Your Rights and How to Use Them
Version 1.0.0-draftEffective 16 August 2026Updated 15 August 2026
What you can ask us to do with your family's data, how to ask, what we need from you, and how long we take. Everything here is free, and most of it you can do yourself in the app without contacting us at all.
1. Most of this you can do yourself
We built these into the app deliberately. A right you have to email someone about is a right with a queue in front of it.
| What you want | Where |
|---|---|
| See everything we hold about your child | Settings → Your family's data |
| Download it as a file | Settings → Your family's data → Download |
| Correct your child's details | The child's profile |
| Delete a post or a photo | The post itself |
| Delete your child's profile | Settings → Family |
| Delete the whole account | Settings → Account |
| Withdraw a consent | Settings → Privacy |
| Turn off social features | Settings → Privacy |
2. Seeing and downloading your data
The download includes: your child's profile details, every post and caption, family messages, mission history and proof photographs, badges and progress, friend connections, reactions, weekly reports, and the full record of the consents you gave.
It arrives as a structured file with the photographs attached, readable without Kibu. This satisfies COPPA's parental review right and the UK, EU and Saudi rights of access and portability at the same time.
3. Correcting things
Edit your child's details in their profile. If something is wrong that you cannot edit — a badge, a mission record, a report decision — email [email protected] and we will correct it or explain why we think it is right.
4. Deleting things
Deleting a child's profile removes their details, posts, photographs, messages, mission history, badges, friendships and progress — from our database and from our file storage. Their friends stop seeing them.
Deleting your account does the same for every child in the family, and removes your own details too.
Two things survive, and neither identifies your child: the record of what you consented to, which is our proof we acted lawfully, and the figures in our accounts, which we strip of any link to your family.
Deletion completes within 30 days. Backups are overwritten on a 35-day cycle and deleted records are never restored from them.
5. Withdrawing consent
Every consent is separately revocable, and withdrawing one never affects another or closes your account.
When you withdraw analytics consent we stop immediately and instruct our analytics provider to delete everything they hold about your child. We keep their confirmation.
You can also refuse any further collection while keeping the account open. Tell us at [email protected] and we will delete what we hold and stop collecting.
6. Other rights, depending on where you live
| Right | What it means | Where it applies |
|---|---|---|
| Object | Tell us to stop processing that relies on our legitimate interests | UK, EU |
| Restrict | Have us hold data without using it while a dispute is resolved | UK, EU |
| Portability | Get your data in a machine-readable form, or sent to another provider | UK, EU, Saudi Arabia |
| Know what is disclosed | A list of who we shared data with | US states, UK, EU, Saudi Arabia |
| Non-discrimination | We never degrade your service for exercising a right | Everywhere |
| Delete a minor's account on request | Applies to under-18s, not only under-13s | Several US states |
7. How we check it is really you
For anything done inside the app, being signed in to the account is enough.
For an emailed request we reply to the address on the account and ask you to confirm from it. For a deletion or a full export we may ask you to confirm a detail only the account holder would know. We will never ask you to send a copy of an identity document by email.
If we cannot verify you, we will say so rather than acting — releasing a child's data to the wrong person is the worst outcome available to us.
8. How long we take
| Request | Target |
|---|---|
| Anything in the app | Immediate |
| Acknowledgement of an emailed request | 3 days |
| Access, export or correction | 30 days |
| Deletion | 30 days |
| Complex requests | Extended once, by up to 60 days, and we tell you why |
9. If you are not happy
Email [email protected] and ask for it to be escalated. You can also complain directly to a regulator — SDAIA in Saudi Arabia, the ICO in the UK, your national supervisory authority in the EU, or the FTC and your State Attorney General in the US. In the UK and EU you may contact our representative for your region instead of us; see the Privacy Policy.
The full policy set
This policy is one of 13. The rest cover children’s privacy, consent, retention, security, AI and the terms you agree to.
For parents
Privacy Policy
Kibu is a family app used by parents and by children. This policy explains what we collect, why, who we share it with, how long we keep it, and how you control it. Because most of our users are children, we hold ourselves to children's privacy rules everywhere we operate — not only where the law compels it.
/privacy-policy
For parents
Children's Privacy Policy
This is the notice required by the United States Children's Online Privacy Protection Act (COPPA), and it also serves as our children's privacy statement for the United Kingdom, the European Union, Saudi Arabia and the US states with children's design codes. It sits alongside our main Privacy Policy and, where the two differ, this one governs anything to do with a child.
/childrens-privacy
For parents
Parental Consent Notices
Kibu asks for your consent separately for each thing we want to do with your child's information, so that agreeing to one never silently agrees to another. This page holds the full text of every consent we ask for. Each is the notice referenced by the corresponding checkbox in the app.
/parental-consent
For parents
Data Retention Policy
How long Kibu keeps each kind of information, why we need to keep it that long, and what happens when the time is up. COPPA requires us to publish this, and we treat it as a specification our systems must actually implement — not a statement of intent.
/data-retention
For parents
Terms of Service
The agreement between you and Kibu. It covers who may hold an account, what you are responsible for, subscriptions and refunds, and how either of us can end the agreement.
/terms
For parents
Cookies and Tracking
What the Kibu website stores on your device, and what the Kibu app stores on your phone. There is no advertising tracking anywhere in Kibu, and nothing at all is tracked on a child's device without a parent's verified consent.
/cookies
Parents and kids
Community Guidelines and Content Moderation Policy
What is allowed on Kibu, how we check, what happens when something breaks the rules, and how to report it. This is a safety document as much as a legal one — it exists because children can see what other children post.
/community-guidelines
For parents
Service Providers and Sub-processors
Every company that handles your family's data on our behalf, what each one receives, where it is processed, and what we require of them in writing. We publish this because you cannot judge whether your child's data is safe without knowing who holds it.
/subprocessors
For parents
How Kibu Uses AI
Kibu uses AI in four places. This page says exactly where, what is sent, who receives it, what we forbid them to do with it, and what your child can and cannot do with AI. Children never talk to an AI in Kibu.
/ai
For schools
Kibu and Schools — FERPA and Student Privacy
Kibu is a consumer family product. We contract with parents, not with schools, and we hold no education records. This page explains our position on FERPA and US state student-privacy laws, and states plainly what we will not do.
/schools
For parents
Security at Kibu
A public summary of how we protect your family's data. The full written programme is an internal document; this page tells you what it covers and how to reach us if you find a problem.
/security
Written for kids
Your Privacy, Explained
A version of our privacy policy written for the children who use Kibu. Required by the ICO Children's Code, which says information must be presented in a way children can actually understand — and by the EU's rules on protecting minors online.
/privacy-for-kids