Privacy Policy

Effective Date: October 21, 2026

RiseOhana helps families turn household responsibilities into quests that kids actually want to do. That means your child's data passes through our hands. We take that seriously.

This page has two parts. Part 1 is a plain-English summary of what we collect, why, and what you can do about it. Part 2 is the full legal policy with every detail. Both parts say the same things — Part 1 just says them faster.

Who this is for: Parents and legal guardians of children under 13. You are our user. Your child participates through you.

Who we are: RiseOhana, Inc., a Delaware C-Corporation. We are the sole operator of the RiseOhana mobile app.

Questions? Email privacy@riseohana.com. We respond within 7 business days.

What We Collect

We only collect what the app needs to work. Here is what that looks like, based on how you and your child use RiseOhana.

When you create a parent account

Name and email address — from your sign-in provider (Google, Apple, or Microsoft)
Family name — a new family is named after your last name, or you are asked to name it when your sign-in gives us no last name, and a family Admin can change it to any name they choose. Every guardian in the family sees it, including a guardian from another household such as a co-parent: in the app (including at the top of the dashboards of a guardian who belongs to more than one family), on the family picker, in invitations, and on notifications if they belong to more than one family. On a device your family shares, the screen where your child chooses who is playing shows it too.
Authentication tokens — generated automatically to keep you signed in

When you add a child

First name or nickname — you choose what to share
Birth month and year only — we do not collect the full date of birth. We use this for age eligibility and to tailor quest difficulty to your child's developmental stage.
Avatar: your child's look in the app, either one of our ready made avatars or a cartoon avatar made from a photo you or your child take or choose. We keep the cartoon avatar. We do not keep the original photo.

When your child completes a quest

Photo evidence — your child submits a photo showing the completed task
AI verification result — the photo is analyzed by OpenAI to check if the quest was done (see “Who Sees Your Data” below)
Quest activity data — assignment, completion timestamps, your review decisions

When your child chats with Hani

Chat messages — your child can talk with Hani, our in-app AI coach, for example to plan a quest to propose to you. Each message is first checked for harmful content by OpenAI’s moderation service, which receives it as typed. Names of family members we know are then replaced with placeholders before the conversation goes to OpenAI to write Hani’s reply. We do not store these chats.
Hani’s notes about your child — short notes about what Hani has learned (for example interests, strengths, and family context such as a pet’s name), including things a parent tells Hani about your child. Hani uses them to stay consistent between chats. They are not shown on any screen. Hani’s notes belong to your child, not to a household. If your child is in two families (for example, one for each parent’s home), Hani uses the same notes when a guardian in either family talks about your child, including notes that came from what a parent in the other household told Hani. A family Admin or Editor can erase Hani’s notes in the app (Data & Privacy > Reset Hani’s Memory), and erasing them removes them for every family your child belongs to. A family Admin or Editor may also ask us to erase them by emailing privacy@riseohana.com.

When your child earns rewards

Points and allowance amounts — calculated by the app when you approve a quest
Wallet balance and transaction history — visible to you in the parental dashboard
Reward requests and goal — the rewards your child asks for (including ones you decline) and the one reward they pick as their goal

When your child uses their own device

Session token and encrypted setup code — generated when you scan a QR code to set up the child's device
PIN hash — your child's PIN is hashed; we never store the actual PIN
Push notification token — a Firebase Cloud Messaging (Android), Amazon Device Messaging (Fire tablets), or Apple Push Notification (iOS) token so we can send quest reminders and activity alerts to your child's device. This token is app-specific, changes on reinstall, and is deregistered when your child logs out.

These are session-scoped or app-scoped identifiers, not persistent hardware identifiers.

Automatically

Device session logs — kept for 90 days for security and troubleshooting, then deleted
Diagnostic logs — only when you or your child taps “Send Feedback”, never in the background. A feedback report includes recent in-app activity logs, an optional screenshot, and basic device details (make, model, operating system version, app version) so we can reproduce the problem. Feedback from a child is held for a parent to review before anyone at RiseOhana can see it.
Install source — on Android and Fire tablets, the app reads a short marketing code the app store hands it the first time it ever runs, showing which of our own pages or campaigns led to the install. It carries no personal information, is not a persistent device identifier, and is read once, before you sign in. There is no equivalent on iOS.

What We Don't Collect from Kids

This matters. RiseOhana does not collect any of the following from children:

Email addresses
Physical addresses
Phone numbers
Social Security numbers or government IDs
Precise geolocation
Persistent device identifiers (IMEI, MAC address, IDFA, AAID)
Behavioral advertising profiles or interest-based tracking data

We do not serve ads to children. The app is ad-free for kids.

Who Sees Your Data

We share data only with the service providers listed below. That’s it — no data brokers, and the app itself contains no ad networks or analytics SDKs. Our public website is separate and does use analytics; see Our Website below.

OpenAI — Quest Photo Verification & AI-Assisted Authoring

When your child submits a quest photo, it goes to OpenAI's Vision API for automated analysis. OpenAI receives: the photo, the quest description, and your child's age range. OpenAI does not receive your child's name, your name, or any contact information. OpenAI retains photos for up to 30 days for abuse monitoring, then deletes them. They do not use photos to train AI models. We have a Data Processing Agreement in place.

If you use the optional AI-assisted authoring feature, the messages you type to our assistant go to OpenAI to generate quest suggestions. Your child's name is removed (replaced with a placeholder) before those messages are sent. OpenAI processes them as a service provider — it does not train on them or sell them. This is your own data as an adult, not your child's.

