Privacy policy

Version of 2026-11-09

PureView is a video app for parents. It plays YouTube videos, but only from channels our curators picked, and a parent decides what shows on each device. Children may watch it on a device a parent hands them, so this policy covers them too. Akiva Ackerman, a sole proprietor trading as ASH-ai, runs it. This page says what the app sends, what we keep and for how long, who else handles it, and what you can do about it.

PureView needs a free parent account to watch. The account is an email and a password; we never ask for a child's name or details.

The short version

Watching needs a free parent account (an email and a password). The app never asks a child for a name, email, photo, voice or location, and we keep no profile of any child on our servers unless a parent with premium turns on sync (below).
While a child watches, the app still sends us some things: a short play log for each video (with no device ID; when a parent is signed in, plays carry that login's account ID), search words (used for that one search, not stored), and, like every internet service, the device's network address. Details are below.
Signing out, or deleting the login, turns the filters and the PIN off on that device, and the app asks for a login again before anything plays.
The parent login is free and required to watch. With one, we keep the parent's email address, the password as a one-way hash, sign-in records, and the account activity described below.
Premium is an optional subscription a parent can buy in the app. Apple or Google takes the payment, and we never see your card. RevenueCat checks the purchase for us with your login's account ID, not your email.
Follows, likes, watch history, which channels a child watches most, the age setting, the content groups and the parent PIN stay on the device. The one exception is premium sync: if a parent with premium turns it on, we keep a copy on our server so all that parent's devices match. Turning sync off deletes the copy. Details.
No ads from us. No tracking or analytics companies. We never sell or rent anything about anyone.
Videos and their pictures load straight from YouTube (Google) on the device, so YouTube receives data from that device under its own rules, and may show its own ads.

What the app sends while a child watches

A child can watch every approved video once a parent has signed in. The app never asks the child for a name, email, photo, location or anything else, and it sends no device ID. It sends us:

Requests for the video list. The app asks our server and our database for the list of approved videos and channels. These requests carry no identifier.
A play log. When a video plays, fails or ends, the app sends the video's ID, which of those happened and an error code. When a video plays again on the same device, it also sends "replayed" for that video. When a child taps the heart on a video, it sends "liked" for that video (nothing is sent when the heart is turned off, and nothing goes to YouTube). When YouTube says a video's owner doesn't allow it to play in other apps, it also sends "unplayable" for that video. When a video can't play and the app skips on to another one, the failure says whether it skipped on and how many it had already skipped, and the video that then plays says how many it skipped (small numbers that never link rows together), so we can count each tap once. We store that with the day only. No device ID and no network address. Plays, finishes and replays carry the parent login's account ID; likes and failures never do. No time of day. Each row also gets a running number from the database. It isn't a time, but it does show the order the rows came in on that day. We use it to hide videos that keep failing or can't play in the app and, as daily totals, to rank the videos children watch, finish and like.
A check before each video plays. The app asks our database whether that video is still approved. The request carries only the video's ID, no identifier. Our database provider, Supabase, sees the network address it comes from, as with any request.
Search. What you type in search is sent to our server only to find matching videos. We don't store it. It goes in the body of the request, never in a web address, and our server doesn't log it. The search covers only the approved videos and channels, never all of YouTube, and nothing is sent to YouTube. The last 10 searches are kept on the device so a child can tap one again; a parent can clear them in Parent settings.
An update check. On launch the app asks whether a newer version of its screens exists. It sends the platform (Android or iOS) and the app's version numbers. Nothing else.

Network addresses. Like every internet service, our servers see the network (IP) address a request comes from, including requests from a child's device. We don't store the address in our database. To stop floods of requests we turn it into a keyed hash (a scrambled code that can't be turned back into the address without our secret key) and count requests per code. A hash is not anonymous: while it exists it still stands for that network, so we treat it as personal information. Those codes are deleted when their time window ends (10 minutes to 7 days), at the latest by the next daily clean-up. Our hosting providers also keep short logs of requests for security and running the service: on our current plans, Vercel keeps them for about a day and Supabase for up to a day. These logs can include the network address and the type of device or browser. We read them only to fix problems.

