Privacy Policy

Who we are

Tomorrow's Kids ("we", "us", "our") is an adventure-based learning platform for families with children ages 6–12. This policy explains what information we collect from parents and, in a limited way, from children whose parents have created an Explorer profile for them.

This page is maintained by Tomorrow's Kids to answer common privacy questions about our service. It is not a certification and is intended as a plain-language summary of our current practices.

Information we collect

• Parent account. Email, name, optional phone number, and password (stored hashed, never in clear text). If you sign in with Google, we receive your Google email and name from Google's OAuth service.
• Explorer profiles. The first name (or nickname) you choose for each child, an avatar, and mission progress (which stories, movies, challenges, and badges the child has opened or completed). We do not ask for a child's last name, email, phone number, home address, precise location, or photo.
• Payments. Card details are collected and processed by Stripe directly. We never see or store full card numbers. We receive a subscription status, last-4 digits, and billing metadata.
• Technical data. IP address, browser type, device type, and basic usage logs, used for security, abuse prevention, and to keep the service running.

How we use information

• Provide the service: unlock content, track progress, personalize badges and certificates.
• Process payments and manage subscriptions.
• Send you transactional emails (verification, password reset, billing, support replies).
• Secure the service, prevent fraud, and comply with legal obligations.

We do not sell personal information. We do not use children's information to target advertising. We do not use children's activity to build advertising profiles.

Legal bases (EEA/UK)

Where GDPR applies, we rely on: (a) performance of a contract to provide the service you subscribed to; (b) our legitimate interests in operating, securing, and improving the service; (c) your consent, where required (for example, optional communications); and (d) compliance with legal obligations.

Who we share information with

Only service providers we need to run the platform, under contract:

• Stripe — payment processing.
• Supabase / Lovable Cloud — database, authentication, storage.
• Email delivery provider — verification and transactional email.
• Google — only if you choose Google sign-in.

We may also disclose information if required by law, to protect rights and safety, or as part of a business transfer (with notice).

Data retention

We keep your account data while your account is active. You can delete individual Explorer profiles from your Passport at any time; that removes the child's profile and progress. On request we will delete your parent account and all associated Explorer data within 30 days, except records we are legally required to keep (e.g. tax and payment records).

Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict use of your personal information, and to object to certain processing. To exercise any of these rights, email us at privacy@tomorrowskids-tkd.ai.

Children's privacy

Parents create and control every Explorer profile. See our Child Safety & COPPA notice for details on how we handle information about children under 13.

International transfers

Our service providers may process data in countries outside your own, including the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses).

Security

Passwords are hashed. Data in transit is protected with TLS. Payments are handled by Stripe under their PCI-DSS certification. No online service is 100% secure — please use a strong, unique password.

Changes

We may update this policy from time to time. Material changes will be announced by email or in-app before they take effect.

Contact

Questions? Email privacy@tomorrowskids-tkd.ai.