Security & Privacy Practices

Data Protection

Your data is encrypted every step of the way — both while it travels between your device and our servers (HTTPS/TLS) and while it's stored at rest in our database.

• Row-level security (RLS) policies are enforced at the database layer, ensuring that families can only ever read or write their own data — other families' data is invisible even if a request were somehow misdirected.
• Database access requires authenticated sessions with role-based permissions. Service-level operations use a separate server-only credential that is never exposed to the browser.
• We conduct regular security audits and code review processes to identify and address vulnerabilities before they reach production.

Access Controls

Every parent account has a PIN that guards access to billing, child profiles, settings, and content approvals. Here's how we keep those controls secure:

• Parent PINs are hashed using bcrypt — we never store your PIN in plain text, and it is never recoverable even by our own team.
• Child profiles are accessible only through an authenticated parent session. No one can reach a child's data without first logging in as that child's parent.
• Admin operations (such as content review and account management) require an elevated role that is verified on every request.
• Session tokens expire automatically and rotate on sensitive actions to limit exposure if a device is lost or shared.

How We Use AI

We use AI in a small number of specific ways to improve safety and educational quality. Here is exactly what AI does — and what it never does — in our app.

What AI is used for:

• Content moderation — when gallery submissions are reviewed for age-appropriateness before publication.
• Lesson generation — creating age-appropriate drawing lesson prompts and educational content tailored to grade levels.
• Re-engagement communications — generating personalized messages to remind inactive families about the app (sent to parents, not children).

What AI never does:

• AI is not used for behavioral profiling, advertising targeting, or tracking.
• AI does not have access to child names, ages, or any personally identifying information.
• AI is not used to make automated decisions about individual children's educational outcomes.

Child data is anonymized before any AI processing. Before any information is sent to an AI service, our system strips out names, ages, and personal details — the AI receives only anonymous activity summaries or generic content descriptions. No child PII is shared with third-party AI providers.

We use Anthropic's Claude APIfor AI features. Anthropic does not retain or train on data sent through their API. You can review Anthropic's data usage policy at anthropic.com/privacy.

Payment Security

We don't store credit card numbers. All payment processing is handled by Stripe, Inc., which is certified PCI DSS Level 1 — the highest level of payment security certification.

• Your payment details go directly from your browser to Stripe — our servers never see or touch your card number.
• Stripe webhook events (subscription changes, payment notifications) are verified using cryptographic signatures so we can confirm they genuinely come from Stripe before acting on them.
• Webhook events are processed idempotently, meaning duplicate events are safely ignored — you will never be double-charged due to a network retry.
• Failed payment notifications are sent directly to the parent email on file, giving you a chance to update your payment method before access is affected.

Monitoring & Incident Response

We run automated monitoring around the clock so that problems are caught and addressed quickly.

• Automated error tracking is active in production. All error reports are scrubbed for PII before logging — personal information is filtered out so it never appears in our error logs or monitoring dashboards.
• External uptime monitoring checks our service every 5 minutes, with real-time alerting if availability drops.
• Point-in-time database recovery is enabled, allowing us to restore data to any point within our retention window in the event of data loss or corruption.
• If a security incident affecting user data occurs, we will notify affected users promptly and take immediate steps to contain and remediate the issue.

To report a security concern or vulnerability, please email us directly at privacy@crayonisland.com. We take all reports seriously and aim to respond within 1 business day.