With a parent login

A parent login is for adults. You make it in the app (Parent settings) with your email address and a password, and confirm it with a 6-digit code we email you. Then you choose a PIN for that device. A login turns on the filters (the age setting and the content groups), the PIN, Request a channel and Send feedback. The filters and the PIN are kept on the device, not with us, unless you have premium and turn on sync. With a login we keep:

your email address;
your password, only as a one-way hash (a scrambled form that can't be turned back into the password), held by our sign-in provider, Supabase. We never see or store the password itself;
when the login was made, when it was confirmed and when it last signed in, and an account ID for the login;
while you stay signed in, the network address and device type of each phone or tablet you signed in on, kept with that session until you sign out;
our sign-in provider's security log of sign-ins, which includes your email and network addresses. We have switched off copying it into our database; Supabase keeps it in its own logs for a short time (1 hour on our current plan);
premium: whether it is on and when it ends, whether we switched it on or you bought it in the app, and, if you bought it, the plan (monthly or yearly), the store (App Store or Google Play) and when the store last told us about it.
if you have premium and turn on sync: the time you turned it on, and the copy described in Sync across devices.

Nothing about your child on the login, unless you turn on sync. Without sync, a login (premium too) holds no child's name, picture, profile, rules, watch time or history. With premium sync on, it holds the copy described in Sync across devices.

To keep you signed in, the app keeps the login's email address and its sign-in keys on the device. They go only to our sign-in provider, and to our own server when you request a channel, send feedback, buy or restore premium, or delete the login. Our server checks that the login is real and never stores its keys. It doesn't store the login with a feedback message. With a channel request it does keep which login asked (see Request a channel, below). When the app opens (at most every 12 hours) it asks our database whether the login still exists and has premium, and asks for the current time, so time-based settings can't be fooled by changing the device's clock. With premium it also asks whether sync is on for the login and, if it is, sends and fetches the synced copy.

Signing out turns the filters off. If you sign out, or our sign-in provider says the login no longer exists (for example after you delete it on another device or on our web page), the filters and the PIN on that device turn off and your child can see everything in the app. The app warns you before you sign out or delete the login. Being offline does not turn them off.

Buying premium

Premium is an optional subscription a parent can buy inside the app, behind the parent PIN. It is never offered on a child's screens. Apple (App Store) or Google (Google Play) takes the payment under its own terms; we never see or store your card or payment details. We use RevenueCat to check purchases with Apple and Google: the app gives RevenueCat your login's account ID (not your email) and the store's purchase record, and RevenueCat tells our server which plan is active and when it ends. RevenueCat handles that under its privacy policy. We don't use RevenueCat's advertising or attribution features, and we send it nothing about your child. RevenueCat, Apple and Google keep their own records of the purchase; deleting your login doesn't delete those. We may also switch premium on for a login by hand, free of charge.

Sync across devices (premium)

A parent login with premium can keep all its phones and tablets the same. Sync is off until you turn it on. Once, when you sign in with premium (or, if you are already signed in, the next time you open Parent settings), the app asks: "Keep your kids' profiles and settings the same on all your devices?" If you tap Turn on sync, we record the time you tapped it and start keeping a copy on our server. If you tap Not now, nothing is copied. You can turn it on or off later in Parent settings. Free logins never sync.

With sync on, we keep this on our server, under your login:

your settings: the "show up to age X" setting, the content groups, the grown-up's first name if you typed one, and whether the grown-up's tile opens without the PIN;
the parent PIN as a salted hash, never the PIN itself. A 4-digit PIN can be worked out from its hash by trying all 10,000 numbers, so the PIN is a lock against children, not a password. Keep using a strong password for the login;
each kid profile: the name you gave it (a nickname works fine), its emoji and colour, its "show up to age X" setting, its content groups, its time zone, its rules (hidden channels, Block Shorts, daily limit, allowed hours) and, if you set one, its own PIN as a salted hash;
for each profile, and for the grown-up's own lists: the channels it follows, the videos it liked, its Watched list (which videos were opened, and when), and how many times it played, finished and replayed videos from each channel;
each child's watch time per day, added up across your devices, so a daily limit counts on all of them.

These never leave the device, even with sync on: recent searches, the PIN's count of wrong tries, the watch report and session timer, and your sign-in keys.

Where it is and who can see it. The copy sits in our database at Supabase, in the eastern United States. It is filed under your login's account ID, never under a phone or tablet: sync sends and keeps no device ID. Only your login can read or change it through the app. It travels encrypted (HTTPS), but it is not end-to-end encrypted, so the people who run PureView and our database host, Supabase, can technically read it. We open it only to fix a problem or to answer a request from you, and our admin shows the owner which PureView channels your profiles hide (see My channels, below). We use it only to keep your devices the same: never for ads, never to rank videos for anyone else, and we never share or sell it.

