KY App Privacy Policy

Last Updated: September 3, 2026

Know Yourself, Inc. ("we," "us," or "our") operates the KY App. This Privacy Policy describes the limited information the App collects, how it is used, and the choices you have. We designed this App to work without accounts, names, or contact information so kids can learn privately.

Children's Privacy (COPPA)

The KY App is designed for children and teens (ages 8 and up). We are committed to complying with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information that would identify an individual child. The App does not require an account, and we do not ask kids for their name, email, phone number, photo, or precise location.

If you are a parent or guardian and have any concerns, please email us at the address below.

Information We Collect

When you use the App, our servers record the following:

• Anonymous session identifier. The first time the App opens, it generates a random UUID. That UUID is how we recognize that the same device is coming back. The UUID is not associated with your name, email, or any account.
• Recovery phrase. If you choose to back up your progress, the App generates a random recovery phrase (four ordinary words joined by hyphens). You can enter that phrase on a new device to restore your lessons-completed state. The recovery feature is optional, and the phrase is not tied to your name or to any account.
• Onboarding selections. You pick an age range ("8–10," "11–13," "14–17," or an adult option) and a language (English or Spanish) when you first open the App. We store these to show age-appropriate content.
• Chat messages. When you ask a question in the "Talk to Dr. B" feature, we store your message and the AI's response so the conversation has memory within a session. Messages are tied only to your anonymous session ID.
• App usage events. We log which lessons you view, which quizzes you complete, how often you open the App, and what tab you use. This helps us know which lessons are working and which ones to improve.
• Crisis-resource events. If the App shows the safety overlay (because you typed about self-harm, abuse, or other distress), we log that the overlay was shown and whether you tapped a resource. We do this so we can confirm the safety feature is working. We do not log the wording of the message that triggered it.
• Approximate location. Our servers record the IP address your device used to connect, look up the city/region/country (rounded to two decimal places of latitude/longitude — accurate to roughly 1 km), and store that approximation. We do not collect GPS or precise location.
• Subscription records. If you buy a subscription, Apple or Google processes the payment — we never receive your card number, billing address, or store account details. Our server checks with Apple or Google that the purchase is genuine and stores the result against your anonymous session ID: which plan was bought, when it expires, whether it renews automatically, whether it reached you through Family Sharing, and the store's transaction identifier for that purchase. We use this only to unlock paid lessons on your device and to restore them if you reinstall the App.
• Technical request logs. Our backend records normal web-request information (URL path, response time, HTTP status code) for the purpose of keeping the service running.

We do not collect: your real name, email, phone number, address, photos, contacts, calendar, microphone audio, camera video, precise location, or device advertising identifiers (IDFA / AAID).

How We Use Information

We use the limited data above to:

• Provide the App's core features (saving progress, recalling chat history, showing age-appropriate content).
• Show you crisis resources if our safety system detects distress.
• Understand which lessons and topics are most useful so we can improve the App.
• Diagnose technical issues and prevent abuse of the service.

We do not use this data to advertise to you, build profiles for marketing, or sell anything.

Sharing With Third Parties

We share data only with the small number of service providers that make the App work:

• Anthropic — When you send a message to "Dr. B," we send the text of your message to Anthropic's Claude API to generate the response. Anthropic's privacy policy is at anthropic.com/legal/privacy. We do not send Anthropic your session ID, age, location, or any other identifier — only the message text and the conversation context for that session.
• Railway — Our backend servers and database are hosted by Railway (railway.com). Their infrastructure stores the data described above.
• Apple (iOS) and Google (Android) — The App Store and Google Play handle downloads, updates, and all subscription payments. When you subscribe, we send the store's purchase receipt or token back to Apple or Google so they can confirm it is genuine; we do not send them your session ID, age, location, or chat content. We do not control what those platforms log about installs and purchases.

We do not share data with advertisers, data brokers, or analytics companies. The KY App contains no advertising SDKs, no Firebase, no Mixpanel, no Segment, no Crashlytics.

AI-Powered Chat

The KY App includes an AI-powered chat feature ("Ask Dr. B") that uses Anthropic's Claude API. When a child sends a message:

• The message is transmitted to our server over an encrypted connection.
• Our server forwards the message to the Anthropic API for processing.
• The AI is instructed to provide only age-appropriate health education content.
• Crisis detection runs on every message before AI processing, and on every AI response, so distress signals can trigger the safety overlay.
• The AI does not ask for, store, or use personal information.

Data Retention

We retain anonymous session data, chat history, and analytics events for as long as the App is in operation, unless you ask us to delete them. We may delete inactive session records on a periodic schedule.

Backups of our database are kept for up to 30 days for disaster recovery, after which they are overwritten.

Security

All data transmission between the App and our servers uses HTTPS encryption. Admin access is password-protected. We minimize what we collect to begin with, on the principle that the safest data is the data we don't have.

Your Choices and Parental Rights

Because the App stores progress and chat history tied to an anonymous device session, parents who want to delete that data can email us with the recovery phrase (if any) or session ID, and we will delete the records.

You can also stop using the App at any time. Uninstalling deletes the local copy of the session ID. Server records associated with that session ID will remain until they are deleted on a retention schedule or upon request.

Changes to This Policy

If we make material changes to this Privacy Policy, we will update the "Last Updated" date and, where appropriate, post a notice in the App.

Contact Us

If you have questions, concerns, or want to request deletion of your data:

Know Yourself, Inc.
1470 East Valley Road, PO Box 5275
Santa Barbara, California 93150
Email: kyapp@knowyourself.com
Website: knowyourself.com