Security & Data Protection

How We Protect Your Family's Data

• No passwords to leak. Sign-in uses one-time codes sent to your email. We never store a password, so there is nothing for attackers to steal or guess.
• Encrypted in transit and at rest. All traffic is protected with TLS, and data stored in our database is encrypted with AES-256.
• Your family is isolated. Database row-level security means your account can only ever see your own family's data — never another family's.
• Photos are never stored. When your child photographs a question for help, the image is processed in memory and discarded immediately. It is never written to disk or a database.
• Abuse protection. Sign-in and sensitive endpoints are rate-limited, and our servers enforce strict security headers on every response.

What We Never Do

• No advertising. The platform is 100% ad-free — for parents and for children.
• No selling data. We never sell, rent, or trade personal data to anyone.
• No third-party trackers. No advertising or cross-site tracking cookies.
• No child-to-child contact. There are no social features, chat rooms, friend lists, or public profiles. Your child interacts only with the AI tutor.
• No training on your child's data. We do not use your child's work to train general-purpose AI models without explicit consent.

Retention & Deletion

• Trial accounts that don't continue to a subscription are automatically deleted — all family data included — 90 days after the trial ends.
• You can request deletion at any time and we will erase your family's data, subject only to legal retention requirements (e.g. billing records required by Singapore accounting law).

Full details are in our Privacy Policy.

If Something Goes Wrong

No system is 100% secure, and we won't pretend otherwise. If a data breach ever affects your personal data, we commit to notifying you within 3 business days, in line with Singapore's PDPA Notification of Data Breach regulations.

Questions? Talk to Our Data Protection Officer

We comply with the Singapore Personal Data Protection Act 2012. You also have the right to contact the Personal Data Protection Commission.