KinDojo Privacy Policy

KINDOJO LLC. Effective date: October 19, 2026. This version replaces the policies dated September 24, 2026 and the separate children's policy, which is now Section 6 of this document.

Contents

1. Who we are and what this policy covers
2. The parent is the account holder
3. Information we collect
4. How we use information
5. How we make money
6. Children's privacy (COPPA)
7. Service providers
8. Amazon and affiliate links
9. When we disclose information
10. Retention and deletion
11. Security
12. Your choices and rights
13. Changes to this policy
14. Contact

1. Who we are and what this policy covers

KINDOJO LLC, a Washington limited liability company ("KINDOJO LLC," "we," or "us"), operates the KinDojo application (the "App") and the website at kindojo.com (the "Site"). This policy describes the information we collect through the App and the Site, how we use and protect it, and the choices you have. It applies whether the App is used in a web browser, installed to a device's home screen, or, in the future, downloaded from an app store.

This policy does not apply to information collected by third-party websites you reach through links in the App, including retailer websites linked from rewards. Once you follow such a link, that website's own privacy policy governs. See Section 8.

If you do not agree with this policy, do not create an account or use the App. By creating an account or using the App, you agree to this policy.

2. The parent is the account holder

Only an adult can create a KinDojo account. The adult who creates an account (the "parent") is the account holder for a family. Children never create accounts. A parent creates a profile for each child from inside the parent's own password-protected account, chooses the child's display name, sets the child's PIN, provides the child's birth month and year, and gives consent at that moment. A child profile cannot be created without that consent.

A parent may invite another adult to join the family as a co-parent. Both adults then have full parental controls, including the ability to see all of the family's data and to approve rewards. A parent is responsible for whom they invite and approve.

Children sign in with the family's code, their display name, and their PIN. They see only their own game and the habits and rewards their parent has set up. Everything a parent does, including the rewards, the settings, the reports, the habit suggestions, and any outside links, lives in the Parent Center, which a child's sign-in cannot reach.

3. Information we collect

3.1 Information parents provide

• Account information. Your email address and a password. The password is stored only in hashed form by our authentication provider; we cannot see it. When you accept the Terms of Service at sign-up, the version accepted and the time of acceptance are recorded on your account.
• Family setup. A family name of your choosing, your family's time zone, and any changes you make to the game's economy settings.
• Child profiles. For each child, a first name or nickname (the "display name"), a birth month and year, and a PIN. We deliberately do not collect a full date of birth. See Section 6 for everything we hold about children.
• Content you author. The habits, penalties, custom quests, and coin bounties you create; and the rewards you offer, including a reward's name, description, coin price, an optional dollar value, an optional link to a product page, and an optional image you upload or paste.
• Habit-planning responses (optional). If you use the habit-suggestion feature, your answers to seven questions about the level of support a child currently needs in six habit categories and up to two categories you want to prioritize. We keep only the most recent set of answers and the date they were given. Submitting new answers replaces the previous set.
• Notification preferences. Which alerts you want on your own devices, and whether reminders are on or off for each child.
• Co-parent requests. If you ask to join another family as a co-parent, we record your request and show your email address to the parent who decides whether to approve it.
• Correspondence. If you email us, we keep the message and your email address so we can respond. Email to our kindojo.com addresses is delivered by Cloudflare and read in a mailbox we operate; our replies are sent through Resend.

3.2 Information generated by using the App

The App's core function is a record of habit activity, so most of what we hold is that record:

• Habit and game activity. Which habits a child marks complete and when, daily check-ins, streaks and streak freezes, coins, experience points and levels, in-game health, hearts, energy, Dojo Points and belts, boss matches and results, feats, equipment and inventory, and cosmetic choices such as the fighter, sidekick, victory dance, and arena scene.
• The ledger. Every coin, point, or health change is written as a dated entry with a short reason (for example, the name of the habit completed or the reward requested). Parent adjustments and reversals are entries in the same ledger, with the parent's account noted as the author.
• Reward activity. Reward requests, which parent approved or declined them and when, and when a parent marked a reward as delivered.
• Claims and penalties. Completions that a parent has confirmed, bounty claims, and penalty events a parent records.
• Suggestions a child sends. A child can send their parent a short idea for a reward or a habit: a choice from a short list plus an optional note of up to 80 characters. Suggestions go only to the parents of that family.
• Habit-suggestion records. For each suggested habit a parent adds, the suggestion's identifier, the starting level chosen, and the reason category; and, for each suggestion a parent declines, its identifier and date (the most recent forty), so it is not suggested again.
• Vacation windows. The dates a parent turns vacation mode on and off for a child.
• Sign-in days. For each child, the days on which they signed in or resumed a session. We do not store IP addresses or device identifiers with these records.
• Reminder log. Which reminder was sent on which day, so the same reminder is not sent twice.

3.3 Information collected automatically

• Server logs. Our hosting providers record standard request logs, including IP address, browser type and version, operating system, and the time of each request, for security and operations. These logs are kept briefly and are not joined to your account.
• Sign-in protection. Our sign-in screens use Cloudflare Turnstile to tell people from automated programs. Turnstile processes technical signals from the browser, such as IP address and browser characteristics, for that purpose only, and may set a cookie on the sign-in page to do so.
• Error reports. If the App malfunctions, a technical report is sent to our error-monitoring provider, GlitchTip. We have configured these reports to carry no name, no account identifier, and no request headers. They contain the error, the page where it happened, the browser and operating system, and up to thirty recent technical events that led to the error.
• Push subscriptions. If you or your child turn on notifications, we store a push subscription for that device: a delivery address assigned by the device's platform, encryption keys, the browser type, and when it was last used. It is used only to deliver the notifications you configured.
• Browser storage. The App stores a sign-in session on the device so you stay signed in, and stores a few preferences, such as whether sound is muted, whether the introduction has been shown, and, if you choose "remember me," the family code and name or email used to sign in. The App's files are cached on the device so it loads quickly and works when the network is poor. This is first-party storage used only to operate the App. We do not set advertising or tracking cookies.
• Fonts. The App and the Site load their typefaces from Google Fonts. Your browser requests the font files from Google's servers, which receive your IP address and browser information as part of that request.
• Server-side fetches you trigger. When a parent pastes a product link or an image address onto a reward, our server (not your device) fetches that page to read its title and picture, downloads the picture, and stores a copy in our file storage so the reward keeps its image even if the original address stops working. The retailer sees a request from our server, not from you.

The App does not collect precise location, does not access contacts, photos, or files on your device (other than an image you choose to upload for a reward), does not use the microphone or camera, and does not record voice. There is no chat, messaging, posting, or other social feature. The App does not use third-party analytics, advertising identifiers, or cross-site tracking of any kind, and we do not track you across other websites or apps.

4. How we use information

We use the information described above to:

• operate the App for your family: run the habit plans, calculate coins, streaks, levels, and other game values, and show you each child's activity, statements, and dashboards;
• generate habit suggestions for your review, using each child's age, your habit-planning responses, and that child's activity;
• deliver the notifications and reminders you or your co-parent have turned on;
• manage your account, including sign-in, password reset, PIN reset, and co-parent approval;
• protect the App against abuse, keep it secure, and diagnose and fix errors;
• respond when you contact us;
• notify you of material changes to the App or this policy;
• enforce our Terms of Service; and
• produce aggregated statistics that do not identify any person, to understand and improve the App.

We do not use personal information for advertising, do not build advertising profiles, do not sell personal information, and do not send marketing email or marketing push notifications. We send email only for account purposes (confirming a sign-up, resetting a password, answering your messages, or notifying you of material changes).

5. How we make money

The App is free to use. There are no in-app purchases, no subscriptions, and no advertising. Our revenue comes from affiliate commissions. A reward in the App may carry a link to a product page. Some links we provide, now or through a future gallery of suggested rewards, are affiliate links, and if a parent makes a qualifying purchase through one of them we may earn a commission at no additional cost to the parent. Affiliate links are shown only in the Parent Center, to the parents of a family. They are never shown to children. Section 8 describes the relationship in detail.

