parents may edit or delete their child's information at any time (in-app: Settings → Manage Children).
• A child's verification photos are stored privately and cannot be viewed by anyone other than the parent.
• Behavioral advertising to child users is blocked by always enabling AdMob's Tag for Child-Directed Treatment (TFCD).

4. Disclosure to Third Parties

As a rule, we do not disclose users' personal information to third parties, except in the following cases:

• Combined ranking: if a parent turns on the "Join overall ranking" opt-in, that child's nickname, character, and score become visible to other parents. This opt-in is off by default and can be turned off at any time.
• When lawfully requested by an investigative or other government authority under applicable law.

5. Outsourced Processing and Cross-Border Transfer

To provide the Service smoothly, we entrust some processing to the following companies. Each processor implements technical and administrative safeguards to ensure security.

• Supabase Inc. (United States) — database, storage, authentication
• Google LLC (United States) — Firebase Cloud Messaging (push notifications), Firebase Analytics/Crashlytics, Google Sign-In, Play Billing (payments)
• Kakao Corp. (Republic of Korea) — Kakao Sign-In
• Apple Inc. (United States) — App Store payments (iOS)

Outsourcing processing to Supabase, Google, and Apple involves transferring data outside your country. The data transferred is limited to the items listed under "Information Collected" above, and the transfer occurs when you use the relevant feature — signing up, signing in, receiving push notifications, or making a payment. By agreeing to this Policy, you are considered to have consented to this cross-border transfer.

6. Retention Period

Upon account deletion or withdrawal of consent, all personal information is destroyed immediately, except where applicable law requires retention for a specific period:

• Act on Consumer Protection in Electronic Commerce, etc.: payment and refund records for 5 years
• Protection of Communications Secrets Act: access logs for 3 months
• For fraud prevention purposes: block records for 1 year

7. Data Subject Rights and Data Deletion

Users (or their legal guardians) may request to view, correct, delete, or restrict the processing of their information.

• In-app: Settings → Delete Account — immediately destroys child information, missions, verification photos, and payment records
• Web: https://kidshabit.app/delete-account — if you don't have the app or can't access it
• Email: mini3486@gmail.com — processed within 7 business days

8. Security Measures

• Passwords are stored as hashes, and authentication tokens are encrypted
• Communications are encrypted with TLS 1.2 or higher
• Row Level Security (RLS) restricts database access to each user's own data
• EXIF metadata such as location is removed from uploaded photos
• Access is limited to what's necessary, with regular security reviews

9. Advertising Identifiers

To block behavioral advertising to child users, we always enable AdMob's Tag for Child-Directed Treatment (TFCD) and Tag for Users under the Age of Consent (TFUA). No ads are shown on screens used directly by children, such as starting a mission or requesting a reward.

10. Data Protection Officer and Contact

Data Protection Officer: Kids Habit Operations Team

Email: mini3486@gmail.com

We respond within 7 business days.