Kids Learn to Earn Privacy Policy

1. Who we are and how to reach us

Kids Learn to Earn is operated by Espyeon LLC, a limited liability company organized in the State of Ohio. We are the only operator that collects or maintains personal information from children through Kids Learn to Earn. The service providers that process information on our behalf are listed in section 11 and act only on our instructions.

Parents may contact us at any of these with any question about this policy or about their child’s information, and we will respond.

2. Who the app is for, and how accounts work

Kids Learn to Earn has two kinds of user, and they are treated very differently:

• The parent or legal guardian (the “account holder”), who must be 18 or older. Only the account holder can create an account, give consent, create child profiles, choose which apps are restricted, set the rules, see results, and change or delete anything.
• Children, who use a profile their parent created. A child cannot create an account, cannot sign up on their own, and cannot change the rules.

Children cannot make any personal information public through Kids Learn to Earn. There is no chat, no messaging, no public profile, no leaderboard visible to other people, no user-generated content that anyone else can see, and no way for a child to contact or be contacted by anyone through the app.

All settings, the parent dashboard, purchases, and any link that leaves the app sit behind a parental gate — a check a young child cannot pass — as Apple and Google require for apps directed to children. The parental gate is a safeguard against children wandering into adult areas; it is separate from, and does not replace, the parental consent described in section 3.

3. Parental consent, before anything is collected from a child

We obtain verifiable parental consent before we collect, use or disclose any personal information from a child, and we do not activate a child profile until we have it. It works like this:

1. The parent creates the account with their own email address. That is the only information we collect before consent, and we collect it only to seek consent and to send the parent this notice.
2. We send the parent a direct notice by email explaining what we will collect from their child, how we will use it, and a link to this policy.
3. The parent gives consent by confirming through that email. Because we use children’s information only inside our own service and do not disclose it to third parties, COPPA permits this “email plus” method; as the “plus”, we follow up with a second, confirming email after a delay, so a parent can withdraw consent if the first confirmation was not theirs.
4. Only then can the parent create a child profile and can the child use the app.

If consent is not given within 14 days, we delete the parent’s contact information and anything else collected for the purpose of seeking consent.

A parent may withdraw consent at any time — see section 14. Withdrawing consent stops all further collection from that child. We will never condition a child’s participation on the child disclosing more information than is reasonably necessary for the activity.

If we ever wanted to disclose a child’s information to a third party for a purpose that is not integral to the service, COPPA would require a separate, specific consent for that disclosure. We do not do this, and we would ask before we did.

4. Information we collect from parents

• Account details — email address and password. Passwords are stored only as salted cryptographic hashes; we cannot read them.
• Consent records — when and how consent was given, so we can show that it was.
• Rules and settings — which apps or categories to restrict, the number of quiz questions, the pass mark, the length of a reward window, and similar choices.
• Subscription status — whether a subscription is active, as reported by Apple or Google. We never receive payment card details.
• Correspondence — anything you send us for support.

5. Information we collect from and about children

We collect only what the app needs to work. This is the complete list:

A child’s first name is never required — a nickname works just as well, and we suggest one.

6. Information collected automatically, and persistent identifiers

Like any app, Kids Learn to Earn uses a small amount of technical information to work: the device model, operating system and app version, crash and error reports, and an app-generated identifier for each installation. These identifiers are persistent identifiers under COPPA.

We use them only to support the internal operations of the app, which specifically means:

• keeping a child’s profile linked to the right device;
• syncing the parent’s rules across the family’s devices;
• keeping the parent signed in securely;
• diagnosing and fixing crashes and errors; and
• protecting the service against fraud and abuse.

We ensure these identifiers are not used for anything else: they are never used to contact a specific person, never used for advertising of any kind, never used to build a profile of a child, never combined with information from other companies, and never disclosed to a third party except a service provider processing them for the purposes above. We do not access the device’s advertising identifier (IDFA or Android advertising ID), and we do not use any cross-app tracking.