If you or your child create a custom avatar, the photo goes to OpenAI to be turned into a cartoon avatar. We do not keep the original photo; we keep only the finished cartoon. OpenAI keeps the photo for up to 30 days for abuse monitoring, then deletes it, and does not use it to train AI models.

Why this isn't optional: AI quest verification is how RiseOhana works — it's how the app checks whether the task was actually done. This is a core part of the service, like how Stripe processes payments.

Stripe — Payment Processing (Parent Only)

Stripe handles subscription billing. They receive your payment method and billing info. They do not receive any child data — no photos, no quest data, no child names.

OAuth Providers — Sign-In (Parent Only)

Google, Apple, or Microsoft handle your sign-in. They provide us your name and email. They do not receive any child data.

Firebase Cloud Messaging — Push Notifications (Parent and Child)

Google's Firebase Cloud Messaging (FCM) delivers push notifications to both parent and child devices. FCM receives a device-specific push token, internal record identifiers the app uses to open the right screen, and the notification's text. Notifications about your child use generic wording (e.g., “You have a quest waiting!”) and never include your child's name, photos, quest or reward names, point balances, or anything your child typed. Two kinds of notification to parents name a family. The first is an invitation to join a family, sent only to the invited adult, which shows the inviting parent's first name and the family's name. The second: if you are a parent in more than one family, notifications begin with the name of the family they concern, so you can tell households apart. A family's name is free text: a new family is named after the parent's last name, or a name the parent was asked for when we had no last name, and a family Admin can change it to anything they choose, so it may contain a surname or other words the Admin chose. Parents in only one family never see a family name on other notifications, and no notification sent to a child's device includes a family name. We use FCM solely for notification delivery — not for Firebase Analytics, crash reporting, or any other Firebase service.

Amazon Device Messaging — Push Notifications on Fire Tablets (Parent and Child)

If your family uses the App on an Amazon Fire tablet, Amazon Device Messaging (ADM) delivers push notifications to that tablet, in place of Firebase. ADM receives a device-specific push token that Amazon itself issued, an internal identifier for the child the notification is about, the kind of notification it is, and a generic title and body (e.g., “You have a quest waiting!”), and, if you are a parent in more than one family, the family's name and internal identifier (see Firebase above). ADM does not receive your child's name, quest or reward names, photos, point balances, or anything either of you typed other than a family's name. We use ADM solely for notification delivery on Fire tablets — nothing else.

If a Fire tablet is offline, Amazon holds the undelivered notification in its queue for up to 7 days before discarding it. There is no way for us to recall a notification already queued at Amazon, so a deletion request cannot reach one. It expires on its own within 7 days.

Email Provider — Notifications (Parent Only)

We use an email service to send you transactional messages (consent verification, account notifications). Your child's first name may appear in these emails in context (e.g., “You approved Emma's quest”). Children do not receive email from RiseOhana.

Customer.io — Parent Account Emails and Usage Insight (Parent Only)

Customer.io receives your name, email, sign-in provider, when you joined, your subscription status, and counts of your activity (for example, how many children you have added and how many quests you have created). It does not receive your child’s name, age, photos or profile, and children never have a Customer.io profile. When you delete your account we tell Customer.io to delete your profile.

That's the complete list.

The RiseOhana app does not use: Firebase Analytics, behavioral analytics (Mixpanel, Amplitude), crash reporting SDKs (Sentry, Crashlytics), advertising SDKs, social media plugins, or data brokers.

Our Website

Our public website — the pages you can visit without signing in — uses Google Analytics, loaded through Google Tag Manager. It records the pages visited, the browser and device type, and the approximate location derived from the IP address. Some pages also carry advertising conversion tags from Google and Reddit, which tell us when a visit led to an app install.

This is ordinary website analytics about visitors. It is not connected to your account, and it never receives child data — no names, photos, quest activity or wallet information. Signing in, resetting a password and confirming an email address all happen on pages that carry no analytics at all.

The setup page a parent opens on a child’s device deliberately omits the advertising conversion tags that our other pages carry.

On Android and Fire tablets, the app itself also reports back — once, before you sign in — whether a store visit actually became an install and which page or campaign it came from, using the install source described in “What We Collect” above. This is not available on iOS.

Cookies and Do Not Track

Our website uses cookies — small files your browser keeps for a site. Google Analytics sets cookies that tell one visit from a return visit, and on the pages that carry them, the Google Ads and Reddit conversion tags set cookies that tell us when an ad led to a visit or an install. We set one cookie of our own, which remembers for 24 hours which link or campaign brought you to the site. It holds only that — nothing about you.

Because these tags load on our pages, Google and Reddit can collect information about your visit and may combine it with what they collect about you on other websites over time. You can block or delete cookies in your browser’s settings; the website still works without them. The RiseOhana app does not use cookies for analytics or advertising.

If you visit from the European Union, the UK or Switzerland, we ask first: these cookies, including our own, are set only after you accept them, and you can change your answer at any time with the “Cookies” button at the bottom of the page. We judge where you are from your device’s time zone.

Our website does not currently respond to “Do Not Track” signals sent by web browsers, because there is no agreed standard for what such a signal should do.