Children's information. Some of the copy is personal information about your children: a profile's name, its time zone, and what each child followed, liked and watched. We treat it under the children's privacy rule (COPPA) described below. We collect it only from a parent's login, after the parent turns sync on behind the PIN. We never ask a child for it, and no other parent or child can see it.

Turning it off and deleting it.

Turn sync off in Parent settings: we delete the whole copy from our server straight away, daily watch time included. Each device keeps its own copy, as it would without sync.
Delete the login: the copy is deleted with it.
Premium ends: sync stops. If premium is not back within 90 days, we delete the copy and forget that you said yes, so the app asks again if you get premium later. Renew within 90 days and sync picks up where it stopped. The channels you added in My channels are kept longer (below).
When you remove a profile, a follow, a like or a Watched item, we keep a note that it was removed for 30 days, so your other devices remove it too.
Daily watch time is deleted after 35 days.
You can also ask us by email, mail or phone to show you the copy or delete it (see Contact).

My channels. With premium and sync on, a parent can add YouTube channels that aren't in PureView, behind the parent PIN, for one kid profile, several or all of them. For each channel you add, we keep under your login which channel it is, which of your profiles have it (by the profile's random ID, never its name), whether you ticked "Keep basic filter", and when you added it. Our server fetches the channel's public YouTube details and videos (its newest 300, then each new upload) and keeps one copy, shared by every family that added the same channel. No other family can see that you added it. Which PureView channels each profile hides is one of that profile's rules in the synced copy above.

Who can see it. The people who run PureView's channel list can see each added channel with the email address of each login that added it, how many of that login's profiles have it (for example "2 of 3 profiles", never a name), whether the filter is ticked, and when it was added. The owner also sees, with your login, the channels you added and the PureView channels your profiles hide. They use this to decide whether a channel should be in PureView for everyone. If they add it, it shows on every profile in every family like any PureView channel, your own entry for it is removed, and you can still hide it on a profile. Like the rest of the synced copy, we treat which profile has which channel as information about your children under the children's privacy rule (COPPA).

Your list of added channels, with each one's profiles and filter choice, is kept until you remove a channel in My channels, turn sync off, or delete the login. When premium ends it is kept, not deleted, so renewing brings it back. This is unlike the rest of the synced copy, which is deleted 90 days after premium ends. While premium is off, My channels stops showing on your devices, and we stop fetching new videos for a channel no paying family has. You can still remove channels, or ask us to delete the list (see Contact). A channel no family has any more is deleted from our server with its videos by the daily job, or, if our AI checked it that month, once the month is over.

On the device only

These live in the app's storage on the device, with or without a login. Without premium sync we never receive them. With sync on we keep the copy described above, and recent searches and the PIN's wrong-try count still never leave. Uninstalling the app or clearing its data removes them from the device:

follows, the videos a child liked, watch history and which channels a child watches most (likes and follows help the app suggest more like them);
the last 10 searches (each child's own with premium profiles);
with a login: the "show up to age X" setting, the content groups a parent picks (Kids, Teens, Jewish, Sports), and the parent PIN (stored as a salted hash, never the PIN itself) with its count of wrong tries;
with premium: kid profiles, each child's rules (such as hidden channels, Block Shorts and time limits) and daily watch time.

Without sync, the content groups and the parent PIN stay on the device, and so does everything a parent sets up for a child.

If the phone or tablet backs itself up (Google backup on Android, iCloud on iPhone and iPad), that backup can include this app's storage and put it back on a new or reset device. The backup belongs to you and is kept by Google or Apple; we can't see it.

The web preview (pureview-app.vercel.app) is the same app in a browser. It keeps the same on-device data in that browser's local storage instead of the app's, and clearing the site's data removes it. Our host, Vercel, sees standard request data (network address and browser type) to serve its pages.

Request a channel and Send feedback (signed-in parents)

A signed-in parent can ask us to add a YouTube channel. We receive the channel link and, only if you type it, your email address. We also record which login sent the request, so we can tell you in the app if the channel isn't approved. The people who run PureView's channel list can see that login's email address on the request in our admin. We delete that record when the channel is added, 7 days after you've seen the "not approved" note, or 90 days after you asked, whichever comes first, and with the login.

We use the email you type once, to tell you the channel was added, and then delete it. If the request is dismissed, or 90 days pass, we delete it without writing. The address is stored apart from the request count. Neither it nor the login ever appears in our admin log or our daily email. While it's kept, the people who run PureView's channel list can see it on the request in our admin.

