Privacy Policy — Cerebryx Jr

What Information We Collect

Your child cannot use Cerebryx Jr without parental consent. You (the parent or guardian) must provide your email address to create the account. We collect the minimum information necessary to deliver our learning service.

Information Parents Provide

• Parent/Guardian Email Address: Used to create the account, verify identity, send notifications, and manage the child's account. This is required.
• Child's First Name: Used to personalize the learning experience (greeting, progress reports). Optional but recommended.
• Grade Level (or Age Range): Used to tailor difficulty and content appropriateness. Optional.
• Subject Preferences: Which learning tracks (Math, Science, Coding, etc.) the child is enrolled in. Optional.

Information Collected Automatically During Learning

• Learning Progress Data:
  • Concepts mastered (mastery scores)
  • Questions answered (correct or incorrect)
  • Time spent on each question or concept
  • Session history (when the child used the app, how long)
• Spaced Repetition Data:
  • Which concepts need review
  • When the next review is scheduled
  • Learning intervals and study pace
• Gamification Data:
  • XP earned
  • Daily learning streaks
  • Badges unlocked
  • Progress on daily quests
• Diagnostic Assessment Data:
  • Results from the initial skill diagnostic test (when first using the app)
  • Responses to diagnostic questions (to map knowledge gaps)
  • Accuracy scores by concept
• AI Tutor Usage:
  • How many times the child requested AI help
  • Which concepts were discussed with the AI tutor
  • Tokens used (technical metric for API usage)
  • NOT STORED: The actual AI tutor conversation transcripts are NOT permanently retained in your account

Device & App Usage Data

• Device Type: Whether your child uses iPhone, iPad, or Android device
• App Version: Which version of Cerebryx Jr is installed
• Crash Reports: If the app crashes, we collect technical error data to fix bugs
• Aggregated Analytics: We use Firebase Analytics to track general usage patterns (e.g., "80% of users complete their daily goal"), but NOT user-level tracking

Parental Consent & Account Creation

How We Get Your Consent

Before your child can use Cerebryx Jr, you must:

1. Create an account with your email address
2. Read and accept this privacy policy
3. Accept the Terms of Service
4. Provide consent for data collection and processing

You will NOT be able to create a child account without explicitly providing verifiable parental consent. We use your email address to verify you are a parent or guardian.

Parental Control Options

Once you create an account, you have full control:

• You can log in anytime to view your child's learning progress
• You can delete or suspend your child's account
• You can request that we stop collecting further data
• You can download or delete all data associated with your child's account

How We Use Your Child's Information

Information Type	How We Use It	Legal Basis
Learning & Progress Data (mastery scores, attempts, session history)	• Personalize the learning experience • Calculate spaced repetition intervals • Recommend next concepts to study • Generate progress reports for parents	Service performance & parental consent
Diagnostic Results (initial skill assessment)	• Map knowledge gaps • Tailor initial curriculum • Identify concepts needing review	Service performance & parental consent
Gamification Data (XP, streaks, badges)	• Display motivational feedback • Maintain daily streaks • Unlock achievements	Service performance & parental consent
AI Tutor Usage (concept discussed, tokens used)	• Enforce daily AI limits (free tier) • Track API costs • Improve tutor accuracy for the child	Service performance & fraud prevention
Device & Crash Data	• Fix bugs and crashes • Monitor app performance • Improve stability	Service performance & legitimate interest
Parent Email Address	• Send progress updates (optional, can opt out) • Send security alerts (e.g., login from new device) • Send account notifications	Service performance & parental consent

Aggregated Data

We may use aggregated, de-identified data to improve the app. For example: "Students who review Math daily improve 23% faster" or "Concept X is frequently skipped." This data cannot identify your child.

