Privacy Policy

Who is responsible

STEMbie Kids ("we", "us") provides the STEMbie Kids app for iOS and Android, the parent console at dashboard.stembie.com, and this website at stembie.com (together, "STEMbie Kids"). Where data protection laws such as the EU or UK General Data Protection Regulation apply, we are the controller of the personal information described in this policy. Our contact details are at the end of this policy.

How STEMbie Kids is set up

A parent or guardian creates a family account in the parent console and adds each child. The parent then generates a six-digit family code, valid for 30 minutes, and enters it on the child's phone. That phone is then tied to one child. Children do not have their own login, email address, or password; they open the app on their paired phone and may unlock it with a PIN the parent sets.

Everything that changes a family's setup, including purchases and unpairing a phone, sits behind a grown-ups check in the app or inside the parent console.

Information about parents and guardians

• Account details: your email address, a password (stored only as a secure hash by our authentication provider), and the name you choose to show.
• Family details: the family name, your time zone (used to reset daily learning allowances at your local midnight), and pairing codes.
• Subscription status: whether your family has a Family Pass, which plan, the store it was bought through, and when it renews or ends. We never receive your card or payment details; Apple or Google handle payment.
• Your actions in the parent console, such as lessons you assign, experiment reviews and feedback you write, and coins you award.

Information about children

When a parent adds a child and the child uses the app, we keep:

• Profile: the first name or nickname the parent enters, the child's age (5 to 16) and age group, an avatar colour, the daily learning allowance, reminder time, and whether learning is paused.
• PIN: if the parent sets one, the PIN is stored as a one-way hash for checking, plus an encrypted copy so the parent can view it again in the parent console. Repeated wrong attempts lock the profile for 15 minutes.
• Learning activity: lessons completed, quiz scores, assigned lessons, the minutes spent learning each day, the last day the app was used, coins earned and spent, and learning streaks.
• Science tutor questions: the questions a child types to the science tutor (up to 300 characters), the answers given, the lesson they relate to, and the child's name so parents can see who asked. These appear in the parent's curiosity journal.
• Experiment submissions: a photo of a finished experiment and any note the child writes, together with the parent's review.

We do not collect a child's surname, email address, phone number, birth date, address, location, contacts, voice, or advertising identifiers, and children cannot message other people or share anything publicly in STEMbie Kids.

Experiment photos

Sending a photo is always optional. When a child takes or chooses a photo, the app shrinks it and re-saves it on the phone, which removes hidden details such as GPS location, camera model, and the time it was taken, before it is uploaded. Photos are stored in private storage that cannot be reached by a public link.

Photos are shown to the parents in the child's family through short-lived links that expire after an hour. A small number of our support staff can view a photo only to review it for safety, for example if it is reported or appears to include something it should not, and they can remove it. We never use photos for advertising, publish them, or share them with other families.

Please help your child photograph the experiment rather than people. Photos are deleted automatically 90 days after a parent reviews them, or 90 days after they were sent if nobody reviews them. They are deleted sooner if the child's profile or the family account is deleted, or if a parent or our staff remove them. The child's note and the parent's review stay with their progress.

How we use information

• To run the service: pairing phones, showing the right lessons for each child's age, saving progress, enforcing the daily learning allowance, and keeping coins and streaks.
• To keep parents informed: showing progress, experiment submissions, and tutor questions in the parent console.
• To answer tutor questions and keep answers age-appropriate.
• To manage your Family Pass and unlock paid lessons.
• To keep STEMbie Kids safe and secure: preventing abuse of pairing codes, locking a profile after too many wrong PINs, moderating photos and tutor answers, and investigating problems.
• To send account emails you ask for, such as confirming your email address or resetting your password.

We do not use children's information for advertising, behavioural profiling, or marketing, we do not sell it, and we do not make automated decisions that have legal or similarly significant effects on anyone.

Where the GDPR or UK GDPR applies, we rely on performance of our contract with the parent to provide the service, on the parent's consent for children's information, and on our legitimate interest in keeping the service secure.

Service providers we use

We share information only with providers that help us run STEMbie Kids, under agreements that limit what they may do with it. We do not sell or rent personal information to anyone.

• Supabase hosts our database, file storage, sign-in, and server functions. All the information described above is stored with Supabase.
• Google (Gemini API) generates science tutor answers. We send the question, the lesson it relates to, and the child's age group, but not the child's name or any other identifier.
• RevenueCat and the Apple App Store or Google Play process Family Pass purchases. RevenueCat receives an anonymous family identifier and purchase records, not your name or email address.
• Cloudflare hosts this website and the parent console and protects them from abuse. It may process connection data such as IP addresses in its logs.
• Shorebird delivers small updates to the app's own code. Update checks send the app version and device platform, not personal information.