A signed-in parent can also send us a short message. We receive the message, the app's version and, only if you type it, your email address. We don't record which login sent it. We use the email only to reply. It is deleted when we reply, when we close the message without replying, or after 90 days, whichever comes first. The message is deleted 30 days after we close it; until a curator closes it, it stays. Our reply email quotes your message, and our email provider, Resend, keeps a copy of emails it sends under its own policy. Please don't put your child's name or other personal details in it.

Bot check

We switched off our "are you a person" check (Cloudflare Turnstile) on 8 November 2026. The app and our web pages no longer show it, and neither our server nor our sign-in provider (Supabase) sends anything to Cloudflare. A phone still running an older version of the app that hasn't updated may still show the check on the parent login screens, Request a channel and Send feedback, in a small frame from our website. There Cloudflare looks at signals from the browser to tell people from bots, under its privacy policy. It is never shown on a child's screens. We no longer check or keep its answer.

YouTube

PureView uses YouTube API Services to show videos. By using PureView you agree to the YouTube Terms of Service. Videos play in YouTube's embedded player, loaded from YouTube's standard address (www.youtube.com), which connects straight from the device to YouTube. Video and channel pictures also load straight from YouTube's image servers. We don't send YouTube anything ourselves, but because the player and the pictures run on the device, including a child's device, YouTube receives what any visit to YouTube sends: the network address, device and browser details, which video is played and how, and any cookies YouTube sets in its player. YouTube may show its own ads. YouTube says that for videos marked "made for kids" it limits what it collects and doesn't show personalized ads. Most videos in the app are not marked that way, and they play under YouTube's normal rules, which can include personalized ads. We have a switch that would show only made-for-kids videos; it is off today. We add no tracking of our own to any video. Google's use of that data is covered by the Google Privacy Policy. Nothing in PureView signs in to YouTube, subscribes, likes or comments.

From YouTube we store channel and video information (titles, pictures, lengths, whether a video is made for kids). We refresh it at least every 30 days or delete it.

Who else handles data

These service providers handle data for us to run PureView. Each also has its own privacy policy that says how it handles data and how long it keeps its own logs:

Supabase: our database and parent sign-in, including the password hash (privacy);
Vercel: hosts our website and server code (privacy);
Resend: sends our emails (sign-in and password-reset codes, "it's added", replies to feedback) (privacy);
Cloudflare Turnstile: the old bot check above, only on a phone still running an older version of the app;
RevenueCat: checks premium purchases with Apple and Google (privacy);
Anthropic (Claude): suggests groups and a Home shelf for a newly added channel from its public YouTube titles and description, and checks each channel a parent asks for, using only that channel's public YouTube data (its name, description, picture and counts, and its videos' titles, descriptions and thumbnails); nothing about you or your child is sent, not even who asked. With My channels it also checks each channel a family adds, from the same public YouTube data, and, where a parent ticked "Keep basic filter", each of that channel's videos (its picture, title and the start of its description). Nothing about the family is sent. Only our admin sees the check's result.

These companies handle data under their own policies, not on our behalf:

Google / YouTube: the video player and pictures, as described above;
Google Play and the Apple App Store: they deliver the app and take subscription payments.

We don't share personal information with anyone else, unless the law makes us (for example, a court order) or to protect someone's safety.

Children's privacy (COPPA)

PureView is an app for parents, and children may watch it, so we follow the U.S. Children's Online Privacy Protection Act. This is what that means here:

The app never asks a child for personal information, and nothing in it lets a child post or share anything. Request a channel and Send feedback are behind the parent login.
From a child's device we receive the device's network address with each request. We use it only to run the service: to send the videos and the video list, to keep the service secure and to stop floods of requests. We don't store the address in our database (one exception: if a parent signs in on that device, our sign-in provider keeps the address with the parent's session, as described above). For rate limits we keep only a keyed hash, for 10 minutes to 7 days. We never use the address to contact anyone, to build a profile of anyone or for ads.
We also receive the play log and search words described above. They aren't linked to a device ID or the network address (plays, finishes and replays carry the parent login's account ID), and search words are not stored.
YouTube's player and pictures collect data from the device directly, under Google's policies, as described in the YouTube section.
A parent login holds only the parent's own details, unless the parent has premium and turns on sync. Then we keep the copy described in Sync across devices, which includes children's profiles and what each child followed, liked and watched. We collect it only after the parent turns sync on, behind the PIN, and use it only to keep that parent's devices the same.

