Effective date: 30 October 2026 · Version: 13

What's new in this version: clearer detail on what Unsplash, Google and recipe websites see, and how long our internal job logs are kept. The update before this one (version 12) gave a plainer description of Family Circles and subscriptions, and explained how sign-in records are kept.

Who we are

Kindom brings families closer through small, everyday moments: games around the kitchen table or across town, chores and rewards that feel like teamwork, meals planned together, and quick check-ins that say I see you. If you choose, it can include another family you're close to, through Family Circles. Good money habits are part of it, not the whole of it. This policy explains what we collect, why, who ever sees it, how long we keep it, and the rights you and your children have.

Kindom is operated by Ananta Bound LLC, a Texas limited liability company, which is the data controller for the information described here.

• Email: privacy@anantabound.com (the fastest way to reach us)
• Mail: Ananta Bound LLC, 5900 Balcones Drive, Ste 100, Austin, TX 78731, USA
• Phone (voicemail — we reply by email): (512) 710-5764

Our promises

You're in charge of your family's information. The Trust Center in the app ("Your Family's Data") shows everything we hold about your family, sorted by type, with live counts. From there you can download a copy, delete one kind of information (all your messages, say, or the family's games) in a couple of taps, remove a child, or delete your account yourself. No email, no form, no waiting on us.

What we never do:

• Sell, rent or trade anyone's information.
• Show ads, to children or anyone. There are no ads in Kindom.
• Track you across other apps or websites, or use advertising IDs.
• Put third-party analytics, advertising or data-broker tools in the app.
• Send a child's photo to an AI or image-analysis service. Avatar sketching happens on the phone.
• Make a child visible to strangers. There's no public profile, search or discovery.

How we look after your family:

• Only a parent can create a child's profile. Children can't sign themselves up.
• We collect only what a feature needs. Nothing "just in case."
• Your family's information is kept separate from every other family's, and our database enforces this. The one exception is Family Circles: only with each parent's consent, only what that section lists.
• We share information only with the companies that help run the app (every one is listed below), or where the law requires it. A few features fetch things from outside services (for example, restaurant search and recipe icons from Google), and we say exactly what each one sees.
• Deleting is real. A child's permanent erase gives you 7 days to change your mind, then it can't be undone. The few exceptions, like the record that you gave consent, the game-list totals (counts with no names or IDs) and the record of sign-ins, are explained under "How long we keep data" and "Deletion and backups."
• If we change how we use your child's information, we'll tell you first, and ask again where your consent is needed.

What we collect, and why

The app is built around a Data Category Registry — a single list, enforced in our code, of every category of family data we store. The in-app Trust Center shows you these same categories with your family's live record counts. The table below follows that registry's purposes and legal bases.

For families in the EU/UK: legal bases (GDPR Art. 6): most categories are processed because they are necessary to provide the service you signed up for (Art. 6(1)(b), "contract"). Diagnostics, private reflections and the game-list totals use our legitimate interest (Art. 6(1)(f)) — in keeping the app working and secure, in giving a parent a private place for their own notes, and in knowing when a game needs new content. We deliberately do not use consent as the basis for core functionality — consent is reserved for genuinely optional processing you can refuse or withdraw without losing the app (Family Circles; see below).

From parents specifically: your name and email address (account creation and sign-in — via email/password, Sign in with Apple, or Sign in with Google). We use your email address to send account emails (sign-up confirmation, sign-in links, password resets). If you subscribe, you pay through the App Store or Google Play as an in-app purchase. We never see or store card details.

About children specifically: everything about a child in the app is created inside the household by the family — a display name, an avatar, and the activity data (chores, balances, games, messages) listed above. Children cannot self-register, and there is no public profile, search, or discovery of children anywhere in the app.

Totals we count to improve the games

Many games deal from a fixed list of puzzles, words or places. So we know when to write more, our server keeps one running total per list for each month: how many times a family reached half, most or all of that list, or played it again after seeing all of it. Only that count is saved, with the month it belongs to, and our team sees only the totals. They hold no names or IDs (no account, child, family or item, and no date beyond the month), we never try to work out which family a total came from, and we never use them to make any decision about a family. Because nothing in a total points back to your family, there is nothing to remove when you delete a child or your account, and the totals stay as they are.