What We Do NOT Collect

The following information is explicitly NOT collected from your child, even for parental transparency:

• Personal Identifiers (beyond first name): No last name, full name, birth date, Social Security number, student ID, or passport number
• Location Data: No GPS, precise location, WiFi data, or IP address logging (for location purposes)
• Biometric Data: No fingerprints, facial recognition, or voice data
• Photos or Videos: No camera access, photos, or video from device
• Contacts or Relationships: No access to address book, friends list, or social connections
• Communications: No chat, email, SMS, or other messaging data
• Financial Information: No credit card, bank account, or payment method data (parents handle all billing)
• Advertising Identifiers: No IDFA (Apple) or GAID (Google) collection for behavioral advertising
• Microphone or Audio: No audio recordings or voice processing
• Precise Device Information: No IMEI, MAC address, or device serial numbers for tracking
• Behavioral Profiling: No detailed personality assessment, psychological profiling, or interest categorization for ad targeting

Third-party services we use

Third-Party Services & Data Sharing

Services We Use

Cerebryx Jr uses the following third-party services. No service receives your child's personal information beyond what's necessary to operate the app.

Supabase (Database & Authentication)

• What it does: Stores all learning data, handles account login, manages real-time data sync
• Data shared: Parent email, child first name (if provided), all learning progress data
• Location: EU-based (GDPR compliant), with option to choose region
• Privacy: Supabase Privacy Policy

Anthropic Claude (AI Tutor)

• What it does: Provides AI-powered hints, explanations, and tutoring when your child requests help
• Data shared: Only the current question/concept and the child's mastery level. No conversation history or personal data.
• Data retention: Anthropic processes requests in real-time but does NOT train on or retain child data. See "AI Tutor Privacy" section below.
• Privacy: Anthropic Privacy Policy

Firebase (Analytics & Crash Reporting)

• What it does: Collects anonymous app usage metrics and crash reports
• Data shared: Device type, app version, aggregated usage patterns. NO personal or learning data.
• Privacy: Firebase is configured to NOT track individual users. Analytics are aggregated only.
• Link: Firebase Privacy Policy

RevenueCat (Subscription Management — Mobile)

• What it does: Manages Scholar/Champion subscription billing inside the mobile app
• Data shared: Parent email, subscription status. No child data or learning information.
• Privacy: RevenueCat Privacy Policy

Razorpay (Web Payments — India)

• What it does: Processes subscription payments made on cerebryx.ai (UPI, cards, netbanking)
• Data shared: Parent's name, email, and payment instrument details. Cerebryx never stores full card numbers or UPI credentials. No child data is shared.
• Privacy: Razorpay Privacy Policy

App Stores (Apple & Google)

• What it does: Distribution and in-app purchase processing
• Data shared: Apple and Google receive your account email and subscription information. No child data.
• Privacy: Apple Privacy | Google Privacy

What We Do NOT Share

• We do NOT sell your child's data to advertisers, data brokers, or marketers
• We do NOT share data with social media platforms
• We do NOT share data with behavioral advertising networks
• We do NOT use data brokers or third-party analytics beyond Firebase (aggregated)
• Third parties are contractually prohibited from using your child's data for their own purposes

COPPA Compliance on Third Parties

All third-party services we use are COPPA-compliant and contractually bound to protect children's privacy. We do not use services that track, profile, or advertise to children.

Your Rights as a Parent

Right to Access

You can view all data we've collected about your child.

• Log in to the Cerebryx Jr app with your email account
• View your child's progress, mastery scores, attempts, and gamification data
• Export all learning data as a file (PDF or CSV)

Right to Deletion

You can request that we delete all data associated with your child's account.

• Request account deletion through the app settings, OR
• Email us at help@cerebryx.ai with your request
• We will delete all data within 30 days (except aggregated data, which is de-identified)
• Deletion is permanent and cannot be undone

Right to Refuse Further Collection

You can withdraw consent and stop us from collecting new data.

• Suspend your child's account (they can log in but no new data is recorded)
• We will not collect new learning data, but previously collected data remains in your account unless you request deletion

Right to Correct

You can update your child's information.

• Edit child's first name, grade level, or subject preferences in account settings
• Email us to request corrections to data we've recorded

Right to Non-Discrimination

We will not discriminate against you for exercising these rights. Your child's access to Cerebryx Jr will not be reduced or service quality lowered if you request data deletion or refuse further collection.