7. What we never collect

Kids Learn to Earn does not collect, and does not ask the device for permission to access, any of the following:

• precise or approximate location;
• contacts, photos, videos, microphone or camera;
• messages, calls, or the content of any other app;
• browsing history or websites visited;
• a child’s email address, phone number, or date of birth;
• the device’s advertising identifier; or
• biometric data. When a parent uses Face ID or Touch ID for an override, the check happens entirely inside the device’s operating system; we receive only a yes or no, never the biometric itself.

8. How the device restrictions work, and what the app can see

Restricting other apps is the core of Kids Learn to Earn, so it matters exactly what that gives us access to. The answer differs by platform.

iPhone and iPad

On Apple devices, Kids Learn to Earn uses Apple’s Screen Time API (the Family Controls, Managed Settings and Device Activity frameworks). A parent or guardian in the same Apple Family Sharing group authorises it on the child’s device, and chooses which apps and categories to restrict using Apple’s own app picker.

Android

On Android, the operating system provides no equivalent sealed-token system, so the app necessarily knows the identifiers of the apps you choose to restrict, and it must observe which app is in the foreground in order to show the Shield. On Android the app will ask for the specific system permissions this requires, with a clear explanation and your explicit consent before any are granted, and it shows a persistent notification whenever the restrictions are active.

• We store the identifiers of the apps and categories you choose to restrict, so the rules can be enforced and synced to your other devices.
• Foreground-app information is used on the device, in the moment, only to decide whether to show the Shield. We do not store a history of which apps your child opens or for how long, and we do not send it to our servers.

On both platforms

The restrictions are never hidden. The app has a normal, visible icon, the Shield tells a child plainly that a rule is in effect, and the app is designed and marketed exclusively for parents managing their own children’s devices. It must not be used to monitor an adult — see the Terms.

9. How we use information

We use the information described above only to:

• create and run the parent account and each child’s profile;
• show grade-appropriate quizzes, grade them, and apply the parent’s pass mark;
• unlock restricted apps for the reward window a child has earned, and re-apply the restrictions when it ends;
• show the parent their child’s results and progress;
• sync the parent’s rules across the family’s devices;
• verify subscription status;
• send the parent the notices and service messages the account needs, and answer support requests;
• keep the service secure, fix faults, and prevent abuse; and
• meet our legal obligations.

10. Advertising, analytics and tracking

• There is no advertising in Kids Learn to Earn — no third-party ads, no behavioural or targeted ads, no contextual ads, no sponsored content, and no advertising software development kits.
• There are no third-party analytics in the app, and no tracking pixels or cross-app tracking.
• We never send a child’s personal information, or information about their device, to any third party other than the service providers in section 11 that host and run the app for us.

11. Who we share information with

We do not sell, rent or trade personal information, and we do not share it for targeted advertising. We disclose it only to service providers that host and operate Kids Learn to Earn on our behalf, and only what each needs to do that job:

Apple and Google. Subscriptions are purchased through the App Store or Google Play, which process payment under their own privacy policies; we receive only whether a subscription is active. On Apple devices, the Screen Time frameworks run inside Apple’s operating system on the device. We do not send children’s personal information to Apple or Google.

Legal requirements. We may disclose information if we are required to by law or valid legal process, or where necessary to protect the safety of a child or anyone else. We review such demands for validity and scope and will tell the parent where we lawfully can.

Business transfers. If Espyeon LLC is involved in a merger, acquisition or sale of assets, information may transfer to the successor, which must continue to honour this policy for information collected under it. We would notify parents before any different policy applied, and obtain new consent where COPPA requires it.

12. How long we keep information — our data retention policy

This is our written data retention policy for children’s personal information, as the COPPA Rule requires. We keep information only as long as it is reasonably necessary for the purpose it was collected for, and we never keep children’s personal information indefinitely.

