Service Providers and Sub-processors
Version 1.0.0-draftEffective 16 August 2026Updated 15 August 2026
Every company that handles your family's data on our behalf, what each one receives, where it is processed, and what we require of them in writing. We publish this because you cannot judge whether your child's data is safe without knowing who holds it.
How we notify you of changes
We will publish any new service provider here at least 30 days before it starts handling your data, and email you if it will handle children's data. If you object, you may close your account and we will refund the unused part of your subscription.
Who processes data on our behalf
| Provider | Service | Child data? | What it receives | Hosting region | DPA status |
|---|---|---|---|---|---|
| Google LLC | Gemini — avatar image generation and text moderation | Yes | Photograph of a child's face (transient, one request), Clothing description typed by a child | REGION_GOOGLE | NOT_EXECUTED |
| Anthropic PBC | Claude — mission suggestions, weekly report commentary, parent assistant | Yes | Child's age, gender and activity summary under a pseudonym, Parent's free-text messages | REGION_ANTHROPIC | NOT_EXECUTED |
| Amazon Web Services | S3 object storage | Yes | All photographs: avatars, mission proof, post images | REGION_AWS | NOT_EXECUTED |
| MongoDB Inc. (Atlas) | Primary database | Yes | All structured records | REGION_MONGODB | NOT_EXECUTED |
| Mixpanel Inc. | Product analytics | Yes | Persistent identifier, Fixed allowlist of usage events | REGION_MIXPANEL | NOT_EXECUTED |
| Google Firebase | Push notifications, Remote Config | Yes | Device notification token, Device and app metadata | REGION_FIREBASE | NOT_EXECUTED |
| RevenueCat Inc. | Subscription management | No | Parent account identifier, Transaction data | REGION_REVENUECAT | NOT_EXECUTED |
| Resend | Transactional email | No | Parent email address, Message content | REGION_RESEND | NOT_EXECUTED |
| Apple Inc. / Google Play | App distribution and billing | No | Purchase data | Global | PLATFORM_TERMS |
Who inside Kibu can see your data
Our own staff can access family data only where their role requires it, only through logged administrative tools, and only under the access controls in our security programme. We do not browse family content.
The full policy set
This policy is one of 13. The rest cover children’s privacy, consent, retention, security, AI and the terms you agree to.
For parents
Privacy Policy
Kibu is a family app used by parents and by children. This policy explains what we collect, why, who we share it with, how long we keep it, and how you control it. Because most of our users are children, we hold ourselves to children's privacy rules everywhere we operate — not only where the law compels it.
/privacy-policy
For parents
Children's Privacy Policy
This is the notice required by the United States Children's Online Privacy Protection Act (COPPA), and it also serves as our children's privacy statement for the United Kingdom, the European Union, Saudi Arabia and the US states with children's design codes. It sits alongside our main Privacy Policy and, where the two differ, this one governs anything to do with a child.
/childrens-privacy
For parents
Parental Consent Notices
Kibu asks for your consent separately for each thing we want to do with your child's information, so that agreeing to one never silently agrees to another. This page holds the full text of every consent we ask for. Each is the notice referenced by the corresponding checkbox in the app.
/parental-consent
For parents
Data Retention Policy
How long Kibu keeps each kind of information, why we need to keep it that long, and what happens when the time is up. COPPA requires us to publish this, and we treat it as a specification our systems must actually implement — not a statement of intent.
/data-retention
For parents
Terms of Service
The agreement between you and Kibu. It covers who may hold an account, what you are responsible for, subscriptions and refunds, and how either of us can end the agreement.
/terms
For parents
Cookies and Tracking
What the Kibu website stores on your device, and what the Kibu app stores on your phone. There is no advertising tracking anywhere in Kibu, and nothing at all is tracked on a child's device without a parent's verified consent.
/cookies
Parents and kids
Community Guidelines and Content Moderation Policy
What is allowed on Kibu, how we check, what happens when something breaks the rules, and how to report it. This is a safety document as much as a legal one — it exists because children can see what other children post.
/community-guidelines
For parents
Your Rights and How to Use Them
What you can ask us to do with your family's data, how to ask, what we need from you, and how long we take. Everything here is free, and most of it you can do yourself in the app without contacting us at all.
/your-rights
For parents
How Kibu Uses AI
Kibu uses AI in four places. This page says exactly where, what is sent, who receives it, what we forbid them to do with it, and what your child can and cannot do with AI. Children never talk to an AI in Kibu.
/ai
For schools
Kibu and Schools — FERPA and Student Privacy
Kibu is a consumer family product. We contract with parents, not with schools, and we hold no education records. This page explains our position on FERPA and US state student-privacy laws, and states plainly what we will not do.
/schools
For parents
Security at Kibu
A public summary of how we protect your family's data. The full written programme is an internal document; this page tells you what it covers and how to reach us if you find a problem.
/security
Written for kids
Your Privacy, Explained
A version of our privacy policy written for the children who use Kibu. Required by the ICO Children's Code, which says information must be presented in a way children can actually understand — and by the EU's rules on protecting minors online.
/privacy-for-kids