As a parent you can, at any time:

change or remove any setting on the device in Parent settings;
turn premium sync off in Parent settings, which deletes the synced copy from our server straight away;
delete your login in the app (Parent settings, then Delete login, then your PIN) or on our delete-login page; that happens straight away;
ask us by email, mail or phone to show you, or delete, what we hold about you or your child. We reply within 7 days. If you ask us to delete something, we do it once we have checked the request comes from you, and tell you when it is done.

Deleting a login removes the email address, the password hash, the sign-in records, the sessions, any synced copy and any premium straight away. If premium was ever given by hand or the login was let in early to buy it, our admin log keeps a line saying so, with the account ID and usually your address shortened. Devices signed in with that login turn their filters off.

Deleting a login does not cancel a premium subscription bought in the app: cancel it in your App Store or Google Play account settings (in the app: Parent settings, then Manage subscription).

How long we keep things

This is our written data-retention policy. We keep information only as long as the reason for it lasts.

What	Why	How long
Follows, watch history, likes (the videos a child hearted), the last 10 searches and which channels a child watches most (on the device only). With a parent login, also: the age setting, the content groups (Kids, Teens, Jewish, Sports), the parent PIN (stored as a salted hash) and its wrong-try lock, and premium's kid profiles, per-child rules and daily watch time	So the app remembers your settings on that device, applies your filters, and can suggest more of what a child likes	On the device. Without premium sync we never receive them. With premium sync on, a copy of everything except recent searches and the PIN's wrong-try count is also kept on our server (see the sync rows below). Uninstalling the app or clearing its data removes them from that device, but the phone's own Google or iCloud backup can still hold a copy (yours, not ours). In the web preview, they stay in that browser's local storage until you clear the site's data.
Play log: a video's ID, whether it played, failed, ended, was replayed, liked or unplayable, an error code and the day. When a video couldn't play, the row also says whether the app skipped on to another video and how many it had skipped (a play after skipped videos says how many); these are small numbers that never link rows together. When a parent login is signed in, plays, finishes and replays also carry that login's account ID (likes and failures never do). The account link is removed when the login is deleted. Each row also has a running number (not a time, but it shows the order rows came in on a day)	To spot and hide videos that keep failing to play, and to rank videos children watch, finish and like	30 days
Daily totals per video and channel: plays, finishes, replays, likes, failures. No identifier.	So curators can see which videos and channels children watch and finish, and to rank videos in the app	Kept.
What you type in search	Sent to our server only to find matching videos in the approved list	Not stored. We don't keep it or log it; it is used for that one search and dropped. It travels in the body of the request, so our host's request log doesn't show it
A keyed hash of your network address (never the address itself; for IPv6, of its first part). When you buy or restore premium, also a keyed hash of the login's account ID. While it exists a hash is still tied to your network or login, so we treat it as personal information	Rate limits, so nobody can flood the play log, search, channel requests, feedback, premium checks or sign-in pages	Until its time window ends (10 minutes to 7 days), deleted by the next request or the daily job
Parent login: email address, password (only as a one-way hash, held by our sign-in provider), when the login was made, confirmed and last used to sign in, and its account ID	To sign you in, so the filters can work on your devices	Until you delete the login, or after 24 months with no sign-in and no use of the app while signed in, when we delete it for you. A login whose emailed code was never typed, so it never signed in: 7 days
Account activity: for each day a parent login opens the app, that day and how many videos were started while signed in. Keyed to the login's account ID only. Nothing about the device.	To count how many families use PureView each day, week and month, and how many keep using it.	Until you delete the login (or we delete it after 24 months unused).
Your signed-in session: the network address and device type of the phone you signed in on. Sessions don't time out on their own	Keeps you signed in, and lets sign-out end it	Until you sign out or delete the login
Sign-in security log kept by our sign-in provider, Supabase (includes your email and network addresses)	Account security	We have switched off copying it into our database. Supabase keeps it in its own logs for a short time set by our plan (1 hour on our current plan). If it is ever copied into our database again, the daily job deletes it after 30 days
Premium, only if we gave it to your login: that it is on, when it was given, and when it ends or was taken away	So the app knows to unlock premium features on your devices	Until you delete the login
Our admin log line when premium is given or taken away by hand, or when a login is let in early to buy premium: the login's account ID and, on most lines, your address shortened (like a…@gmail.com). A shortened address next to an account ID can still point to you	A record of who changed what in the admin	Kept. The log can't be edited, so these lines stay after a login is deleted. They hold nothing about your children
