Privacy Policy

1. Who we are and how to contact us

Project Kirk provides the Kirk parent and child apps and this website. For any privacy question or request, write to support@projectkirk.app. We are the data controller for the information described here.

2. Scope

This policy covers the Kirk apps for iPhone and Android and this website.

3. Information we collect

• Account data — parent email address and first name. Purpose: to create and secure the account and to send service messages. Legal basis: performance of a contract.
• Child profile data — child first name, age band, device platform. Purpose: to identify children in the family and show only the features their device supports. Legal basis: performance of a contract, with verifiable parental consent.
• Device data — push notification token, OS platform, app version. Purpose: to deliver alerts and support the app. Legal basis: performance of a contract.
• Usage data where supported — screen time summaries and app limit rules. Purpose: to show the summaries and enforce the limits a parent sets. Legal basis: performance of a contract.
• Safety event data — Need Help alerts, with timestamp, the coordinates and accuracy captured at the moment of the press, and delivery status. Purpose: to alert the family and keep an honest record. Legal basis: performance of a contract and the vital interests of the child.
• Preferences — language. Purpose: to show the interface in the chosen language. Legal basis: performance of a contract.
• Subscription entitlement status — whether a plan is active and which one. Purpose: to give access to the service. Legal basis: performance of a contract.

Payment card details are never seen by Kirk. Apple and Google process payment and share only entitlement status with us.

4. What we explicitly do not collect

• Does not read messages or their contents, in any app, on any platform.
• Does not view photos or the camera roll.
• Does not record audio or listen through the microphone.
• Does not log keystrokes.
• Does not track location in the background — only at a Need Help press.
• Does not read contacts.
• Does not log or record calls.
• Does not track browsing history.
• Does not contact emergency services or 911.
• Does not sell, rent, or share personal data with advertisers.
• Does not show ads.

5. Children's privacy and COPPA

Children's information is collected under the verifiable parental consent of the account-holding parent or legal guardian, who adds the child and agrees to this policy on their behalf. The categories collected about a child are limited to: first name, age band, device platform, push token, language, screen time summaries and app limit rules where supported, and Need Help alert events including the location captured at the press.

A child's information is never used for advertising or profiling, and is never sold. A parent may review, correct, or delete their child's information at any time in the app, or by writing to support@projectkirk.app. A parent may also refuse further collection by removing the child or deleting the account.

6. How we use information

Strictly to operate the service: to deliver and record Need Help alerts, to show screen time and limits where supported, to manage roles and invites, to provide support, to keep the service secure, and to meet legal obligations. We do not advertise, we do not sell data, we do not work with data brokers, and we do not train AI models on family data.

7. Service providers and sub-processors

• Supabase — application database and backend hosting. Data stored in the United States.
• Apple Push Notification service and Google Firebase Cloud Messaging — delivering alerts to phones. United States and global edge infrastructure.
• Apple and Google — subscription billing and entitlement.
• Resend — sending invitation and service emails. United States.
• Our website host — serving this site. Global edge network.

8. Location data

Location is captured only at the moment a child presses Need Help. It is never continuous and never collected in the background. It is visible to the adults in that family — the owner, guardians, and emergency contacts — and to the child who sent it. It is stored with the alert and kept for as long as the alert history is kept.

9. Retention

• Account and child profile data: for the life of the account.
• Need Help alerts, captured locations and delivery status: for the life of the account, so the family keeps its history.
• Screen time summaries: rolling 90 days.
• Push tokens: until the device unlinks or the token is replaced.
• Support emails: up to 24 months.

On deletion, the data above is removed from live systems, and from routine backups within 30 days.

10. Security

Data is encrypted in transit. Access to production systems is restricted to the people who need it and is authenticated. Database row-level security isolates each family's data from every other family.

11. Your rights

You may request access to, correction of, deletion of, or a portable copy of your information by writing to support@projectkirk.app. We respond within 30 days.

If you are in the EU or UK, you have rights of access, rectification, erasure, restriction, portability, and objection under the GDPR and UK GDPR. If you are in California, you have the right to know, delete, and correct your personal information, and to opt out of its sale or sharing. Project Kirk does not sell or share personal information as those terms are defined by the CCPA and CPRA. We will not discriminate against you for exercising any right.

12. Account deletion

Deleting the family account removes the parent account, every child profile, all Need Help alert events and captured locations, delivery records, screen time summaries, app limit rules, push tokens and language preferences. We may retain limited records where the law requires it, such as tax and transaction records held in connection with billing, and basic logs needed to prevent abuse. Subscription records held by Apple or Google are governed by their policies.

13. International transfers

Our providers are primarily based in the United States, so data may be transferred there. Where personal data is transferred out of the EEA or UK we rely on Standard Contractual Clauses and the UK Addendum, together with additional safeguards where appropriate.

14. Changes to this policy

We may update this policy. The "last updated" date will change, and for material changes we will notify account holders by email or in the app before the change takes effect.

15. Contact and complaints

Write to support@projectkirk.app. If you are in the EU you may also complain to your national data protection authority; in the UK, to the Information Commissioner's Office (ico.org.uk).

See also our Terms of Use.