How Long We Keep It

Data	Retention	Then What
Child photos	30 days, unless you choose to keep them (below)	Auto-deleted
Photo metadata (AI score, timestamps)	Kept while your child’s account exists	On deletion, kept without your child’s name (Section 5.4)
Quest activity data	Kept while your child’s account exists	On deletion, kept without your child’s name (Section 5.4)
Device session logs	90 days	Auto-deleted
Feedback reports (logs, screenshot, device details)	Until resolved, or until the child or account is deleted	Blob and message erased
Push notification tokens	Until logout or account deletion	Deregistered and deleted
Wallet & transaction history	Kept while your child’s account exists	When your child’s account is deleted, the wallet is de-identified: your child’s name and each transaction’s description are removed, and the amounts, dates and balance are kept without your child’s name, under an internal ID, with no deletion date
Reward requests and goal	Kept while your child’s account exists	Deleted when your child’s account is deleted
Parental consent records (consents you verified)	While you are a parent in the family, then 3 years after the family is deleted or you leave it	Retained for COPPA compliance. A consent request that was never verified is deleted, not kept.
Child profile data	Account lifetime	Deleted when account is deleted
Parent account data	Account lifetime	Deleted when account is deleted

Keeping photos as a family keepsake is your choice. In the app’s data and privacy settings, a parent can turn on “Keep all photos forever” to keep your child’s photos as a family keepsake archive. It is off unless a parent deliberately turns it on. While it is on, we keep the photos for that one purpose — so your family can look back on them — instead of deleting them after 30 days. We keep them only while the setting is on and your child’s account exists: turning the setting off, deleting a photo, or deleting your child’s profile or your account ends it. When you turn the setting off, photos go back on the 30-day schedule, and any already older than 30 days are deleted 30 days later.

Backups: After data is deleted from our primary systems, it may persist in automated backups for up to 90 additional days. Backups are used only for disaster recovery.

Your Rights as a Parent

Under COPPA, you have strong rights over your child's data. We honor all of them, promptly and without charge.

Review — See everything we've collected about your child. In-app: Parental Dashboard > Child Data & Privacy. Or email us.
Delete — Request deletion of specific photos, specific data categories, or the entire child account and all associated data. We process deletions within 24 hours.
Stop collection — Refuse further collection at any time. Your child's account goes read-only.
Withdraw consent — Revoke your consent entirely. Processed within 48 hours.
Get a copy — Request a portable export (CSV or JSON) of your child's data. Delivered within 30 days.
No penalty — We will never deny service, charge extra, or reduce quality because you exercised your rights.

How to reach us

In-App	Parental Dashboard > Child Data & Privacy
Email	privacy@riseohana.com
Phone	[To be added]

Security

All data encrypted in transit (HTTPS/TLS) and at rest (database-level encryption)
Passwords and PINs hashed with BCrypt
Role-based access controls — the app shows a parent one family at a time. A child who belongs to two families (for example, one per household) appears in both, and guardians in either family see that child’s full RiseOhana history.
Child sessions are temporary and session-based
Third-party providers vetted and bound by contractual data processing terms — including a Data Processing Agreement with OpenAI
Access to child data is logged for compliance and security review

No security system is perfect. In the event of a breach affecting children's data, we will notify you and applicable regulators as required by law.

Changes to This Policy

If we make a material change — new data collection, new third parties, changed retention periods — we will:

Email you before the change takes effect
Post the updated policy in the app and on our website
Get new parental consent where COPPA requires it — a change that needs your consent will not take effect until you give it

Read the Full Privacy Policy

RiseOhana, Inc. Privacy Policy

Directed to Children Under 13 — COPPA-Compliant Disclosure

This Privacy Policy describes how RiseOhana, Inc. (“RiseOhana,” “RO,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information from users of the RiseOhana mobile application (the “App”), including personal information collected from children under the age of 13 (“Child Users” or “children”). RiseOhana is committed to protecting the privacy and safety of all users, and particularly children, in compliance with the Children's Online Privacy Protection Act (“COPPA”), 15 U.S.C. §6501–6506, and its implementing regulations at 16 C.F.R. Part 312, as amended (effective 2026).

This Privacy Policy is intended to be read by parents and legal guardians (“Parents”) of Child Users. If you are a Parent, please read this Privacy Policy carefully before allowing your child to use the App. By providing verifiable parental consent, you acknowledge that you have read and understood this Privacy Policy and consent to the data practices described herein.

1. Operator Information

RiseOhana, Inc. is a Delaware C-Corporation that operates the RiseOhana mobile application. RiseOhana is the sole operator of the App and is responsible for all data collection and processing described in this Privacy Policy.

Company Name	RiseOhana, Inc.
Incorporation	State of Delaware, United States
Privacy Contact Email	privacy@riseohana.com
Phone	[To be added]
Mailing Address	[To be added]

For questions or concerns about this Privacy Policy or our data practices, Parents may contact us at privacy@riseohana.com. We will respond within seven (7) business days.

2. Information We Collect

RiseOhana collects personal information from both Parents and Child Users. This section describes, in detail, all categories of personal information collected.

2.1 Information Collected from Parents

Data Category	Specific Data Elements	Collection Method
Account Information	Name, email address	Provided via OAuth sign-in (Google, Apple, or Microsoft)
Authentication Data	OAuth tokens, refresh tokens	Generated during OAuth authentication
Family Information	Family name, parent-child relationships, each guardian’s role (Admin, Editor or Viewer)	Family name set to the creating Parent’s last name, or typed by that Parent when we had no last name, and changeable by a family Admin to any name they choose; relationships and roles set by Parents
Billing Information	Subscription status, payment method tokens, billing history	Processed by Stripe (see Section 4.2)
Parental Consent Records	Consent status, consent method, date of consent, data elements consented to	System-generated during VPC process
AI Authoring Data (Parent)	The Parent's authoring-conversation messages; short derived notes about the Parent (stated parenting values, goals, or focus)	Parent-provided during an optional AI-assisted authoring session

Note: RiseOhana does not store credit card numbers or detailed payment instrument data. All payment information is processed and stored by Stripe, our third-party payment processor.

