Privacy Policy
Simple, honest and parent-friendly. We tell you exactly what we collect, what we don't, and how we keep your child safe.
Last updated: 27 May 2026 · Effective: 27 May 2026
The 5-Second Version
- 💾Progress stored on your device only — not on our servers
- 🚫We never sell or trade personal data
- 🧒Children under 18 (India) need parental consent
- 🤖AI only discusses educational topics — strictly moderated
- 📢No stranger chat, no social features, no behavioural ads to children
1. Who We Are
Kidora (“we”, “us”, “our”) is an AI-powered educational platform for children. Our primary market is India (Phase 1) with a global expansion planned.
This Privacy Policy applies to all users of kidora.world and any related mobile or app experiences. It is written in compliance with:
- Digital Personal Data Protection Act, 2023 (DPDP Act) — India's primary data protection law.
- Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
- Children's Online Privacy Protection Act (COPPA, USA) — for users accessing from the United States.
2. What Data We Collect
We designed Kidora to be data-minimal by default. Here is a full list of everything we do and do not collect:
Explorer nickname
Chosen or generated fantasy name — never your real name. Stored locally on your device.
Learning progress
XP, level, streak, achievements, game history — stored in browser localStorage only.
AI conversation turns
Text sent to AI Tutor is forwarded to OpenAI's API to generate a reply, then discarded. We do not log or store conversation history on our servers.
Google sign-in (optional)
If you choose Google Sign-In, Firebase stores your display name, email address, and a unique user ID to sync progress across devices.
Anonymous analytics
Aggregate page-view counts via Vercel analytics — no personal identifiers, no IP addresses retained.
Real name, phone, address
We never ask for or collect these.
Payment information
Kidora has no paid features — no payment data is ever collected.
Biometric or health data
Never collected.
3. How We Use Your Data
- 🎮To deliver the service: Progress data saved locally allows the platform to show your level, XP, and achievements across sessions.
- 🤖To power AI features: Questions typed into the AI Tutor are sent to OpenAI's API to generate educational responses. This data is processed under OpenAI's privacy policy and not stored by us.
- 📊To improve the platform: Anonymised aggregate analytics (page visits, feature usage) help us understand what to build next. No personal identifiers are included.
- ⚖️Legal compliance: We may process minimal data to comply with court orders, government requests, or applicable Indian law.
We never use personal data for profiling, targeted advertising, or automated decision-making that significantly affects users.
4. Children's Privacy
DPDP Act 2023 — Section 9 | IT Rules 2011 | COPPA
🇮🇳 India — Under 18 Years
Under the DPDP Act 2023, Section 9, a “child” in India means any person under 18 years of age. Processing personal data of children requires verifiable parental or guardian consent.
🌍 USA — Under 13 Years (COPPA)
For users accessing from the United States, COPPA requires verifiable parental consent for children under 13. We comply with both standards — the stricter Indian threshold applies for all India-region users.
How we obtain parental consent:
- During onboarding, a parent or guardian is prompted to review and accept these terms on behalf of their child.
- Children are never asked for real names, phone numbers, addresses, or school names.
- The explorer name used in-app is a fictional nickname (parent-chosen or auto-generated).
What we do NOT do with children's data:
- No behavioural advertising or interest-based tracking
- No third-party sharing for commercial purposes
- No profiling of children based on activity
- No nudging children to spend money or share more data
Parents / guardians may contact us at privacy@kidora.world to review, correct, or request deletion of their child's data at any time.
5. Data Storage and Security
Local-first storage: Learning progress (XP, levels, streaks, achievements) is stored exclusively in your browser's localStorage — a sandboxed storage area on your device that no third party can access. We have no copy of this data.
Optional cloud sync: If you sign in with Google, Firebase Authentication stores a minimal profile. This data is hosted on Google Cloud infrastructure and governed by Google's security standards.
HTTPS everywhere: All data in transit is encrypted using TLS 1.3.
AI API calls: Questions sent to OpenAI are transmitted over TLS. We do not log these transmissions. OpenAI's data retention policies apply to data sent through their API.
Security practices: We follow the IS/ISO/IEC 27001 framework for information security and the reasonable security practices prescribed under Rule 8 of the IT (SPDI) Rules, 2011.
Data breach notification: In the unlikely event of a data breach that is likely to harm your interests, we will notify affected users and the Data Protection Board of India (when operational) as required under the DPDP Act 2023.
