This policy explains how long Rise Ohana keeps your family’s data, and what happens when it’s time to delete it.
This page has two parts. Part 1 is a plain-English summary. Part 2 is the full policy with every detail. Both parts say the same things — Part 1 just says them faster.
Our guiding principles: We keep data only as long as we need it. We tell you exactly how long that is. You can request deletion at any time.
| Data | How Long | Then What |
|---|---|---|
| Your child’s photos | 30 days, unless you choose to keep them (below) | Auto-deleted from our servers |
| Photo metadata (AI scores, your review decisions) | While your child’s account exists | On deletion, kept without your child’s name |
| Quest activity (assignments, completions) | While your child’s account exists | On deletion, kept without your child’s name |
| Device session logs | 90 days | Auto-deleted |
| Push notification tokens | Until logout or account deletion | Deregistered from Firebase |
| Wallet and transaction history | While your child’s account exists | On deletion, the wallet is de-identified: your child’s name and each transaction’s description are removed, and the amounts, dates and balance are kept without your child’s name, under an internal ID, with no deletion date |
| Reward requests and goal | While your child’s account exists | Deleted when your child’s account is deleted |
| Parental consent records | While you are a parent in the family, then 3 years after the family is deleted or you leave it | Deleted (COPPA compliance) |
| Audit logs | 1 year | Auto-deleted |
| Child profile (name, birth month/year, avatar) | Lifetime of account | Deleted when account is closed |
| Parent account data | Lifetime of account | Deleted when account is closed |
Keeping photos as a family keepsake is your choice. In the app’s data and privacy settings, a parent can turn on “Keep all photos forever” to keep your child’s photos as a family keepsake archive. It is off unless a parent deliberately turns it on. While it is on, we keep the photos for that one purpose — so your family can look back on them — instead of deleting them after 30 days. We keep them only while the setting is on and your child’s account exists: turning the setting off, deleting a photo, or deleting your child’s profile or your account ends it. When you turn the setting off, photos go back on the 30-day schedule, and any already older than 30 days are deleted 30 days later.
How: Use the Parental Dashboard in the app, email privacy@riseohana.com.
We use cloud-hosted databases with automated backups for disaster recovery. When we delete data from our primary systems, it may persist in backups for up to 90 days. We cannot delete individual records from backups on demand — this is a technical limitation of how database backups work. After 90 days, the data is permanently purged from all systems, including backups.
| Provider | What They Handle | Their Retention |
|---|---|---|
| OpenAI | Quest photo analysis | No longer than 30 days (per our DPA) |
| Firebase Cloud Messaging | Push notification delivery | Token deregistered on logout/deletion |
| Stripe | Parent subscription billing | Per Stripe’s terms (typically 3–5 years) |
| OAuth (Google/Apple/Microsoft) | Parent sign-in | Per their privacy policies |
We require Data Processing Agreements with all providers who handle child data. No child data is sold, rented, or shared for advertising.
Email privacy@riseohana.com. We respond within 7 business days.
See also: Privacy Policy • Terms of Service
Effective Date: October 9, 2026 • Rise Ohana, Inc., a Delaware C-Corporation
Rise Ohana (“RO” or “Company”) is committed to protecting the privacy of all users, particularly children under 13, in compliance with the Children’s Online Privacy Protection Act (COPPA) and applicable privacy laws. This Data Retention Policy describes how Rise Ohana collects, retains, and deletes personal information.
Key Principles: Minimization (retain only what’s needed), Transparency (parents know what, why, and how long), Control (parents can request deletion at any time), Security (reasonable measures to protect data), Honesty (we disclose technical limitations).
Photos, images, or video submitted by a child as evidence of quest completion, plus any derivative analysis, metadata, or descriptions generated from the image. Photos are classified as personal information under COPPA.
