Privacy Notice

• Your account: your email address and sign-in details (or the basic profile Google or Apple shares if you sign in with them).
• About your child, from you: a first name or nickname, an age (and, only if you choose, a birth month and year, never the day), the exploration goals you choose, the play settings you set (daily limits, session type, sounds), the moments and activities you record, Adventures your child marks as done with their 3-face reaction, your weekly check-ins (shown in the app as your observations), Discovery Journey notes (which you can keep private from other caregivers) and Checkpoint answers. A nickname is enough: we never ask for a full birth date, school, address or health information.
• Passports and certificates: Optional full names and photos used to personalise Discovery Passports or certificates are processed on your device and are not uploaded to or stored by Innatora. They are kept only while the page is open and are not sent to AI, analytics or logs.
• Your child's choices: what your child picks on their own home screen in Child Mode (for example "build" or "music"), used as an interest signal.
• From the games (only after your recorded consent): taps, timing and choices (including how long a game took, hints and retries, and the learning topic), and in Would You Rather, which option your child picked. Words typed in Silly Uses are used on screen and not stored; only counts are kept. Prompts and Buddy's lines are read aloud from fixed scripts (by a speech service that receives only that text, or by your device's own speech feature); no audio is recorded, Buddy never chats freely or asks questions about your child, and the games never use the camera, microphone or location.
• From people you invite: moments a grandparent or teacher adds through a link you create.
• Photos you add to the gallery. We re-save each one on your device before upload, which shrinks it and removes hidden details such as location; originals are never uploaded. Gallery photos are private to your family and deleted when you delete them or the child's profile.
• Payments: if you subscribe or buy a Checkpoint, our payment provider handles your card details; we only receive what you bought and your plan's status.
• Plans, trials and invites: whether you started a free trial and when it ends, your invite code, and which account invited which (so the right reward is given). Friends never see each other's details.
• Creatures and certificates: a random seed for each creature your child hatches, and the dates certificates were earned. Share images are drawn on your device and never uploaded.
• Messages you send us through the contact form or by email: your name, email address and message, used only to reply and kept only as long as needed to handle it.
• Closer-look checklist: if you fill it in, your own answers about your child (rarely / sometimes / often), so you can see changes over time. Never sent to AI, never shared.
• Advanced Learning Check: if you use it, your ratings and milestone answers, your child's task results (the longest sequences remembered) and the outcome shown. Private to your account, never sent to AI, never shown to your child.
• Agreement records: which version of our Terms and this notice you accepted, and when.
• Usage counts: which screens and features are used, without your child's name, anything you type, or game answers. Website visits and clicks are counted without cookies or IP addresses: we keep daily totals only, plus a visitor fingerprint that is scrambled with a key we delete after two days, so visits can't be linked to a person or across days. Visits aren't counted at all in Child Mode or when your browser sends a Do Not Track or Global Privacy Control signal.

Please don't enter health, clinical or other sensitive information anywhere in Innatora.

• To provide the service you asked for: weekly plans, games, pathways, reports and certificates (our contract with you).
• Children's game play and the data it produces rely on your consent as their parent or guardian, which you give before the first game.
• To keep the service secure and working, and to improve it using aggregate usage counts (our legitimate interest).
• To take payments and meet legal and tax obligations.

We never sell family data, never use it for advertising, and never produce scores, rankings or comparisons against other children.

We use a small number of service providers, who process data only to provide their service to us:

• Hosting and database (Lovable Cloud, built on Supabase): stores your account and family records.
• AI writing (Lovable's AI gateway, currently using an OpenAI model): drafts summaries, suggestions, game worlds and activity twists. It receives already-computed labels, game notes, age band and interest areas, never your child's name. Before anything is sent, names, email addresses, phone numbers, street addresses, postcodes, links and ID or card numbers are removed automatically, and text you or your invitees typed is treated as data, never as instructions. Its output is checked again on the way back (no contact details, scores, diagnoses or predictions) and can still be wrong. We use AI only to write for you, never to train models on your family's data.
• Payments (Paddle): acts as the seller of record for purchases and handles billing details under its own privacy policy.
• Email (FormSubmit for the contact form, and Resend for emails between you and our team, including occasional product emails you can unsubscribe from in one click): delivers messages.
• Fonts (Google Fonts): pages load typefaces from Google, which means your browser's IP address reaches Google when a page loads.
• Sign-in (Google or Apple, only if you choose them).

Some of these providers may process data outside your country, under their own safeguards for international transfers.

Innatora is for parents and guardians aged 18 or over. Children never create accounts and we don't knowingly collect information from a child except through a parent's account, with that parent's consent. A child plays either on a parent's signed-in device, and can't leave the games without a grown-up, or on a tablet the parent pairs with a one-time code, which can only show that child's own space and can be unpaired at any time. We never show children ads, links out, chat or other users. The games are not clinical tests or IQ measures. You control everything recorded about your child. If you believe a child has given us information without a parent, contact us and we will delete it.

A link you create lets its holder add moments about one child. They see only your child's first name and can never read your child's record. Links expire after 180 days, and you can switch one off at any time. We store only a scrambled fingerprint of each link, not the link itself.

Co-parents. If the family's owner invites a co-parent, that person signs in with their own account and has the same access to the family's children as the owner, except billing and deleting a child or the family. Only the owner can add or remove a co-parent, and a co-parent can leave at any time.

Teachers. A parent can invite a teacher, who signs in with their own account. A teacher sees only the children a parent chose, and only what a parent switched on for each child: by default, the child's first name and age, the things the teacher suggested and whether they were done (with the games' plain-language highlights), and moments the teacher adds. A parent may also let a teacher see the child's three strongest interest areas or all game highlights. Teachers never see parents' notes, hopes, Checkpoint reports, Advanced Learning Check or closer-look answers, the gallery, other children or billing. Parents can change or remove a teacher's access at any time, with immediate effect.

Assignments. What a parent or teacher assigns to a child (a quest, a game, an activity or Checkpoint games), who assigned it and whether it was done are stored with the child's record. A child's paired device shows only the name of what was assigned, never instructions or anything else from the record.

We keep your family's data while your account exists, so the picture can build over time. When you delete your data, it is removed straight away. Your sign-in itself is removed by our team within 30 days of your request. Copies in our hosting provider's routine backups, if any, expire on that provider's schedule. Payment records are kept by Paddle as the law requires.

We use your browser's storage for sign-in and a few conveniences, such as which child you last viewed and which activities you swapped this week. We don't use advertising or tracking cookies. Paddle's checkout may set its own cookies when you pay.

• See and take your data: download everything from Your data & account.
• Delete it: delete everything from the same page, or remove one child from their profile page.
• Correct it: edit your child's details in the app at any time.
• Withdraw consent for the games: simply stop starting them, and contact us if you'd like existing game results removed.

Depending on where you live, you may also have the right to object, to restrict processing, and to complain to your data protection authority.

Family records are protected by sign-in and by database rules that let only your own account read or change them. Invited observers and the games write through narrow, checked paths. No system is perfect, and we'll tell you promptly if something goes wrong that affects your data.

Privacy questions, requests and complaints: privacy@innatora.com, or our contact form. We reply within 30 days. If you're not satisfied, you can complain to your data protection authority, for example the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.