Children's Privacy Policy

1. Who operates Kibu

Kibu Company, 8098 Hajr, Dhahran 34254, Saudi Arabia is the sole operator of the Kibu app and of getkibu.com. No other operator collects personal information through Kibu.

For any question about your child's information, contact [email protected] or write to the address above. We answer within 30 days.

2. What we collect from a child

A child cannot register for Kibu. A parent or guardian creates the child's profile, and we collect nothing from the child until that parent has given us verifiable consent.

Information the parent gives us about the child: full name, date of birth, gender.

Information the child gives us directly inside the app: a username, a PIN, a photograph taken with the camera for avatar generation, a short description of the clothing they want their avatar to wear, photographs attached to completed missions, post captions and post photographs, messages in the family chat, answers to the daily question, and reports they submit about content they have seen.

Information we generate about the child: a cartoon avatar, points, level, streak, coins, badges, mission history, and a weekly summary for the parent.

Information collected automatically: a device notification token, app version and device type, and — only where the parent has given verified consent for analytics — a persistent identifier and a limited, fixed list of usage events.

3. How we use it

We never use a child's personal information for advertising, marketing, profiling for commercial purposes, or to contact the child outside the app.

• To operate the child's profile and let them sign in.
• To generate a cartoon avatar from the photograph, once.
• To run missions, rewards and the game mechanics.
• To let family members send messages to each other.
• To let the child share posts with approved friends, if the parent enabled that.
• To screen what the child writes and uploads, so other children are not exposed to harmful content.
• To produce a weekly summary and mission suggestions for the parent.
• To send notifications to the child's device.

4. Who we disclose it to

COPPA requires us to tell you the identities or categories of every third party we disclose your child's information to, and why. Here they are by name.

You may consent to us collecting your child's information without consenting to us disclosing it to Google, Anthropic or Mixpanel. Declining any of those three disables that feature only; the rest of Kibu works normally. This choice is offered at the moment we ask, and can be changed at any time in Settings.

Every one of these companies is bound by a written agreement requiring confidentiality, security, deletion on our instruction, and a prohibition on training their own models on your child's data.

5. We do not require more than we need

We do not make your child's participation in any part of Kibu conditional on giving us more personal information than is reasonably necessary for that activity.

Concretely: a child who does not want a photo-based avatar picks a ready-made character and loses nothing else. A family that declines the social feature keeps every other feature. A family that declines analytics or AI keeps the full product.

6. Your rights as a parent

None of these requires you to contact support, pay a fee, or explain why. If you would rather email us, [email protected] works and we will verify you are the account holder before acting.

If you refuse further collection, we will delete what we already hold about your child, except the consent records described in section 7.

• Review what we have collected from your child, at any time, from Settings → Your family's data.
• Download all of it as a file.
• Correct anything that is wrong.
• Delete any individual item, the child's whole profile, or the entire family account.
• Refuse to permit any further collection or use of your child's information, while keeping the account.
• Withdraw any consent you have given, individually.

7. How long we keep a child's information

We keep a child's personal information only as long as is reasonably necessary for the purpose it was collected for. We do not keep it indefinitely.

Our full written retention policy — every category, the business need, and the deletion timeframe — is published at getkibu.com/data-retention and forms part of this notice, as COPPA requires.

Two things to know specifically. First, the photograph a child takes for their avatar is deleted as soon as the avatar is generated; we do not keep it. Second, the record of the consents you gave outlives the account, because it is our evidence that we acted lawfully — it holds no content about your child.

When a retention period ends, or you delete something, we delete it from our database and from our file storage. Deletion is not a hidden flag; the file is removed.

8. How we protect it

We maintain a written information security programme specifically covering children's personal information. It names an individual responsible for coordinating it, requires risk assessments at least annually, sets safeguards against the risks identified, requires regular testing and monitoring, and is evaluated and updated at least once a year.

Before we let any service provider handle children's information, we assess whether they can keep it confidential, secure and intact, and we obtain written assurances that they will.

9. We do not rely on the internal-operations exception

COPPA lets an operator collect a persistent identifier from a child without parental consent, where it is used solely to support the internal operations of the service. We have chosen not to rely on this.

If a parent has not given verified consent for analytics, we send nothing about that child to our analytics provider — not a reduced event, not an anonymised one. The stream is closed, not narrowed.

We never use a persistent identifier to contact a specific child, to build a profile of a child, or for any form of advertising.

10. Ages, and which rules apply where

Different countries set different ages at which a young person can agree to data processing themselves. We apply whichever is highest for where your family is.

Where we cannot establish your country reliably, we apply the strictest rule we operate under, not the most permissive.

Because Kibu is built for families, a parent creates and controls every child profile regardless of the child's age, and the protections in this notice apply to every child on Kibu — not only those below the local threshold.

11. High privacy by default

Every privacy-affecting setting on a new child profile starts at its most protective position. Nothing that shares a child's information with anyone outside their family is on unless a parent deliberately turns it on.

12. Keeping children safe from each other

Where the social feature is on, everything a child writes is screened before it can be seen by anyone else, and every photograph is classified before it is published. Content that fails screening is not published, and where our checks cannot run we refuse to publish rather than publishing unchecked.

Any child or parent can report a post. Reports go to a trained reviewer with a target response time published in our community guidelines. Suspected child sexual abuse material is escalated immediately and reported to the appropriate authority.

Children cannot message anyone outside their own family, and cannot be contacted by an adult stranger through Kibu.

13. If we change this

If we want to collect, use or disclose your child's information in a materially different way from what you agreed to, we will ask you again and wait for your answer. We will not treat continued use of the app as agreement, and we will not apply the change to your family in the meantime.