Quest verification (AI-powered and parental review), parental review and override, and system improvement (anonymized data only). If a Parent asks, a family keepsake archive of the child’s photos (Section 1.3).
| Status | Retention | Trigger |
|---|---|---|
| Active submission | 7 days | Photo submitted |
| Under review | 30 days total | Photo submitted |
| Approved & archived | 30 days from submission | Photo submitted |
| Kept as a family keepsake archive (the “Keep all photos forever” setting) | While the setting is on and the child’s account exists; then 30 days | Parent turns the setting on |
| Rejected | 1–7 days | Photo submitted |
| Deleted by parent | Immediate | Parent request |
| Child account deleted | Purged at hard-delete | 30 days after soft-delete |
Summary: Photos are deleted from primary storage no later than 30 days after submission, unless a Parent has asked us to keep them as a family keepsake archive by turning on the “Keep all photos forever” setting, which is off by default and is turned on only by a Parent’s deliberate action. Photos kept this way are retained for that purpose alone, and only while the setting is on and the child’s account exists. Turning it off returns the family’s photos to the 30-day schedule, no sooner than 30 days after it is turned off; deleting a photo, a child’s account or the Parent’s account ends that retention regardless of the setting. Photos may persist in automated backups for up to 90 days after deletion from primary storage, after which they are permanently purged from all systems.
Primary database: Permanent deletion via database DELETE operation. Automated daily at 2:00 AM UTC. Backups: Purged per provider schedule, no later than 90 days after deletion from primary storage.
Parents can request deletion via the Parental Dashboard or email (privacy@riseohana.com). Upon request: flagged immediately, physically deleted within 24 hours, confirmation within 7 days.
| Data | Retained After Photo Deletion | Rationale |
|---|---|---|
| Quest completion record | While the child’s account exists; on deletion, kept without the child’s name | Parent historical reference |
| AI confidence score | While the child’s account exists; on deletion, kept without the child’s name | System improvement and analytics |
| Parent override decision | While the child’s account exists; on deletion, kept without the child’s name | Parental decision history |
| Submission timestamp | While the child’s account exists; on deletion, kept without the child’s name | Activity history |
Anonymized, de-identified data derived from photos (aggregate completion rates, AI accuracy metrics) is not subject to COPPA’s retention requirements and may be retained indefinitely. Anonymized data is used only for system improvement, not for marketing or behavioral targeting.
| Data Type | Retention | Purpose |
|---|---|---|
| Quest assignments & completions | While the child’s account exists; on deletion, kept without the child’s name | Parent dashboard history |
| Evidence submission history | While the child’s account exists; on deletion, kept without the child’s name, with any evidence notes erased | Parent reference, dispute resolution |
| Parental override decisions | While the child’s account exists; on deletion, kept without the child’s name | Account management |
| Child device session logs | 90 days | Security, fraud detection |
| Login history | 90 days | Account security |
| Failed auth attempts | 30 days | Fraud detection |
| AI confidence scores (per child) | While the child’s account exists; on deletion, kept without the child’s name | AI accuracy measurement |
| Reward requests and goal | While the child’s account exists; deleted with it | Showing the child their usual rewards and how close they are to their goal; letting the Parent see what the child is working toward |
| Aggregate statistics | Indefinite | System health (anonymized) |
| Data Type | Retention | Purpose |
|---|---|---|
| Email address, name | Account lifetime | Account identification, notifications |
| OAuth tokens | Account lifetime | Authentication |
| Billing information | Per Stripe terms (typically 3 years) | Subscription management |
| Family relationships | Account lifetime | Account structure |
| Parental consent records | While the parent is in the family, then 3 years after the family is deleted or the parent leaves it | COPPA compliance |
Upon account deletion: soft delete (immediate), 30-day grace period, then hard delete of all data except consent records (3 years after the family is deleted or the parent leaves it) and audit logs (1 year). A child’s wallet is de-identified when the child’s account is deleted: the child’s name and each transaction’s description are removed, and the transaction amounts and dates and the wallet balance are kept without the child’s name, under an internal ID, with no deletion date. Only a consent the parent verified is kept; a consent request that was never verified is deleted.