2.2 Information Collected from Child Users

RiseOhana collects the following personal information from children under 13, subject to verifiable parental consent:

Data Category	Specific Data Elements	Collection Method	Purpose
Child Profile Information	Child's first name or nickname	Parent-provided during child account setup	Account identification and personalization
Birth Month and Year	Month and year of birth only	Parent-provided during child account setup	Age eligibility verification and COPPA compliance
Photos	Photographs submitted as evidence of quest completion	Child-submitted via device camera or photo gallery	Quest verification (AI-powered and parental review)
Quest Activity Data	Quest assignments, completion records, submission timestamps, AI verification results, parental override decisions	System-generated during App use	Quest management, parental dashboard, activity tracking
Wallet and Transaction Data	Points earned, allowance amounts, wallet balance, transaction history	System-generated upon quest approval	Allowance and reward management
Reward Activity	The rewards the child asks for (including requests a parent declines) and the one reward the child chooses as their goal	Child-initiated in the App	Showing the child their usual rewards and how close they are to their goal; letting the Parent see what the child is working toward
Device Session Data	Session tokens, setup codes (encrypted), PIN hash	System-generated during device provisioning via QR code	Child device authentication
Push Notification Token	FCM, APNs or ADM token, device fingerprint, platform type	System-generated during app initialization with device permission	Delivering quest reminders, activity alerts, and family notifications
Avatar Customization	Avatar selection, background color preference and, if you or your child create a custom avatar, the cartoon avatar made from the photo. The original photo is not kept.	Child or Parent-provided	Personalization
Diagnostic and Feedback Data	In-app activity logs, optional screenshot, device make, model, operating system version, app version	Child-initiated, only on explicit submission of a feedback report	Diagnosing and fixing defects the child encountered — support for the internal operations of the service

Data Minimization: We collect your child's birth month and year only to verify age eligibility. We do not collect the exact date of birth.

What We Do NOT Collect from Children:

We do not collect email addresses from children.
We do not collect physical addresses from children.
We do not collect telephone numbers from children.
We do not collect Social Security numbers or government identifiers from children.
We do not collect precise geolocation data.
We do not collect persistent device identifiers (such as IMEI, MAC address, IDFA, or AAID).
We do not use behavioral advertising, interest-based tracking, or profiling of children for marketing purposes.

2.3 Install Attribution Data (Android and Fire Tablet Installations)

On Android and Fire tablets, the App reads and reports one additional value on its very first launch, before any Parent or Child account exists:

Data Category	Specific Data Elements	Collection Method	Purpose
Install Attribution Code	A short marketing-source code identifying which of our own website pages or campaigns the visitor came from (for example, a blog post or a specific ad). Contains no personal information and is not a persistent device identifier (not an IMEI, MAC address, IDFA, or AAID).	Provided to the App by the Google Play Store or the Amazon Appstore on the App's first launch after installation, before sign-in	Measuring which marketing source led to an install, so install counts can be compared against website click counts

This value is not collected on iOS, which has no equivalent mechanism. It is never linked to a Parent account, a Child User, or any other personal information collected under Sections 2.1 or 2.2 of this Policy.

3. How We Use Information

RiseOhana uses the personal information described in Section 2 solely for the purposes stated below. We do not use children's personal information for any purpose not disclosed in this Privacy Policy.

3.1 Purposes for Child Data

Data Category	How We Use It
Child's Name	To identify the child within the family account; to display the child's name on quests and in the parental dashboard
Birth Month and Year	To verify age eligibility; to support COPPA age-gating; to personalize AI quest generation appropriate to the child's developmental stage
Photos	To verify quest completion through AI-powered analysis (see Section 4.1); to display quest evidence to the Parent for review; to maintain a record of quest completion during the retention period; if a Parent asks, to keep them as a family keepsake archive (Section 5.2)
Quest Activity Data	To operate the quest system (assignment, tracking, and completion); to display activity history in the parental dashboard; to calculate trust metrics (AI accuracy measurement)
Wallet and Transaction Data	To manage the child's allowance and point system; to provide transaction history to Parents
Reward Activity	To show the child their usual rewards and how close they are to their goal; to let the Parent see what the child is working toward
Device Session Data	To authenticate the child's device session; to maintain secure access during active sessions. Session data is temporary and is not used for tracking
Push Notification Token	To deliver quest reminders, activity alerts, and family notifications to the child's device. Not used for advertising, analytics, or tracking. Deregistered on logout and deleted on account deletion
Avatar Customization	To personalize the child's in app experience. A photo used to create a custom avatar is used only to make the cartoon avatar and is not kept.

3.2 Purposes for Parent Data

Data Category	How We Use It
Account Information	To identify and authenticate the Parent's account; to send notifications and communications related to the child's activity
Family Information	To establish and maintain parent-child relationships within the App; to show each guardian which family they are viewing and, for Parents in more than one family, which family a notification concerns
Billing Information	To process subscription payments through Stripe; to manage subscription status
Parental Consent Records	To document compliance with COPPA; to maintain a verifiable record of parental consent
AI Authoring Data (Parent)	To power the optional AI-assisted authoring feature (generate Quest suggestions from the Parent's own description) and to provide continuity across sessions via a small set of Parent-private notes. Processed by OpenAI as a service provider (see Section 4.1). Not used for advertising, profiling, or AI model training. Parent notes are private to the individual Parent and can be viewed and deleted in-app.

3.2(b) Install Attribution Data

The Install Attribution Code described in Section 2.3 is used solely to measure which marketing source led to an app install, so that install counts can be compared against website click counts. It is never linked to a Parent account or a Child User, never used to identify or contact anyone, and never used for advertising or profiling.

3.3 Prohibited Uses

RiseOhana does not use personal information collected from children for any of the following purposes:

Behavioral advertising or interest-based targeting of children
Sale of personal information to any third party for any purpose
Profiling of children for marketing or commercial purposes
Training of artificial intelligence models using children's personal information
Manipulative design patterns (“dark patterns”) that encourage children to provide more personal information or engage in excessive app usage

4. Third-Party Service Providers

RiseOhana shares personal information with the following third-party service providers solely to operate the App and provide the services described in this Privacy Policy. We do not sell, rent, or otherwise disclose children's personal information for marketing, advertising, or any purpose unrelated to the operation of the App.

4.1 OpenAI — AI-Powered Quest Verification

Provider: OpenAI, L.L.C.
Location: United States
Purpose: AI-powered quest verification is a core component of the RiseOhana service. When a child submits a photo as evidence of quest completion, the photo is transmitted to OpenAI's Vision API for automated analysis.

Data Shared with OpenAI:

Photo submitted by the child (image data)
Quest completion criteria (text description of the task)
Child's age range (derived from birth month and year)
Photo used to create a custom avatar (image data), used only to make the cartoon avatar

Data NOT Shared with OpenAI:

Child's name
Child's exact birth date (only age range is shared)
Parent's name, email, or contact information
Payment or billing information
Device identifiers

OpenAI's Obligations: RiseOhana maintains a Data Processing Agreement (“DPA”) with OpenAI that contractually requires OpenAI to: (a) process photos solely for the purpose of providing AI analysis as requested by RiseOhana; (b) not use photos to train, fine-tune, or improve its AI models; and (c) maintain appropriate security measures.

Photo Retention by OpenAI: After processing, OpenAI retains photos for up to thirty (30) days for trust and safety monitoring (abuse and misuse detection), after which the photos are automatically deleted.

Per-Record Deletion Limitation: If you request deletion of a specific photo, RiseOhana will delete it from our primary systems within 24 hours. However, if the photo was previously transmitted to OpenAI, RiseOhana cannot instruct OpenAI to delete that specific photo from its 30-day abuse-monitoring retention. The photo will be automatically deleted from OpenAI's systems no later than 30 days after original submission.

Avatar photos: RiseOhana does not keep the original photo used to create a custom avatar, so there is nothing to delete from our systems. You can change or delete the cartoon avatar at any time, and it is deleted with your child's account. A photo already sent to OpenAI is deleted from OpenAI's systems no later than 30 days after it was sent.

4.1(b) OpenAI — AI-Assisted Authoring (Parent Data)

Purpose: When a Parent uses the optional AI-assisted authoring feature, the Parent's authoring messages — and a small set of short, Parent-private notes derived from them — are transmitted to OpenAI to generate Quest suggestions and to provide continuity across sessions.

Data Shared with OpenAI:

The Parent's authoring-conversation messages
The short derived Parent notes (stated parenting values, goals, or focus)
Limited non-identifying context (child age range, placeholder labels) used to tailor the suggestion

Data NOT Shared with OpenAI:

Child's name or child-identifying details (removed and replaced with placeholders before transmission)
Child's exact birth date
Parent's email or contact information
Payment or billing information

OpenAI's Obligations: The same Data Processing Agreement described in Section 4.1 applies — OpenAI processes this data solely to provide the requested assistance, does not use it to train, fine-tune, or improve its AI models, does not sell or commercially transfer it, and maintains appropriate security measures. OpenAI acts as a data processor and does not independently collect personal information.

Retention: Consistent with OpenAI's published API data policy, data submitted to the OpenAI API is not used to train or improve OpenAI's models. OpenAI retains these authoring requests for up to thirty (30) days for abuse-monitoring purposes, after which they are automatically deleted — the same window that applies to Quest photos (Section 4.1).

Consenting Adult's Own Data: This flow processes the Parent's own data as a consenting adult — not the child's. Child names and child-identifying details are removed before any authoring message is sent to OpenAI.

4.2 Stripe — Payment Processing

Provider: Stripe, Inc.
Location: United States
Purpose: Subscription billing and payment processing for Parent accounts.

Data Shared: Parent's payment method information, subscription status, billing events, parent's name and email.

Data NOT Shared: Any Child User personal information, photos, quest data, or activity data.

Stripe processes payment data in compliance with PCI-DSS standards. Stripe typically retains billing records for 3–5 years.

4.3 OAuth Authentication Providers — Google, Apple, Microsoft

Purpose: Parent account authentication via OAuth 2.0.

Data Shared: Authentication requests and tokens (standard OAuth protocol).

Data Received: Parent's email address and name (for account creation).

Data NOT Shared: Any Child User personal information, photos, quest data, or activity data.

4.4 SMTP Email Service — Transactional Communications

Purpose: Sending transactional emails to Parents (consent verification, account notifications, deletion confirmations).

Data Processed: Parent email address; email content that may include the child's first name in context.

Data NOT Processed: Children do not receive email from RiseOhana.

4.5 Firebase Cloud Messaging — Push Notifications

Purpose: Delivering push notifications to Parent and Child devices (quest reminders, reward alerts, system messages).

Data Shared: App-specific push notification token (FCM registration token for Android; APNs device token for iOS); notification payload (title, body, category); internal, randomly generated identifiers for the child and the record the notification refers to. For a Parent who belongs to two or more families, also: the family's name at the start of the notification text, and the family's internal identifier with its name alongside it. The device uses the identifier to group notifications by family (on iOS, as the notification's thread identifier).

Data NOT Shared: A child's name, photos, quest or reward names, wallet data, point balances, or any text written by a child. Notifications about a child use generic prompts. Family names appear only on notifications to Parents: on an invitation to join a family, and on notifications to a Parent who belongs to more than one family. A family's name is free text: a new family is named after the creating Parent's last name, or a name that Parent was asked for when we had no last name, and a family Admin can change it to anything they choose, so it may contain a surname or other words the Admin chose.

Token Lifecycle: Push tokens are registered when the app is installed and notification permission is granted; deregistered on logout; deleted from RiseOhana servers on account deletion or anonymization. Tokens are app-specific identifiers — they are not persistent hardware identifiers (IMEI, AAID, IDFA) and cannot be used to track a child across apps or services.

Firebase Data Processing: Google’s Firebase Cloud Messaging acts as a message relay. Google’s FCM data processing terms apply. RiseOhana does not use Firebase Analytics, Firebase Crashlytics, or any other Firebase service.

4.5(b) Amazon Device Messaging — Push Notifications (Fire Tablets)

Provider: Amazon.com Services LLC
Location: United States
Purpose: Delivering push notifications to devices running the Amazon Appstore build of the App (Amazon Fire tablets). Firebase Cloud Messaging is not available on those devices; Amazon Device Messaging (“ADM”) is the only push transport they have. RiseOhana uses ADM for notification delivery and for nothing else.

Data Shared with Amazon:

The ADM registration identifier for the device — an opaque, app-specific token that Amazon itself issued to that installation
An internal, randomly generated identifier for the child the notification concerns — not the child’s name, and meaningless outside RiseOhana’s own systems
The category of the notification (for example, that a quest is waiting for review)
Internal, randomly generated record identifiers for the quest, reward or negotiation the notification refers to
A generic notification title and body
For a Parent who belongs to two or more families only: the name and internal identifier of the family the notification concerns

Data NOT Shared with Amazon:

Child’s name or nickname
Quest names, reward names, or wishlist item names
Photos
Point balances, allowance amounts, or wallet and transaction data
Any free text written by the child or the Parent, other than a family’s name as described above
Child’s birth month and year
Parent’s name, email, or contact information
Payment or billing information

Notification titles and bodies are deliberately generic (for example, “You have a quest waiting!”). This is an enforced rule of the App rather than a property of the notifications that happen to exist today: no push notification RiseOhana sends carries a child’s name, a photo, a quest or reward name, a balance, or text a child or Parent wrote, on any platform, other than a family’s name. Family names appear only on notifications to Parents, as described in Section 4.5.

Message Retention by Amazon: When a Fire tablet is offline, ADM queues the undelivered notification for up to seven (7) days, after which Amazon discards it.

Per-Record Deletion Limitation: Amazon Device Messaging provides no interface for recalling a notification that has already been queued for delivery. If you request deletion while a notification is queued, RiseOhana will delete the underlying data from our primary systems within 24 hours but cannot retract that queued notification; it expires on its own no later than seven (7) days after it was sent. The same limitation applies to a notification a device has already received, which is then held by the device’s operating system and is outside RiseOhana’s reach.

Token Lifecycle: ADM registration identifiers follow the same lifecycle as the FCM and APNs tokens described in Section 4.5 — registered when notification permission is granted, deregistered on logout, and deleted from RiseOhana servers on account deletion or anonymization. They are app-specific identifiers — they are not persistent hardware identifiers (IMEI, AAID, IDFA) and cannot be used to track a child across apps or services.

Amazon Data Processing: Amazon Device Messaging acts as a message relay, under Amazon’s developer terms for that service. RiseOhana does not use Amazon Advertising, Amazon Analytics, or any other Amazon service, and no child or Parent data reaches Amazon other than what is listed above.

4.6 Website Analytics

Purpose: Measuring traffic to the public marketing website and attributing app installs to their source.

Data Processed: Page URL, referring page, browser and device characteristics, and approximate location derived from IP address, collected by Google Analytics through Google Tag Manager. Certain pages additionally load advertising conversion tags, including Google Ads and Reddit.

Scope: The public website only. The RiseOhana app integrates no advertising networks, ad SDKs, behavioral analytics platforms, crash reporting SDKs, social media plugins or data brokers. Authentication pages carry no analytics. On Android and Fire tablets, the App itself separately reports whether a store visit became an install; see Section 2.3.

Data NOT Processed: No child data of any kind — no names, photographs, quest activity, wallet balances or account identifiers. Website analytics is not linked to a RiseOhana account.

Cookies: The public website uses cookies. Google Analytics sets cookies to distinguish visits; on pages that load them, the Google Ads and Reddit conversion tags set cookies to attribute visits and app installs to advertising. RiseOhana sets one first-party cookie that records, for 24 hours, the marketing link or campaign that referred the visitor, and contains no other information. Through these tags, Google and Reddit may collect information about a visitor’s activity on the website and combine it with information about that visitor’s activity on other websites over time. Visitors may block or delete cookies through their browser settings without losing access to the website. The App does not use cookies for analytics or advertising.

Consent in the EU, EEA, UK and Switzerland: For visitors whose device time zone places them in the European Union, the European Economic Area, the United Kingdom or Switzerland, the analytics, advertising and referral cookies described above are set only after the visitor accepts them, and the visitor may withdraw or change that choice at any time through the “Cookies” control shown on each page. Withdrawing consent removes those cookies from the visitor’s browser.

Do Not Track: The website does not currently respond to “Do Not Track” browser signals, as no uniform standard for interpreting them has been adopted.

4.7 No Other Third Parties

Beyond the providers listed above, RiseOhana does not integrate data brokers, crash reporting SDKs or social media plugins.

Push notifications are relayed by Google, through Firebase Cloud Messaging and Apple Push Notification service, and by Amazon, through Amazon Device Messaging on Fire tablets. No other push provider receives data from RiseOhana.

5. Data Retention and Deletion

RiseOhana retains personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected.

5.1 Retention Schedule

Data Category	Retention Period	Justification
Child Photos	30 days from submission, unless a Parent asks us to keep them as a family keepsake archive (Section 5.2)	Parent review, quest verification, dispute resolution
Photo Metadata	Kept while your child’s account exists; on deletion, kept without your child’s name (Section 5.4)	Parental activity history, accuracy measurement, aggregate statistics
Quest Activity Data	Kept while your child’s account exists; on deletion, kept without your child’s name (Section 5.4)	Parental dashboard history, activity tracking, aggregate statistics
Device Session Logs	90 days	Security, fraud detection, user support
Push Notification Tokens	Active session lifetime	Deregistered on logout; deleted on account deletion/anonymization
Wallet and Transaction History	Kept while the child’s account exists; on deletion, the wallet is de-identified: the child’s name and each transaction’s description are removed, and the transaction amounts and dates and the wallet balance are kept without the child’s name, under an internal ID, with no deletion date (Section 5.4)	Allowance and reward management, parental dashboard history, aggregate statistics
Reward Activity	Until the child’s account is deleted	Showing the child their usual rewards and how close they are to their goal; letting the Parent see what the child is working toward
Parental Consent Records (verified consents)	While the Parent is in the family, then 3 years after the family is deleted or the Parent leaves it	COPPA compliance documentation
Audit Logs	1 year	Compliance audit and security
Install Attribution Code (Section 2.3)	Not linked to an account; retained as aggregate marketing measurement data	Marketing effectiveness measurement
Child Profile Data	Account lifetime	Account operation
Parent Account Data	Account lifetime	Account operation

5.2 Automatic Deletion

Photos are automatically deleted from the primary database 30 days after submission, unless a Parent has asked us to keep the family’s photographs as a keepsake archive.
Family keepsake archive. A Parent may ask RiseOhana to keep the family’s photographs as a keepsake archive by turning on the App setting labelled “Keep all photos forever”. It is off by default and is turned on only by a Parent’s deliberate action. While it is on, the family’s photographs are retained for that purpose alone — so the family can look back on them — rather than deleted on the 30-day schedule, and only for as long as the setting remains on and the Child User’s account exists. Turning the setting off returns each photograph to the 30-day schedule, and no photograph is deleted sooner than 30 days after the setting is turned off. Deletion of a specific photograph, of a Child User’s account or of the Parent’s account ends that retention regardless of the setting.
Session logs are automatically purged after 90 days.

5.3 Backup Retention

After data is deleted from the primary database, it may persist in automated backups for up to 90 days. Backups are used only for disaster recovery. RiseOhana cannot delete individual records from backups on a per-record basis.

5.4 Account Deletion

When a Parent requests deletion of a child's account:

Immediate: The child's account is soft-deleted. Device access is revoked.
30-Day Grace Period: Data is retained to allow account restoration.
Erasure (30 days): Your child’s name, birth month and year, gender, avatar, timezone and any accommodations are erased. So are photos, feedback, device sessions, PINs, push tokens, reward and wishlist data, quest conversations with parents, and Hani’s notes, and the text written on your child’s quests: the comments your child wrote on quest tasks and any evidence notes submitted with their quests. The child’s quest history and interests are kept without the child’s name, under an internal ID, for aggregate statistics: wherever your child’s first name appears in a kept quest’s name, description or tasks, it is replaced with a neutral word. A family’s name belongs to the household, not to your child, and is not changed: if a family Admin named the family after your child, that name is kept. A reward your child shares with another child in the family is kept, with its name, description and picture, because the family is still using it; if its name came from your child’s own wishlist, your child’s name is removed from it. Your child’s other photos, including wishlist photos, are erased.
Backup Purge (up to 90 days after): Data is purged from automated backups.

Exceptions: Parental consent records (3 years after the family is deleted or the Parent leaves it) and audit logs (1 year) are retained beyond account deletion for legal compliance. Only a consent the Parent verified is kept; a consent request that was never verified is deleted. Your child’s wallet is de-identified: your child’s name and each transaction’s description are removed, and the transaction amounts and dates and the wallet balance are kept without your child’s name, under an internal ID, with no deletion date.

5.5 How to Request Deletion

Method	Details	Timeline
In-App	Parental Dashboard > Child Data & Privacy > Delete Data	Within 24 hours
Email	Send request to privacy@riseohana.com	Within 24 hours of verification
Phone	[To be added]	Within 24 hours of verification

RiseOhana will send written confirmation within 7 calendar days, specifying the date and categories of data deleted.

6. Parental Rights Under COPPA

Under COPPA, Parents of Child Users have the following rights. RiseOhana honors these rights promptly and without charge.

6.1 Right to Review

Parents may review all personal information collected from their child: profile information, photos (during retention period), quest activity, wallet balance and transactions, AI verification results, and consent history.

How: Parental Dashboard > Child Data & Privacy, or email privacy@riseohana.com. Response within 30 days.

6.2 Right to Request Deletion

Parents may request deletion of specific photos, specific data categories, or the entire child account and all associated data. See Section 5.5. Hani’s notes about a child can be erased in the app by a family Admin or Editor, or by a family Admin or Editor on request to privacy@riseohana.com.

6.3 Right to Refuse Further Collection

Parents may refuse further collection at any time. The child's account will be placed in read-only mode.

6.4 Right to Withdraw Consent

Parents may withdraw consent at any time in the App — Settings > Data & Privacy > Revoke Consent, or from a child’s settings, Data & Privacy > Revoke Consent — or by email. Processed within 48 hours.

6.5 Right to Data Portability

Parents may request a copy of their child's data in CSV or JSON format. Delivered within 30 days via secure download link.

6.6 No Conditioning of Services

RiseOhana does not condition a child's participation on disclosure of more information than is reasonably necessary.

7. Parental Consent

7.1 Verifiable Parental Consent Required

RiseOhana obtains verifiable parental consent (“VPC”) before collecting any personal information from a Child User, in compliance with COPPA Section 312.5.

7.2 How Consent Is Obtained

During child account creation, the Parent is presented with a detailed consent notice covering: data categories collected, purposes, third-party recipients, a link to this Privacy Policy, and parental rights under COPPA.

VPC Method	Description
Email Plus	RiseOhana sends a verification email. The Parent must respond to confirm consent, followed by confirmatory communication.

7.3 What Parents Consent To

Collection of child's first name/nickname, birth month and year, photos, quest activity data, wallet data, reward requests and the reward chosen as a goal, device session data, and avatar customization
Use of child's personal information for purposes described in Section 3
Sharing of photos with OpenAI for AI-powered quest verification
Sharing of photos with OpenAI to create a cartoon avatar, when you or your child choose to make a custom avatar
Sharing of a device push notification token, internal record identifiers, and a notification title and body that never contain your child's name with Firebase Cloud Messaging and Apple Push Notification service, and with Amazon Device Messaging on Fire tablets, for notification delivery, as described in Sections 4.5 and 4.5(b) (for Parents in more than one family, the family's name as described in Section 4.5)
Retention per the schedule in Section 5

7.4 Consent Records

RiseOhana maintains records of each verified parental consent (identity, date/time, method, data elements, status) while the Parent is in the family, then for 3 years after the family is deleted or the Parent leaves it. A consent request that was never verified is deleted, not kept.

8. Security

8.1 Technical Safeguards

Encryption in Transit: HTTPS/TLS for all data transmission
Encryption at Rest: Database-level encryption
Password Security: BCrypt hashing with salt
Access Controls: Role-based; the App shows a Parent one family at a time, and a child who belongs to two families appears in both, with their full RiseOhana history visible to guardians in either family; internal staff access limited and audited
Session Management: Temporary, session-based child device sessions via encrypted setup codes and JWT tokens

8.2 Organizational Safeguards

Data minimization (birth month/year, not full DOB)
Third-party vetting, with contractual data processing obligations in place — including a Data Processing Agreement with OpenAI (Section 4.1)
Audit logging of all actions on child personal information

8.3 Limitations

No security system is perfect. In the event of a data breach affecting children's personal information, RiseOhana will notify affected Parents and applicable regulatory authorities as required by law.

9. Changes to This Privacy Policy

9.1 Material Changes

For material changes, RiseOhana will: (1) notify Parents via email before the change takes effect; (2) post the updated policy; and (3) obtain new parental consent if required by COPPA. Material changes requiring new consent will not take effect for any user until that user’s Parent has provided updated consent.

9.2 Non-Material Changes

Non-material changes (typographical corrections, contact info updates) may be made without advance notice.

9.3 Continued Use After Changes

For material changes requiring new consent, Parents must affirmatively provide updated consent before the new data practices apply to their family. For material changes that do not require new consent, continued use of the App following notice constitutes acceptance of the updated Privacy Policy.

10. Contact Information

Privacy Contact Email	privacy@riseohana.com
Phone	[To be added]
Mailing Address	[To be added]
Response Time	Within 7 business days

10.1 Complaints

If you believe RiseOhana has violated your rights or your child's rights under COPPA, you may file a complaint with the Federal Trade Commission:

Website: ftc.gov
Phone: 1-877-FTC-HELP (1-877-382-4357)
Mail: Federal Trade Commission, 600 Pennsylvania Avenue, NW, Washington, DC 20580

11. Additional Disclosures

11.1 Children's Personal Information and Advertising

RiseOhana does not serve advertisements of any kind to Child Users. The App is advertisement-free for children.

11.2 No Sale of Personal Information

RiseOhana does not sell, rent, license, or otherwise commercially transfer personal information collected from children or Parents to any third party.

11.3 Anonymized and Aggregated Data

RiseOhana may create anonymized or aggregated data that can no longer identify a specific individual. Such data is not “personal information” under COPPA and may be used for product improvement, analytics, and reporting. RiseOhana commits that: (a) anonymization uses industry-standard de-identification methods; (b) anonymized data cannot be re-identified to a specific child; and (c) anonymized data is not shared with third parties for marketing or advertising.

11.4 International Users

RiseOhana is based in the United States and processes personal information in the United States.

11.5 California Residents

RiseOhana does not sell or share the personal information of any user, including minors, as defined under the CCPA/CPRA.

12. Definitions

“App” means the RiseOhana mobile application, available on iOS, Android and Amazon Fire tablets.
“Child User” or “child” means an individual under the age of 13 who uses the App under the supervision of a Parent.
“COPPA” means the Children's Online Privacy Protection Act, 15 U.S.C. §6501–6506, and its implementing regulations at 16 C.F.R. Part 312, as amended.
“Parent” means a parent or legal guardian of a Child User who holds an account on the App.
“Personal Information” has the meaning set forth in 16 C.F.R. Section 312.2.
“Quest” means a task or activity assigned by a Parent to a Child User within the App.
“Verifiable Parental Consent” or “VPC” means consent obtained from a Parent through a method reasonably calculated to ensure the person providing consent is the child's parent, per 16 C.F.R. Section 312.5.