6. Children's privacy

This section is our notice to parents and legal guardians under the Children's Online Privacy Protection Act and its rules ("COPPA") about our practices for collecting, using, and disclosing personal information from children under the age of 13. The App treats every child profile the same way regardless of age, so the practices described here also describe what we hold about teenagers who use the App through a parent's account.

6.1 How children come to use KinDojo

Children cannot create accounts, and they cannot provide us with personal information directly. A parent creates each child's profile from inside the parent's own password-protected account, and the parent, not the child, chooses the display name, sets the PIN, and provides the birth month and year. Consent is collected and recorded electronically at the moment the profile is created, including which parent account consented and when. The parent's signed-in, password-protected account is the method by which we verify that the consent comes from the parent.

6.2 What we collect about a child

We collect only as much information about a child as is reasonably necessary for the child to use the App, and we do not condition a child's participation on disclosing more than that.

Provided by the parent:

• The child's first name or nickname (the display name shown in the App).
• The child's birth month and year, used only to determine the child's age, whether this section applies, and which age range of habit suggestions to offer. We do not collect the day of birth.
• A PIN chosen by the parent. The PIN is stored only in hashed form and cannot be recovered; a parent resets it from the Parent Center.
• The habit-planning responses described in Section 3.1, if the parent uses that feature.

When a profile is created, we also generate an internal sign-in identifier for the child in the form child.[random code]@players.kindojo.invalid. This is not a real email address and cannot receive mail. Children are never asked for an email address, phone number, home address, photo, or any other contact information.

Generated by use: the habit and game activity, ledger entries, reward requests, claims, suggestions to the parent, vacation windows, sign-in days, and reminder log described in Section 3.2, and the push subscription described in Section 3.3 if the parent turns reminders on for the child's device.

6.3 What a child sees and cannot see

A child's sign-in shows only the child's own game, the habits and rewards their parent set up, and the family's weekly standings among siblings. A child's view contains no advertising and no links to outside websites. Product links on rewards, including affiliate links, are visible only in the Parent Center. Images a parent attaches to rewards are served from our own file storage, so a child's device does not contact the retailer. Children cannot message anyone, and nothing a child enters is visible outside the family.

6.4 Persistent identifiers

Two persistent identifiers are associated with a child's use of the App: the sign-in session stored on the device, and, when a parent has turned reminders on, the push subscription for that device. We use them solely to support the internal operations of the App: keeping the child signed in, delivering the reminders the parent configured, protecting the App's security, and fixing errors. We never use them to contact a child for any other purpose, to build a profile of a child, for advertising, or for tracking across sites or apps.

6.5 How we use and disclose a child's information

We use a child's information to operate the child's profile and make the game work, to report the child's habit activity to the child's own parents, to generate habit suggestions for the parents to review, to deliver reminders the parent turned on, to keep the App secure, and to produce aggregated statistics that identify no one. We do not use children's information for marketing or advertising and do not send marketing messages to children.

We disclose a child's information only to the service providers listed in Section 7, which process it on our behalf to support the internal operations of the App and are bound to use it only for that purpose, and in the limited legal circumstances described in Section 9. We do not share, sell, rent, or transfer children's personal information for any other purpose.

6.6 Your rights as a parent

At any time you may review the personal information we hold about your child, have it corrected or deleted, refuse to let us collect any more of it, and revoke the consent you gave. You can do this:

• Review. Sign in to your parent account. The Parent Center shows the child's full activity record, including the activity statement, the habit dashboard, every ledger entry, reward history, and sign-in days.
• Export. Email privacy@kindojo.com from the email address on your parent account and ask for a copy of your family's data. We will send it in a machine-readable format within 30 days.
• Correct. Edit the child's display name, reset their PIN, change their birth month and year, revise your habit-planning responses, and adjust coins or reverse ledger entries from the Parent Center.
• Delete. From the Players tab, permanently delete the child's profile. This removes the child's sign-in and all of the child's data immediately. Revoking consent means the child can no longer use the App.
• Ask us. Email privacy@kindojo.com for any of the above. To protect your child, we may ask you to confirm your identity, for example by writing from the email address on your parent account.