| Data Type | Retention | Purpose |
|---|---|---|
| First name or nickname | Account lifetime | Account identification |
| Birth month and year | Account lifetime | Age eligibility, COPPA, AI personalization |
| Avatar customization | Account lifetime | Personalization |
| Device provisioning data | Duration of session | Child device authentication |
| Push notification token | Until logout or account deletion | Quest reminders, activity alerts |
Upon child account deletion: soft delete (immediate access block), 30-day grace period, then erasure. The child’s name, birth month and year, gender, avatar, timezone and any accommodations are erased, and so are photos, feedback, device sessions, PINs, push tokens, reward and wishlist data, quest conversations with parents, Hani’s notes, the child’s comments on quest tasks and any evidence notes submitted with the child’s quests. The child’s quest history and interests are kept without the child’s name, under an internal ID, for aggregate statistics, with the child’s first name replaced by a neutral word wherever it appears in a kept quest’s name, description or tasks. A family’s name belongs to the household and is not changed: if a family Admin named the family after the child, that name is kept. A reward the child shares with another child in the family is kept, with its name, description and picture, because the family is still using it; if its name came from the child’s own wishlist, the child’s name is removed from it. The child’s other photos, including wishlist photos, are erased. The child’s wallet is de-identified: the child’s name and each transaction’s description are removed, and the transaction amounts and dates and the wallet balance are kept without the child’s name, under an internal ID, with no deletion date. Exceptions: consent records (3 years after the family is deleted or the parent leaves it), audit logs (1 year).
Photos are transmitted to OpenAI’s Vision API for quest verification. OpenAI does not retain photos submitted via API calls. Rise Ohana maintains a Data Processing Agreement (DPA) prohibiting retention and secondary use of child photos. Photos are not used to train AI models.
Parent subscription billing only. No child data is shared with Stripe. Stripe retains billing information per its standard practices (typically 3–5 years).
Parent authentication only (Google, Apple, Microsoft). No child data is shared. Retention governed by each provider’s privacy policy.
Push notification delivery to parent and child devices. Only an app-specific push token is shared — no child names, photos, or quest data. Rise Ohana does not use Firebase Analytics, Crashlytics, or any other Firebase service. Tokens are deregistered on logout or account deletion.
Rise Ohana only shares child personal information with third parties when necessary to provide the service. All third parties processing child data are bound by Data Processing Agreements. No child data is sold or shared for advertising or behavioral targeting.
| Log Type | Retention | Purpose |
|---|---|---|
| Photo submission/deletion events | 1 year | Compliance audit |
| Parental consent records | While the parent is in the family, then 3 years after the family is deleted or the parent leaves it | COPPA legal compliance |
| Parent dashboard access logs | 90 days | Security, fraud detection |
| Account modification logs | 1 year | User support, dispute resolution |
| Administrative access logs | 1 year | Security, access control |
If Rise Ohana becomes aware of pending litigation, government investigation, or legal process, a litigation hold may be placed on affected data. Data under litigation hold is preserved until the legal matter concludes. Parents will be notified in writing unless prohibited by law.
Rise Ohana complies with government subpoenas, court orders, and regulatory requests. Retention periods in this policy do not apply when overridden by valid legal process.
Rise Ohana uses cloud-hosted databases with automated backups (daily and weekly, retained 30–90 days). Individual records cannot be deleted from backups on demand. All data is permanently purged from backups no later than 90 days after deletion from the primary database.
Contact: privacy@riseohana.com
Backups: Rise Ohana uses cloud-hosted databases with automated backups. Individual records cannot be deleted from backups on demand. Backups are purged per the provider’s standard retention schedule (up to 90 days).
Third-party data: Once data is shared with OpenAI or other third parties, Rise Ohana cannot delete it from their systems directly. Deletion is enforced via contractual Data Processing Agreements.
This policy is reviewed at least annually. Material changes (extending retention periods, adding new purposes, reducing parental rights) will be communicated to parents via email before taking effect. Minor clarifications do not require notification.
Last updated: October 9, 2026 (v1.3)
Related documents: Privacy Policy • Terms of Service