Diagnostics and the install identifier (please read — we want this to be clear)

To deliver notifications and diagnose problems, the app records, per installed device:

• a random install identifier — a UUID we generate ourselves and store in the device's secure keychain. It is not a hardware identifier and not an advertising identifier. A new one is created if you reinstall the app;
• basic device information (model, OS version, and which version and build of the app it is running);
• diagnostic breadcrumbs and error reports (what screen an error happened on — never the content of your messages, photos, chore notes, or other personal text);
• anything you type into "Report a problem" or "Send feedback" — if you choose to send one, the message you write (up to 2,000 characters) is stored with that diagnostic record so we can understand and fix the issue, and kept for 90 days like other diagnostic reports. It stays in our own systems — it is not sent to any other company. This is the one place diagnostics can contain text someone wrote, and it can be sent from any family member's device, so please leave out anything private;
• a push notification token, only if notifications are enabled.

Because children use the app on their own devices, this diagnostic data can relate to a child. It is used solely for "support for internal operations" in the COPPA sense: delivering the notifications you turn on, fixing crashes and bugs, and keeping the service secure. It is never used for tracking, profiling, or advertising, and is never combined with data from other apps or sites.

Sign-in and app health checks, even when you're signed out. To fix sign-in problems quickly and keep the app working and secure, the app sends us a short note when someone signs in or out, when a sign-in doesn't work, and when the app updates. If part of the app hits an error and has to recover, the app asks whether to send us a short error report, and sends one only if the person using the phone chooses to (on a child's phone, that can be the child). Both work even when nobody is signed in. Each note says which version of the app the phone is running, the type of phone and its system version, a short code for what happened (for example, that a password wasn't accepted, or, for an error report, which part of the app and which kind of game had the error, with a short error code), and a short fingerprint of the app's connection key, together with the random install identifier above. It never includes a name, email address, password, household, account or child, the error's own message, or anything anyone typed. Children's and parents' phones send exactly the same thing. We keep these notes for 30 days (sooner if that device's record is deleted) and include them in your data export (for your own and your children's phones). Like the rest of diagnostics, they are used only to keep the app working and secure, and never for advertising or profiling.

Game and schedule history. For each family game and game schedule, we keep a short record of what happened to it: who created, changed, joined or left it, when a schedule sent it out, and when it finished. Each entry notes how the game started (for example a quick start, a schedule, a rematch, or an invitation from a Family Circle) and which version and build of the app was used, on which platform (iPhone or iPad, Android, or web). The person in an entry can be a parent or a child. We use this record only to work out what went wrong when a game misbehaves, looking at one game or schedule at a time. It never includes a device name, the install identifier, an IP address, or a location, and it is never used for advertising, analytics, or profiling. We keep each entry for 1 month, then delete it automatically. Erasing a child removes them from it, and deleting the account deletes it. It is included in your data export. (The "How this happened" view in the app is built from game activity your family can already see, and shows names and times only.) For families in the EU/UK, we keep this record on the basis of our legitimate interest in keeping games working.

What stays on your phone

Some data is kept on the device itself: your encrypted sign-in token (removed when you sign out); the email address and sign-in method a parent last used on that phone, so the sign-in screen can welcome them back and fill in the email (it stays after signing out so signing back in is quick — tap "Not you?" on the sign-in screen to remove it; deleting the account or reinstalling the app also removes it; it is never sent to us, and children, who sign in with a code, never have an email stored); a cached offline copy of your family's data so the app works without a connection; your app preferences; cached images; the random install id described above; and a short record of when the phone signed in and out (no names or email addresses), which is included in diagnostic reports so we can explain an unexpected sign-out. The Trust Center's "On this phone" section shows this for each device.

Who ever sees your data (our service providers)

We share personal data only with the service providers below, only to run the app, and only the minimum each needs. This is the complete list.

Some buttons simply open another app or website at your request — map directions, a restaurant's booking page (for example OpenTable), or the app stores. We don't send them your family's data; what happens there is covered by their own privacy policies.

We may also disclose information where the law requires it, or to protect the safety and rights of users. If we ever add a service provider, this list is updated first.