6.7 Operator

The operator that collects and maintains information from children through the App is KINDOJO LLC, at the address in Section 14. No other operator collects or maintains personal information from children through the App. If you believe we have collected information from a child in a way not described here, email privacy@kindojo.com and we will delete it.

7. Service providers

A small number of companies process information on our behalf so the App can run. Each is bound by its terms to use the information only to provide its service to us. These are all of them:

Provider	What it does for KinDojo	What it processes
Supabase, Inc.	Database, authentication, server functions, and file storage. Sends our account emails (sign-up confirmation and password reset).	All account, family, child, and game data described in Section 3; parent email addresses and hashed passwords; hashed child PINs; stored reward images; server logs.
Vercel, Inc.	Hosts and delivers the App.	Server request logs (IP address, browser, timestamps).
Cloudflare, Inc.	Domain and network services for kindojo.com, hosting of this Site, sign-in bot protection (Turnstile), and delivery of email sent to our addresses.	Request logs; technical browser signals on the sign-in screens; email you send to our kindojo.com addresses.
Resend, Inc.	Sends the email we write to you from our kindojo.com addresses, such as replies to support and privacy requests.	Your email address and the contents of messages we send you.
Burke Software and Consulting LLC (GlitchTip)	Error monitoring.	Error reports stripped of names, account identifiers, and request headers, as described in Section 3.3.
Google LLC (Google Fonts)	Serves the typefaces used by the App and the Site.	The IP address and browser information sent with each font request.
Apple Inc., Google LLC, and Mozilla Corporation (push services)	Deliver push notifications to the device or browser each company makes, only when notifications are turned on.	The push delivery address for the device. Notification contents are encrypted on our server and decrypted on the device, so the push service cannot read them.

Amazon is not a service provider. It is a retailer we link to, described next.

8. Amazon and affiliate links

KINDOJO LLC participates in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to Amazon.com. As an Amazon Associate, KINDOJO LLC earns from qualifying purchases.

Where links appear. A reward in the Parent Center may carry a link to a product page on Amazon.com or another retailer. Parents add most of these links themselves. Links we supply, now or through a future gallery of suggested rewards, may include an Amazon affiliate tag. Links appear only in the Parent Center. A child's view never contains a link to any outside website.

Tapping a link leaves the App. When a parent taps a reward link, the retailer's website opens in the browser. From that point the retailer's privacy policy governs. Amazon sets its own cookies on its own site to attribute purchases to the affiliate link, under Amazon's policies, not ours. We do not send Amazon any information about you or your child; the link carries only our affiliate tag.

What Amazon reports back. Amazon reports to us the number of clicks on our links, the items ordered through them, and the commissions earned, grouped by link. Amazon does not tell us who clicked, who purchased, or any customer's name, address, or payment details. We cannot connect an Amazon report to a KinDojo family.

Parent-added links and the reward gallery. Links and reward names that parents add are private to that family in the App. We may review the product links parents add in order to decide whether to offer that product in the gallery we show to all families. Such a review looks at the product and link only. Nothing about your family, your children, your coin prices, or your notes is ever included in the gallery, and the gallery never indicates which family first added a product.

9. When we disclose information

We disclose personal information only:

• to the service providers listed in Section 7, for the purposes stated there;
• to a buyer or successor if KINDOJO LLC is involved in a merger, sale of assets, reorganization, dissolution, or similar event in which personal information is among the assets transferred, in which case this policy continues to apply to that information;
• to comply with a court order, law, or legal process, including a government or regulatory request;
• to enforce our Terms of Service; or
• if we believe disclosure is necessary to protect the rights, property, or safety of KINDOJO LLC, our users, a child, or others.

We may disclose aggregated information that does not identify any person or device without restriction. We do not disclose personal information to third parties for their own marketing or advertising. KINDOJO LLC has no subsidiaries or affiliates.