How to Exercise Your Rights

To exercise any of these rights, contact us at:

How We Protect Your Child's Data

Technical Security

• Encryption in Transit: All data sent between the app and our servers is encrypted with TLS/SSL (HTTPS)
• Encryption at Rest: Learning data is encrypted in our database
• Secure Authentication: Passwords are hashed using industry-standard algorithms. We never store plain-text passwords.
• API Key Security: Claude API keys are stored securely on our servers, never on the device or in code
• Rate Limiting: We limit API requests to prevent abuse and protect against attacks

Organizational Security

• Limited Access: Only the development team can access databases. Access is logged.
• No Vendor Shortcuts: We do not share API keys or credentials with third-party vendors
• Regular Backups: Data is backed up daily and tested for recovery
• Security Monitoring: We monitor for suspicious activity and unauthorized access

What We Cannot Guarantee

No system is 100% secure. While we take reasonable precautions, we cannot guarantee absolute protection against:

• Sophisticated hacking attacks
• Breaches caused by stolen parent credentials
• Physical theft of parent's device
• Natural disasters or force majeure events

If we discover a security breach that exposes your child's personal information, we will notify you by email within 30 days.

Data Retention & Deletion

How Long We Keep Data

Data Type	Retention Period	Reason
Learning Progress Data (mastery, attempts, sessions)	While account is active + 90 days after deletion	Needed to deliver the service and maintain spaced repetition accuracy
Gamification Data (XP, streaks, badges)	While account is active + 90 days after deletion	Displays in app for motivation
AI Tutor Conversations (transcripts, context)	30 days (deleted automatically)	Temporary working memory only. Not used for training or long-term analytics.
Crash & Error Logs	90 days	Needed to identify and fix bugs
Firebase Analytics (aggregated, de-identified)	14 months	Aggregated only, no personal identifiers
Parent Email Address	While account is active (until deleted)	Needed for account access and notifications
Backup/Archive Data	Up to 180 days after deletion	Disaster recovery. Then permanently deleted.

Automatic Deletion

Inactive accounts: If an account shows no activity for 1 year, we may delete it automatically after sending a warning email to the parent.

Parent-Requested Deletion

When you request account deletion:

1. All learning data is marked for deletion immediately
2. Data is permanently deleted within 30 days
3. Backup copies are deleted within 180 days
4. We keep aggregated/de-identified analytics only (e.g., "one user completed X concept")
5. We send a confirmation email when deletion is complete

AI Tutor Privacy — Special Details

The AI tutor (powered by Anthropic Claude) is a core feature of Cerebryx Jr. Here's exactly how it handles your child's privacy.

How the AI Tutor Works

• When your child asks for help on a question, the app sends:
  • The current question or concept
  • Your child's mastery level in that topic
  • A system prompt that tells Claude to be a patient tutor for kids
• Claude returns a hint, explanation, or guided question (no direct answers)
• The response is displayed to your child immediately

What Data is NOT Stored

Crucially, AI tutor conversations are NOT stored in your child's account.

• We do NOT save the full conversation history
• We do NOT save hints or explanations Claude provided
• We do NOT log every back-and-forth between child and tutor
• Claude responses exist only in the app session and are deleted when the app closes

What We DO Track (Minimally)

• Usage Counter: "Child used AI help 5 times today"
• Concept: "AI help was requested for Algebra"
• Tokens Used: For billing purposes (to track API costs)

This is purely operational — it does NOT create a record of what the child asked or what Claude said.

Data Sharing with Anthropic

• Real-time Processing: When your child requests help, the question and context are sent to Anthropic's API in real-time
• NOT for Training: Anthropic does NOT use inputs from Cerebryx Jr to train Claude models. Per Anthropic's commitment, educational content involving children is never used for model improvement.
• Retention: Anthropic retains conversation data for up to 90 days for safety/abuse monitoring, then deletes it
• Aggregated Insights: Anthropic may analyze aggregated patterns (e.g., "common misconceptions in algebra") but NOT at the student level

Daily AI Limits (Free Tier)

• Free accounts: 3 AI help requests per day
• Pro accounts: Unlimited AI help
• Limits reset daily at midnight (child's timezone)

Questions or Concerns?

We want you to feel confident about your child's privacy on Cerebryx Jr. If you have any questions about this policy, your child's data, or privacy practices, please reach out.

Regulatory Contacts

If you believe Cerebryx Jr is violating COPPA or privacy laws, you can file a complaint with:

• US Federal Trade Commission (FTC): reportcomplaint.ftc.gov (COPPA violations)
• Your State's Attorney General: Consumer protection division
• Google Play Family Safety: Report directly through Google Play
• Apple Privacy: Through App Store feedback