Inactive accounts. If neither the parent nor any child uses an account for 24 months, we email the parent. If the account is still not used 30 days after that notice, we delete all children’s personal information in it.

Deleted information is removed so that it cannot practicably be read or reconstructed. A consent record contains only the parent’s email address, the date and the method — no information about the child.

13. How we protect information

We maintain a written information security program for children’s personal information, as the COPPA Rule requires. It names the person responsible for it, is based on a regular assessment of risks, is reviewed and tested at least once a year, and covers the service providers we use. Its safeguards include:

• encryption of all data in transit (TLS) and at rest;
• access to children’s information limited to the few people who need it to run the service, protected by multi-factor authentication and logged;
• salted, one-way hashing of passwords; and
• written security and confidentiality commitments from every service provider that can access children’s information.

No system is perfectly secure, and we do not claim otherwise. Parents can help by choosing a strong, private parental passcode and account password.

14. Your rights as a parent

At any time, and at no charge, a parent may:

• review the personal information we hold about their child;
• correct it — the profile name, grade and settings can be changed directly in the parent dashboard;
• have it deleted — one child’s profile, or the whole account;
• refuse further collection or use of their child’s information, by withdrawing consent; and
• receive a copy of it in a portable format.

How. Most of this can be done directly in the parent dashboard, behind the parental passcode — see Account & Data Deletion for the exact steps. You can also email Contact@espyeon.com. Because a request about a child is a request about someone else’s information, we first confirm that it comes from the child’s parent — normally by asking you to reply from the email address on the account.

Withdrawing consent means we can no longer run that child’s profile, so we delete it. The rest of your account is unaffected.

15. App store age signals and consent

In some places, including Texas and Utah, the law requires app stores to confirm a user’s age category and obtain a parent’s consent for a minor’s downloads, purchases and significant app changes. Where that applies, Kids Learn to Earn may receive an age category — never a date of birth — from Apple’s or Google’s age-assurance systems, and a notice if a parent withdraws consent through the store.

We use those signals only to comply with those laws and to honour a withdrawal of consent. We do not use them for any other purpose, and we do not share them. This store-level consent is in addition to, not instead of, the consent described in section 3.

16. Children outside the United States

Where the EU or UK General Data Protection Regulation applies, we process a child’s information on the basis of the consent given by the holder of parental responsibility, which may be withdrawn at any time, and on the basis of performing the service the parent asked for. Parents there have the rights described in section 14, plus the rights to restrict or object to processing and to complain to their data protection authority.

In line with the UK Age Appropriate Design Code, the app is private by default: there is no location collection, no profiling, no advertising, no nudges to share more, and a child is always told plainly — by the Shield — when a parent’s rule is in effect.

17. California and other US states

We do not sell or share personal information, as those terms are defined under California law, and we have not done so in the preceding 12 months. We do not sell or share the personal information of any consumer under 16. Parents in California and in every state with a comprehensive privacy law have, at a minimum, the rights described in section 14; where a state provides an appeal process and we decline a request, we will explain how to appeal.

18. International data transfers

Espyeon LLC is based in the United States, and the service is hosted there. If you use Kids Learn to Earn from outside the US, your family’s information is transferred to the US. Where required, we rely on the European Commission’s Standard Contractual Clauses and the UK Addendum, together with encryption and access controls.

19. If there is a security incident

If personal information about your family is accessed without authorisation, we will notify you without undue delay, and notify regulators, as the law requires. We will tell you what happened, what information was involved, what we have done, and what you can do.

20. Changes to this policy

If we change this policy, we will update the date at the top. Before any material change to how we collect, use or disclose children’s information takes effect, we will notify parents directly and obtain new consent where COPPA requires it. Where app store age-assurance laws apply, we will also report the change through the store so it can seek any parental approval those laws require. We will never apply a less protective policy to information already collected without the parent’s consent.

21. Contact

Questions, requests or complaints about this policy or your child’s information: Contact@espyeon.com. Our full postal address is in section 1, and company details are on our About page.