6. Cookies and Advertising
Kidora uses the following types of cookies:
| Cookie type | Purpose | Can opt out? |
|---|---|---|
| Essential | Platform functionality, CSRF protection | No (required) |
| Analytics (Vercel) | Anonymous page-view counts | Yes |
| Google AdSense | Ad serving (non-personalised for under-13) | Yes — via Google |
Children and ads: Users who indicate they are under 13 (US) or whose accounts are flagged as child users (India) receive non-personalised, child-directed ads only. No interest-based or behavioural targeting is applied to children.
Opt out of personalised Google ads at adssettings.google.com.
7. Third-Party Services and Data Sharing
We share the minimum necessary data with these service providers only:
| Service | Purpose | Data shared | Policy |
|---|---|---|---|
| OpenAI | Powers AI Tutor and game questions | User-typed question text only (no name/email) | View → |
| Google Firebase | Optional user authentication | Display name, email, UID (only if signed in) | View → |
| Google AdSense | Advertising to support the free platform | Cookies / device identifiers (non-personalised for under-13) | View → |
| Vercel | Hosting, CDN, anonymous analytics | Aggregate traffic data only | View → |
We do not sell, rent, trade, or share personal data with advertisers, data brokers, or any party not listed above.
8. Data Retention
- 💾Local progress data: Retained on your device until you clear browser storage or uninstall the app.
- ☁️Google Sign-In data: Retained until you delete your account via the profile page or request deletion from us.
- 🤖AI conversation data: Not stored on our servers. OpenAI retains API inputs per their data retention policy.
- 📊Analytics data: Anonymised aggregate data retained for up to 12 months for product improvement.
9. Your Rights as a Data Principal (DPDP Act 2023)
Under India's Digital Personal Data Protection Act 2023, you have the following rights. To exercise any right, email privacy@kidora.world. We will respond within 30 days.
Right to Information
Section 11, DPDP Act 2023Know what personal data we hold about you and how it is processed.
Right to Correction
Section 12, DPDP Act 2023Request correction or updating of inaccurate personal data.
Right to Erasure
Section 12, DPDP Act 2023Request deletion of personal data where it is no longer necessary for the purpose it was collected.
Right to Grievance Redressal
Section 13, DPDP Act 2023Lodge a grievance with our Grievance Officer and receive a response within 30 days.
Right to Nominate
Section 14, DPDP Act 2023Nominate another individual to exercise your data rights in the event of death or incapacity.
Right to Withdraw Consent
Section 6, DPDP Act 2023Withdraw consent for optional data processing (e.g. Google Sign-In) at any time without affecting prior lawful processing.
COPPA Rights (under-13, USA)
COPPA 1998Parents may review, delete or refuse further collection of their child's personal information.
10. Grievance Officer
Mandatory under IT Rules 2011 & DPDP Act 2023
As required by Rule 5(9) of the IT (SPDI) Rules, 2011 and Section 13 of the DPDP Act 2023, Kidora has designated a Grievance Officer to address complaints regarding the processing of personal data. If you have a grievance, the Grievance Officer will acknowledge it within 48 hours and resolve it within 30 days of receipt.
Name: Grievance Officer, Kidora
Designation: Data Protection Officer / Grievance Officer
Email:grievance@kidora.world
Response time: Acknowledgement within 48 hours · Resolution within 30 days
Jurisdiction: India — subject to courts at [City], India
If you are not satisfied with our resolution, you may escalate your complaint to the Data Protection Board of India once it is constituted under the DPDP Act 2023.
11. International Users
Kidora is a globally accessible platform with Phase 1 operations in India. If you access the platform from outside India, your data may be transferred to and processed in India, where our primary servers and data processors are located.
EU / EEA users: By using Kidora, you consent to this transfer. We maintain appropriate safeguards consistent with applicable data protection law.
US users: COPPA applies to children under 13. Parental consent is collected during onboarding for identified under-13 users.
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the “Last Updated” date at the top of this page
- Display a notice on the platform for 30 days following a significant change
- Obtain fresh consent from users where required by law
Continued use of Kidora after changes become effective constitutes acceptance of the revised policy.
Questions or Concerns?
For privacy questions email us at privacy@kidora.world. For formal grievances, write to grievance@kidora.world. We aim to respond within 2 business days.
This Privacy Policy was last reviewed on 27 May 2026. Kidora is committed to complying with the Digital Personal Data Protection Act, 2023 and all applicable Indian and international data protection laws. For the avoidance of doubt, in case of conflict between this policy and applicable law, the applicable law shall prevail.