10. Retention and deletion

While your account exists. We keep your family's data for as long as your account exists, because the activity record is the product: it is what the statements, dashboards, and streaks are made of. We do not automatically delete activity after a set period.

Deleting a child's profile. A parent can permanently delete a child's profile from the Players tab. Deletion removes the child's sign-in and every record tied to the child (activity, ledger, rewards, requests, suggestions, push subscriptions, habit-planning responses, and suggestion records) immediately and without a recovery period.

Deleting a parent account. A parent can permanently delete their own account from the Parent Center. If another parent remains in the family, your membership is removed and the family's data stays with them. If you are the last parent, the whole family is deleted: every child profile and sign-in, all activity, all rewards and their stored images, and your own sign-in. This is immediate and cannot be undone.

Things that live outside your account. Hosting request logs are retained briefly by the providers in Section 7 and are not joined to your account. Identity-stripped error reports are retained by GlitchTip for up to 90 days. Email you send us is retained for as long as we need it to answer you. Our database provider keeps encrypted backups for up to 7 days for disaster recovery; deleted data leaves those backups on that schedule.

Push subscriptions are removed when the profile or account they belong to is deleted, and when the device unsubscribes or the platform reports the address is no longer valid.

11. Security

We have implemented measures designed to protect your information from accidental loss and from unauthorized access, use, alteration, and disclosure:

• All traffic between your device and our servers is encrypted in transit (TLS), and data is encrypted at rest by our database provider.
• Passwords and PINs are stored only as hashes and cannot be read by anyone, including us.
• Each family's data is isolated by database access rules so that it can be read or changed only by the signed-in members of that family. A child's sign-in can reach only the child's own game.
• All changes to coins, points, and health are written to an append-only ledger on the server; the App on a phone cannot edit balances directly, and a nightly audit checks the totals against the ledger.
• Sign-in screens are protected against automated attacks, and administrative credentials never leave our servers.

Your part matters too. Keep your password, your children's PINs, and your family code private, and tell us at support@kindojo.com if you believe your account has been accessed without permission. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Your choices and rights

Choices in the App

• Notifications. Parents choose which alerts they receive and whether reminders are on for each child. Notification permission can also be revoked at any time in your device or browser settings.
• Staying signed in. "Remember me" is off by default. If you decline it, the family code and name or email are not stored on the device.
• Browser storage. You can clear the App's stored data through your browser settings. You will need to sign in again.
• Access and correction. Your family's settings, habits, rewards, and each child's full activity record are visible and editable in the Parent Center. You can delete a child's profile or your own account from inside the App.

Requests by email

You can also email privacy@kindojo.com to ask what personal information we hold about you or your child, to receive a copy, to have it corrected, or to have it deleted. We may ask you to confirm your identity, usually by writing from the email address on your account. We will respond within 30 days. If we decline a request, we will tell you why, and you may appeal by replying to our decision; a second person will review the appeal. We do not discriminate against anyone for exercising their privacy rights.

State privacy rights

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia, and other states with consumer privacy laws may have rights to confirm whether we process their personal information, to access, correct, delete, and obtain a copy of it, and to opt out of its sale, its use for targeted advertising, or profiling that produces legal or similarly significant effects. We do not sell personal information, do not use it for targeted advertising, and do not profile anyone in that way, so there is nothing to opt out of. To exercise any other right, email privacy@kindojo.com. Nevada residents may submit a request to opt out of sales at the same address; we do not sell personal information.

13. Changes to this policy

We may update this policy from time to time. The effective date at the top of this page shows when it last changed. If we make a material change to how we treat personal information, we will show a notice in the App and, for changes affecting children's information, will seek a parent's consent again where COPPA requires it. Continued use of the App after a change takes effect means you accept the revised policy.

14. Contact

Questions, requests, and complaints about this policy or our privacy practices:

KINDOJO LLC
100 N Howard St, Ste R
Spokane, WA 99201, USA
Privacy requests: privacy@kindojo.com
Support: support@kindojo.com