We may also disclose information if the law requires it, to protect a child or anyone else from harm, or as part of a merger or sale of the service, in which case this policy will continue to protect the information.

• Supabase privacy policy
• Google privacy policy
• RevenueCat privacy policy
• Cloudflare privacy policy
• Shorebird privacy policy

Permissions and information on the phone

• Camera and photos: used only when a child chooses to photograph a finished experiment. Only the selected photo is read.
• Notifications: daily learning reminders are scheduled on the phone itself. There is no push notification server, and no notification token or child information is sent anywhere.
• Restart on Android: lets reminders be scheduled again after the phone restarts.
• Internet: used to load lessons and save progress.

The app keeps on the phone the pairing details, a session that lets the child stay signed in for up to 12 hours, recent tutor questions and answers, reminder settings, and subscription status. Unpairing the phone or deleting the app removes them.

Children's privacy and parental consent

STEMbie Kids is directed at children, so we follow children's privacy laws such as the US Children's Online Privacy Protection Act (COPPA), the UK Age Appropriate Design Code, and the GDPR's rules for children. Only a parent or legal guardian may create a family account and add a child. By doing so, and by pairing a child's phone, the parent consents to the collection and use of the child's information described in this policy.

Parents can review their child's activity, tutor questions, and photos in the parent console at any time, change or pause a child's settings, and ask us to delete a child's information or to stop collecting it. If we learn that a child's information was collected without a parent's consent, we will delete it.

Cookies and this website

This website sets no cookies, runs no analytics, and loads no third-party fonts or scripts. The parent console stores your sign-in session and display preferences, such as text size, in your browser so you stay signed in; these are strictly necessary and are not used for tracking.

How long information is kept

We keep a family's information for as long as the family account is open, except experiment photos, which are deleted automatically 90 days after review (or 90 days after they were sent if not reviewed). When a parent deletes a child, that child's profile, progress, tutor questions, and photos are deleted. When a family account is deleted, all of the family's profiles, photos, paired phones, and sign-in accounts are deleted.

We keep a small amount of information for longer where we need it for security or accountability: records of pairing attempts, which identify a phone only by a one-way fingerprint of its network address, and a log of actions taken by our staff. Deleting your account does not cancel a store subscription; cancel it in your Apple ID or Google Play settings.

Security

Every connection uses HTTPS. Our database is locked so that apps and browsers cannot read it directly; every request passes through our server, which checks who is asking and which family they belong to. PINs are hashed, photos are kept in private storage, and pairing codes expire after 30 minutes and are rate-limited. No system is perfectly secure, so please use a strong password and tell us straight away if you think your account has been misused.

International transfers

Our service providers operate globally, so information may be stored or processed in the United States or other countries different from where you live. Where the law requires it, we rely on safeguards such as standard contractual clauses to protect it.

Your rights

Wherever you live, you can ask us to tell you what information we hold about you or your child, to give you a copy, to correct it, to delete it, or to stop using it, and you can withdraw consent at any time. We respond free of charge within the time your law requires and will never treat you differently for using these rights. To protect your family, we will confirm the request comes from the account holder before acting on it.

European Economic Area, United Kingdom, and Switzerland

You have the rights of access, rectification, erasure, restriction, portability, and objection under the GDPR, the UK GDPR, and the Swiss Federal Act on Data Protection, and you may complain to your data protection authority, such as the Information Commissioner's Office in the UK.

United States

Under COPPA, parents can review their child's information, ask us to delete it, and refuse further collection. Under the California Consumer Privacy Act and similar state laws, you have the rights to know, access, correct, delete, and port personal information. We do not sell personal information or share it for cross-context behavioural advertising.

Nigeria, South Africa, Kenya, Ghana, and the rest of Africa

Under the Nigeria Data Protection Act 2023, South Africa's Protection of Personal Information Act, Kenya's Data Protection Act 2019, Ghana's Data Protection Act 2012, and comparable laws, you have equivalent rights and may complain to your national data protection authority.

Everywhere else

Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act, India's Digital Personal Data Protection Act, and other laws give you comparable rights. If your law gives you a right not listed here, contact us and we will honour it.

Changes to this policy

When this policy changes, we publish the new version here with a new date. If a change affects how we use children's information in a significant way, we will tell parents by email or in the parent console and, where the law requires, ask for consent again before the change applies.

Contact

Questions, requests, and complaints about privacy can be sent to us at any time. We aim to reply within 30 days.