A parent's optional email on a channel request (signed-in parents only)	To send one "it's added" email	Deleted after that email, when the request is dismissed, or after 90 days, whichever comes first
Channel request tally (the YouTube channel, how many asked, when)	So curators see what parents want	While open; deleted 30 days after a curator adds or dismisses it. The date of each ask: 90 days
Which parent login asked for a channel (signed-in parents only): the login, when it asked, and whether you've seen the "not approved" note	To tell that parent in the app if the channel isn't approved. The people who run PureView's channel list see that login's email address on the request in our admin	Deleted when the channel is added, 7 days after you've seen the "not approved" note, or 90 days after you asked, whichever comes first. Deleted with the login
A parent's feedback message and the app version it was sent from (signed-in parents only). It does not say who sent it	So curators can read it and fix what it is about	Until a curator replies or closes it; deleted 30 days after that
A parent's optional email on feedback	Only to reply to that message	Deleted after the reply, when the message is closed without a reply, or after 90 days, whichever comes first
Premium bought in the app: which plan (monthly or yearly), which store (App Store or Google Play), when the current period ends, and when the store last told us about it. Never a card or payment detail, a price or a receipt	So the app knows premium is on for your login, and stops it when the subscription ends	Until you delete the login. RevenueCat, Apple and Google keep their own records of the purchase under their own policies; deleting the login doesn't remove those
Whether we let your login buy premium before it is open to everyone (a yes or no on the login)	To try buying premium with a few logins first	Until you delete the login
The ID and kind of each subscription notice the store sends us through RevenueCat, and whether it was a test purchase or a real one. It does not say which login it was about	So the same notice is never applied twice, and so we can count real subscriptions apart from tests	90 days
Premium sync, only if you turn it on: your settings (age setting, content groups, the grown-up's first name), the parent PIN as a salted hash, each kid profile (its name, picture, "show up to age" setting, content groups, time zone, rules and optional kid PIN as a salted hash), and each profile's follows, likes, Watched list and how often it plays each channel. Also the time you turned sync on	So every phone or tablet signed in to your login shows the same profiles, settings and lists	Until you turn sync off or delete the login, which deletes it at once, or 90 days after premium ends. A login unused for 24 months is deleted with everything on it
With sync on, a note that a profile, follow, like or Watched item was removed	So your other devices remove it too	30 days
With sync on, each child's watch time per day, added up across your devices (seconds per profile per day, no device)	So a daily time limit counts on every device	35 days. Deleted at once when you turn sync off or delete the login
With sync on, a random code for each batch of watch time a device sends. A new code every time, never tied to the device	So a batch that is sent twice is counted once	7 days
My channels, only with premium and sync on: the YouTube channels you added, which of your kid profiles have each one (by the profile's random ID, never its name), whether "Keep basic filter" is ticked, and when you added it	So the channels you added show on the right profiles on all your devices. The people who run PureView's channel list see each channel with the login's email address and a count of profiles, never a profile's name	Until you remove them, turn sync off or delete the login. When premium ends they are kept, not deleted, so renewing brings them back. The rest of the synced copy is deleted 90 days after premium ends
The public YouTube details and videos of each channel a family added (its name, picture and description, and its newest 300 videos plus new uploads), one copy however many families added it, with our automatic check's result and the filter's answers	So those channels can play, and so the people who run PureView can decide whether to add one for everyone	While any family has the channel. Then the daily job deletes it, or, if our AI checked it that month, once the month is over

A daily job deletes expired information automatically. Our providers' own backups and logs follow their own schedules, so a deleted item can stay in them for a short time after it is gone from our database.

Keeping it safe

Everything travels encrypted (HTTPS). Passwords are held only as one-way hashes by our sign-in provider. Database rules let a signed-in parent read only their own login's details. Only the owner and invited curators can reach the admin, and only the owner can see the list of parent logins. No system is perfectly secure. If we learn that personal information we hold was accessed without permission, we will tell the parents affected, and the authorities where the law requires it, as quickly as the law requires.

Changes

If we change this policy, we'll update the date at the top. If a change means collecting new information from or about children, we will ask parents first where the law requires it.

Contact

Akiva Ackerman, a sole proprietor trading as ASH-ai
Email: akiva@ash-ai.app
Phone: (917) 924-0018
Postal address: 136 Donahue Avenue, Inwood, NY 11096
Website: www.ash-ai.app

The phone number is here because the children's privacy rule asks this notice to list one. Email is the quickest way to reach us.