Children's privacy (COPPA and children's data generally)

• Parents create children, and consent for them. A child profile can only be created by a signed-in parent inside their household. Before we keep a child's information, the parent reads our Direct Notice to Parents and confirms in the app that they are the child's parent or legal guardian and agree; we then email a confirmation to the parent's account address, saying how to withdraw consent (the "email plus" method, 16 CFR §312.5(b)(2)(vi)). We record which parent consented, when, for which children, and the version of the notice they read.
• Data minimisation: a child is represented by a display name and an avatar — we do not ask for a child's email, phone number, precise location, or government identifiers, and the app has no free-text public surfaces.
• Parental control: parents can review everything (the Trust Center inventory covers all child data), correct it in-app, take a copy, and delete one kind of information, a child profile or the whole account at any time.
• Child-directed transparency: children get their own plain-language view of what the app knows about them (see the separate Children's Privacy Notice).
• Diagnostics from a child's device are limited to internal operations, as described above, and are disclosed here and in the app-store privacy labels.
• We don't disclose children's personal information outside your household. Family Circles (below) shows another family only a nickname (checked so it isn't a name from your family and holds no contact details) plus game moves and results, and only with your consent, per child, per family.
• To review or delete your child's information, or to stop further collection, use the Trust Center or contact us at the email, mailing address, or phone number in Who we are. To protect your children, we never release, change, or delete a child's information on the strength of a phone call or letter alone — we confirm the request through your parent account or the email address on it first.

Family Circles — playing with another family (by invitation)

Who can use it. Family Circles is available by invitation, to families who know each other personally. For every other household it is switched off, and nothing crosses.

Consent happens in the app. Before your child can be shared, you'll have confirmed you're their parent (the consent described in Children's privacy, above), and in the share screen you confirm you have read the parent notice and agree to this policy and our Terms. We record when, which parent account, which children, and the exact version of each document. No signed form is needed.

Family Circles lets two (or a few) families connect so their kids — and, where they choose, the parents — can play the app's templated games together. It shows another family a small, fixed set of things, chosen so they don't identify your child, and it works only on an explicit, revocable consent model:

• Adults connect, never kids. A parent invites another family's parent with a single-use code. Children cannot discover, search for, or contact anyone.
• Your consent, per child, per family. Before anything about your child is visible to another household, you grant consent for that child toward that specific family, in the app, on top of your consent as their parent and your agreement to the current parent notice, this policy and our Terms. A new family joining a circle sees nothing until you consent toward them specifically.
• Grown-ups may play too. A parent from a family you connect with may take a seat in the same game as your child, under a nickname and shield they choose (never a photo). Every adult seat is labelled as a grown-up's.
• What crosses the boundary — this list, and nothing else. About your child: a nickname you choose for that circle. Your child can suggest one, but it never crosses until you approve it. It is a name typed for the circle, not read from your child's profile. Our server refuses a name that contains a name from your household, an "@", a web address, or more than two digits, and the same check keeps your children's names out of your family's label, the circle's name and a parent's nickname. It can't recognise every nickname, so please choose one that isn't your child's real name; most families do. About your child's play: game moves and results, including league/matchday results where your family plays a league against another household. About your household: your family crest as artwork only (any motto or typed text is stripped and never leaves your household) — one crest for the whole family, so it says nothing about which child is playing — and the circle's name, chosen by the parent who creates the circle. About the adults: each parent's own circle nickname and shield. About everyone's app: the oldest app version in use at the table, so a game only uses features every player's phone can handle (a version number only, never the phone's type or anything else about it; we note each player's version only while the game runs). We also keep a record of which nicknames your child has used and when, so revocation can be honoured — that record is visible only to your own household, never to the other family. This is enforced in the database, not just policy: cross-household games are templated-only — no chat, no photos, no messages, and no money can cross between households. The only typed words that cross are names.
• Revocation is instant and always available, even if the feature is later disabled: revoking cuts the other family's visibility immediately, and any game your child is in ends for every family at the table; within 24 hours your child's identity is scrubbed from the other family's game records (they keep only anonymized scores, as "a former player"), and within 7 days the underlying disclosure data is purged.
• What the other family keeps after you revoke or leave: their own children's results, with your child anonymized. What they never had: your child's real profile, photo, contact details, balances, or anything outside the fields above.
• Each parent gets a per-child "Who can see my child" view in the Trust Center, showing every live grant with one-tap revoke, and an optional strict mode requiring your approval for every individual game.
• Push notifications related to circles are strictly transactional (your turn, game finished) — never re-engagement, streak pressure, or "your friends are waiting" messaging.

How long we keep data (retention)

Our full written retention policy is the Children's Data Retention Policy (companion document). In summary:

Deletion and backups

Parents can delete a child profile or the entire account in-app (Settings → the Trust Center / Delete Account). No email, phone call, or support ticket is required. Two levels are offered per child: remove (a reversible soft-removal — the child leaves the family but their data is kept until you erase or restore them) and erase permanently. Permanent erasure of a child is scheduled with a 7-day grace window: the child is removed immediately, a countdown is shown, and you can cancel and fully restore them before it runs; once the window passes, the erase runs automatically and cannot be undone.

