Nurturo Privacy Policy

We collect only the minimum data necessary to provide the Nurturo experience. A parent or guardian must provide verifiable consent before any child data is collected.

Child data stored in our database:

• Child's first name (for in-app personalization only)
• Pet name and character selection (Leo, Luna, Pao, or Foxy)
• Daily habits selected by the child (up to 5 habits)
• Habit completion logs (which habits were completed and on what date)
• Streak counts (current streak and best streak)
• Trait progress scores (discipline, kindness, curiosity)
• Diamond balance (in-app reward currency earned through habit completion)
• Pet care stats (energy, happiness, cleanliness levels)

Parent data:

• Parent email address (for account creation and communication)
• Password (securely hashed and stored by Clerk, our auth provider)
• Subscription status (premium plan type and expiration, if applicable)

Data stored locally on device only (never sent to our servers):

• Parent access PIN (4-digit code for parent-only features)
• Notification preferences
• Parental control settings (usage limits, quiet hours, bedtime mode)
• Pet Mart purchase history (virtual items and accessories)

Data we do NOT collect:

• Photos, videos, or audio recordings
• Location or GPS data
• Contacts or address book
• Device identifiers (UDID, advertising ID, IMEI)
• Browsing history or social media accounts

All child data is used exclusively to provide app functionality. We never use child data for advertising, profiling, or marketing purposes.

We use child data to:

• Display the child's name and personalize the in-app experience
• Track daily habit completions and calculate streaks
• Manage the virtual pet's mood, energy, and growth
• Award diamonds and track reward progress
• Schedule local device notifications (reminders and pet alerts)
• Allow parents to view their child's progress

We DO NOT:

• Sell, rent, or trade any personal information to third parties
• Use child data for targeted or behavioral advertising
• Create advertising profiles based on child activity
• Share child data with ad networks or data brokers

We use a limited number of third-party services to operate Nurturo. Each service receives only the minimum data required.

Clerk (Authentication)

Handles parent account creation, login, and email verification. Only parent data — no child data is shared with Clerk.

Supabase (Database)

Secure storage of all app data. Encrypted in transit (TLS/SSL) and at rest with enterprise-grade security.

RevenueCat (Subscriptions)

Processes Nurturo Pro premium subscriptions. Only parent user ID and purchase data — no child data is shared.

Expo Push Notifications

All notifications are scheduled and triggered locally on the device. No data is sent to external notification servers.

We DO NOT use analytics, tracking services, advertising networks, or social media SDKs.

Under COPPA, parents and legal guardians have the following rights:

Right to Review

You may review all personal information collected from your child at any time via the parent dashboard (Settings > Parents).

Right to Delete

You may request deletion of your child's data at any time. Options include deleting child data only or the entire family account. Access via Settings > Parents > Data & Privacy.

Right to Withdraw Consent

When consent is withdrawn, all child data is permanently deleted from our servers and the child will no longer be able to use the app.

Right to Refuse Further Collection

You may refuse further collection of your child's information, which will result in deletion of existing data.

Data Portability

You may request a copy of all data associated with your child's account by contacting us at hello@o2l.tech.

We respond to all requests within 3 days.

Data Retention

• Child data is retained for as long as the family account is active
• We do not retain child data longer than necessary to provide the service
• Locally stored data remains on device until the app is uninstalled or the user signs out

Data Deletion

When a parent requests data deletion or deletes the account:

• All child records are permanently removed from our database (profile, pet, habits, logs, streaks, trait progress, diamonds)
• The parent account is removed from our database and from Clerk
• Local device storage is cleared
• Deletion is permanent and cannot be reversed

Inactive Accounts

• We may delete accounts inactive for 24 months
• Parents will be notified via email before any inactive account deletion

If you have questions about this Children's Privacy Policy, our data practices, or wish to exercise your parental rights, please contact us:

For COPPA-related inquiries, we respond within 3 days.

You may also contact the Federal Trade Commission (FTC) for information about COPPA compliance:
ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule