Privacy Policy

1. What We Collect

• Account info: Email, display name, and a hashed password (Argon2). We never store your plaintext password.
• Child profiles: Name and birthday, used solely to show age-appropriate activities.
• Activity data: Which todos you complete, snooze, or skip, so we can tailor daily suggestions.
• API keys: If you provide a Claude API key, it is encrypted at rest using Fernet symmetric encryption and only decrypted server-side when making API calls on your behalf.

2. How We Use Your Data

• To provide age-appropriate developmental activities and milestone tracking.
• To generate personalized daily todo suggestions (when an API key is provided).
• To maintain your session and preferences across visits.

3. What We Don't Do

• We do not sell, rent, or share your personal data with third parties.
• We do not use tracking cookies, analytics, or advertising.
• We do not send marketing emails (we don't collect email for marketing).

4. Cookies

We use a single essential session cookie (kinderbud_session) to keep you logged in. It expires after 30 days. No tracking or third-party cookies are used.

5. Third-Party Services

If you provide a Claude API key, your child's name, age, and activity data are sent to Anthropic to generate personalized suggestions. No data is shared with any other third party.

6. Data Storage & Security

• All data is stored in an encrypted SQLite database on our servers in Germany (Hetzner).
• All connections use HTTPS with TLS certificates managed by Caddy.
• Passwords are hashed with Argon2. API keys are encrypted with Fernet.

7. Your Rights (GDPR/CCPA)

You have the right to:

• Access your personal data at any time through the app.
• Correct your information through your account settings.
• Delete your account and all associated data from Settings.
• Object to processing of your data.

To exercise these rights, email privacy@kinderbud.org.

8. Children's Privacy

Kinderbud is designed for parents and guardians. We do not knowingly collect data from children directly. Child profile data (name, birthday) is entered by the parent.

9. Changes

We may update this policy from time to time. Material changes will be communicated through the app.

10. Contact

Questions? Email privacy@kinderbud.org.