Deleting one kind of information. You don't have to delete everything to delete something. Open any category in the Trust Center and its delete is right there, a couple of taps away:

• Your own messages: "Delete my messages" deletes every message you sent, and the copies of it in other people's notifications. Parents and teens can do this for themselves. A notification already shown on someone's phone can't be called back, and a copy of your data someone already downloaded keeps what it had.
• The family's messages, games or meals: a parent can delete the whole category in one go. In a home with more than one parent, the other parents confirm first. A few things stay because they still matter: games played with another family, Kredits already won, requests still waiting for an answer, and the record of how a game night came about. Clearing meals also clears the shopping list. Start fresh resets chores, money, the shop and more, and lets you choose what to keep.
• Notifications: hide them from your own view (everyone else keeps theirs), or, as a parent, clear the family's whole feed (the record of how a game night came about stays).
• Private reflections: the parent who wrote them can delete all of their own at once; a co-parent's are never touched.
• On this phone: clear what the app keeps on the device, from the Trust Center's "On this phone" section.

Some things tidy themselves away: the picture drafts made while you set a profile photo are deleted from the phone once the photo is uploaded, and a copy of your data is deleted from the phone when you close the share sheet (the copy on our server is deleted within 2 days).

When you delete, data is removed from our active systems immediately (for a scheduled child erasure, at the end of the grace window). Our database keeps routine encrypted backups for disaster recovery; deleted data is erased from those backups automatically within 8 days (we keep one backup a day for seven days, so the last backup made before you deleted something is erased within 8 days). Photos and other uploaded files are not included in those database backups — when you delete a photo it is gone from our systems immediately, with no backup copy to age out. Backups are never used to serve the app, and if we ever restored a backup we would re-apply all deletions before the system serves traffic (we keep an ID-only erasure log — no personal data — precisely so deletions survive a restore).

Sign-in records. Our hosting provider keeps a record of each sign-in: which account signed in (for a parent, including the email address and name on the account), when, from which IP address, and on what kind of device and app. It keeps these for its own security-log retention period to protect accounts, then deletes them. They hold nothing your family wrote or shared and are separate from your family's information. When you erase a child, any extra sign-in the app made for them on a phone is removed within 2 days.

Your rights (and your child's)

Wherever you live, we honor the following for you and your children — the app is built around GDPR-style rights:

• Access & transparency — the Trust Center shows every category of data we hold with live counts and what stays on each phone; the service providers who receive data are listed in this policy.
• Correction — family data is editable in-app.
• Deletion — deleting one kind of information, a child, or the whole account, in-app, as above.
• Export / portability — a machine-readable copy is available in-app (Trust Center → "Take a copy"): a ZIP with a plain-language README, one JSON file per data category, and your family's photos (if photos have to be left out for size, the app tells you), for the whole household or per child. You can also email privacy@anantabound.com.
• Consent withdrawal — consent-based processing (Family Circles) is revocable in-app, instantly, without losing the rest of the app.
• Objection / restriction — contact privacy@anantabound.com; for consent-based processing, revocation in-app is the direct route.

We respond to rights requests within one month. If you're in the EU/UK you may also complain to your supervisory authority (in Ireland, the Data Protection Commission; in the UK, the Information Commissioner's Office); we'd appreciate the chance to resolve it first.

International transfers

Our backend is hosted by Supabase on servers in the United States, and our service providers listed above include US companies. For EU/UK families, transfers rely on the EU–US Data Privacy Framework (and the UK Extension) for participating providers and Standard Contractual Clauses otherwise.

Security

Every household's data is isolated by row-level security enforced in the database itself — one family can never query another's rows, with the single exception of the limited, parent-consented Family Circles fields described above. Data is encrypted in transit (TLS) and at rest. Sign-in tokens are stored in the device's secure keychain (never plain storage). Money and balance operations run server-side under guarded, audited procedures. Our written children's-data security program (COPPA §312.8) governs access, vendors, incident response, and annual review.

If a breach ever creates risk to you or your children, we will notify the relevant authority within 72 hours and affected families without undue delay.

Changes to this policy

We'll post changes here and date them. Material changes affecting children's data — and any new kind of disclosure of child data — will be notified to parents directly and, where consent is the legal basis, will require fresh consent rather than silent continuation.

Contact

Ananta Bound LLC (operator of Kindom)
Email: privacy@anantabound.com
Mail: 5900 Balcones Drive, Ste 100, Austin, TX 78731, USA
Phone (voicemail — we reply by email): (512) 710-5764