Privacy Policy

Who we are

Kiko is operated by Small Batch Ventures LLC, based in Orange County, California. Contact us at [email protected] for any privacy-related questions.

What we collect

When you create an account and set up a child profile, we collect:

• Your email address and hashed password (for account authentication)
• The date and timestamp of your parental consent (COPPA compliance)
• Child profile information you provide: name, age, language preference, proficiency level, learning interests
• Learning activity data: words snapped, daily snap counts, streaks, words learned
• The path to photos stored locally on your device (not the photos themselves)
• Translation feedback you voluntarily submit via the "Wrong translation?" feature

We do not collect: location data, device contacts, browsing history, advertising identifiers, or any data not described above.

How photos work

When your child snaps a photo:

• The photo is resized on your device to reduce file size
• The resized image is sent over HTTPS to Anthropic's Claude AI API for object identification
• Anthropic returns the identified word, translation, and fun fact — the image is not retained by Anthropic per their API data usage policy
• The photo is saved to your device's local storage (not our servers)
• We store only a file path reference in our database — never the image itself
• If you delete a word from your library, the photo is deleted from your device immediately

If you reinstall the app, locally stored photos are cleared with it. Your word history (text data) remains saved to your account.

Children's data (COPPA)

All child profiles are created and managed by a verified parent or guardian. We:

• Require explicit parental consent before creating any child profile
• Store a timestamp of that consent in your account record
• Do not allow children to create accounts independently
• Do not share children's data with third parties for advertising purposes
• Do not use children's data for behavioral profiling or targeted advertising
• Do not collect more information than necessary to provide the learning experience

Parents may review, correct, or request deletion of all data associated with their account and child profiles at any time by emailing [email protected]. We will respond within 30 days.

How we use your data

• To provide and improve the Kiko language learning experience
• To track your child's learning progress, streaks, and word history
• To process subscription payments via RevenueCat and Apple
• To verify your 7-day free trial eligibility (prevents trial abuse on reinstall)
• To improve translation accuracy using anonymized correction feedback only
• To send important account notifications (never marketing without consent)

Third-party services

• Supabase — database and authentication provider. Data stored in the United States. Privacy policy →
• Anthropic — AI image processing (Claude API). Photos are sent for identification only. Anthropic does not retain API-submitted images for training per their API terms. Privacy policy →
• RevenueCat — subscription management and payment processing. We never store card numbers. Privacy policy →
• Apple — App Store distribution, in-app purchases, TestFlight. Privacy policy →

We do not use any third-party advertising, analytics, or tracking SDKs. There are no ads in Kiko.

California residents — CCPA

California residents have the right to: know what personal information we collect and how it's used; request deletion of their personal information; opt out of the sale of personal information. We do not sell personal information. To exercise any of these rights, contact [email protected]. We will not discriminate against you for exercising your privacy rights.

Image content reporting

Small Batch Ventures complies with all applicable federal and state laws regarding illegal digital content. Because photos are stored locally on your device and never retained on our servers, we do not have access to user-generated images. Our AI safety system prompt blocks processing of inappropriate, violent, or explicit content.

Data retention

We retain your account data for as long as your account is active. If you delete your account, all associated data is removed from our servers within 30 days. Photos are stored on your device only and are not subject to our retention schedule — they are controlled entirely by you.

Security

We use industry-standard security practices: all data transmitted over HTTPS/TLS, passwords hashed using bcrypt (never stored in plain text), database access controlled by row-level security policies, and API keys stored as environment variables (never in client code).

Changes to this po