Smarts — Privacy Policy

Last updated: 2026-10-12 Operator: Forever Green (LLC), contact neil@forevergreenapp.com

The short version

Smarts is built so there is very little to collect.

We ask for a child's nickname and age range. Not their name, birthdate, school, location, or photo.
Voice never leaves the phone. Speech becomes text on the device.
Homework photos are never stored, and a photo with a person in it is deleted before it is sent anywhere.
No ads, no advertising identifiers, no third-party analytics, no tracking.
Questions are deleted automatically after 90 days, and you can delete them sooner.

What we collect

From you, the parent

What	Why
Email address	To sign in, and to reach you about your account
Password	To sign in. Stored only as a hash
A 4-digit PIN	To keep your child out of settings, history and purchases. Stored only as a bcrypt hash, in a column the app cannot read
Record that you verified you are an adult, and when	Required by law before a child profile can exist
A record of the small card charge used to verify it	So we can show how consent was obtained. We never see or store your card details
Subscription status, if you subscribe	To know what your plan includes
A notification address for your phone, if you ask for a daily reminder	So we can tell you the summary is ready. It is an anonymous device address, not a phone number, and it is deleted when you sign out, turn the reminder off, or uninstall

About your child

What	Why
A nickname, optional, first name only	So Smarts can address them. You can leave it blank
An age range — 4–6, 7–9 or 10–12	So answers are pitched correctly. We never ask for a birthdate
Learning-support settings you choose	To change how Smarts writes and how the screen looks
The questions they ask and the answers given	So you can review them

That is the complete list. The children table has no column for a full name, birthdate, school, address, location, or photograph, and the schema carries a comment saying one must never be added.

What we do not collect

No location. No contacts. No photos or videos kept. No voice recordings. No advertising identifier. No device fingerprint. No behavioural profile. No third-party analytics or advertising SDK is present in the app.

Voice

When your child speaks to Smarts, the speech is turned into text on the phone and only the text is sent.

This is not the platform default: iOS sends audio to Apple's servers unless an app explicitly requires on-device recognition. Smarts sets that flag on every request, and where a device cannot recognise speech on-device, the microphone is switched off rather than falling back to a network service. Audio is never written to disk.

Homework photos

If you turn the camera on — it is off until you do — your child can photograph a homework page. What happens then, in order:

The phone checks the picture for people, on the whole shot — not just the part inside the frame. If anyone is visible anywhere, the photo is deleted and nothing is sent. If the check cannot be completed, the photo is refused anyway.
The picture is cropped to the rectangle your child saw on screen. Everything outside it is discarded at this point and plays no further part.
The phone reads that rectangle. When it can, only the text is sent and no image leaves the device at all — this is what usually happens.
Only when the page cannot be read is the cropped picture itself sent.
Every file is deleted, on every path.

Any image that does reach our server is checked again for people before it is used, and is never stored — not in our database, not in file storage, not in logs.

The daily reminder

If you ask for it, we send one notification a day to say the summary is ready.

It contains no summary, and does not name your child. It says a number — "6 questions today. Tap to see how it went." — and stops there. Not a name, not a topic, not a question, and deliberately not a mention of anything flagged.

That is because a notification appears on a lock screen, and the person most likely to be standing next to it is the child it is about. Tapping it opens the grown-ups area, which means the PIN; the summary is written only then.

For the same reason we do not email the summary. Email would put a child's day in plain text in an inbox that is synced across devices and forwarded, and would add another company to the list below.

The reminder is off until you turn it on, and turning it on is the only thing that asks your phone for notification permission. It is never requested while a child is using the app.

It goes only to the phones you turn it on from, not to every device signed into your account. If your child has their own phone, leave it off there. Grown-ups → Today lists every device that will receive it, and any of them can be removed.

Who else sees this

Who	What they receive	Why
Anthropic	The question, the child's age range and settings, recent conversation turns, and — rarely — a cropped homework image	To generate the answer
Supabase	Everything in the tables above	Our database and server host
Stripe	The one-off adult-verification charge	To confirm an adult set up the account
Apple	Subscription purchases	Payments, if you subscribe
Expo, and then Apple or Google	A device address, and the words of the daily reminder — a number of questions, with no name and no topic	To deliver the reminder, only if you asked for one

No one else. We do not sell data, we do not share it for advertising, and there is no advertising or analytics SDK in the app.

What Anthropic does with it

Checked against Anthropic's own published terms on 2026-10-12 rather than assumed:

They are contractually barred from training on it. Their commercial terms say plainly: Anthropic may not train models on customer content.
It is deleted within 30 days. Inputs and outputs sent through the API are deleted automatically within 30 days. The exceptions are narrow: material flagged by their automated trust-and-safety systems, or where the law requires it to be kept.
They do not receive a name, an email, or an account. What is sent is a question, an age range and the settings you chose. There is no identifier in it that points back to your child or to you.

A zero-retention arrangement — where nothing is stored at all — exists and we may pursue it. Thirty days with no training is what is true today, and it is what this page says.

How long we keep it

Questions and answers: 90 days, then deleted automatically by a scheduled job (purge_old_data, nightly). You can delete them sooner from Grown-ups → All questions.
Account data: until you delete your account.
Voice audio and homework photos: never kept at all.
Your notification address: until you sign out, turn the reminder off, uninstall the app, or your phone reports the address as dead — whichever comes first.
A record that a reminder was sent, so you are not sent the same one twice: one row per day, with no content in it.

Your rights as a parent

See everything your child has asked: Grown-ups → All questions.
Delete the history at any time, without deleting the account.
Change what Smarts will discuss: Grown-ups → Tricky topics.
Turn off the camera or the microphone at any time.
Turn off the daily reminder, or remove any single device from it, at any time: Grown-ups → Today.
Delete the account — Grown-ups → Delete my account. This removes the account, every child profile on it, and every question, and is the way to withdraw consent.
Refuse any further collection by deleting the account.

Or email neil@forevergreenapp.com and we will do any of the above.

Children's privacy

Smarts is intended for children and is operated with that in mind. We require verified parental consent before any child profile can exist: the database refuses to create one until consent is recorded, and consent is only recorded from a confirmed card transaction, never from the app saying so.

We collect only what is needed to answer a child's question, we never ask a child for personal information, and Smarts is instructed not to repeat personal information if a child volunteers it.

Smarts complies with the Children's Online Privacy Protection Act (COPPA). We obtain verifiable parental consent before collecting anything from a child, collect only what the service needs, let a parent see and delete all of it, and delete it ourselves after 90 days.

Smarts is a computer program, not a person. The owl your child talks to is software. The app says so on the screen where they ask their questions, in words a young child can follow, and Smarts says so itself if asked. It is never presented as a friend, a teacher, or a real animal.

If a child tells Smarts something suggesting they are being hurt or are in danger, Smarts replies warmly, tells them it is not their fault, tells them to tell a trusted adult straight away, and flags it for you in the Grown-ups area.

Security

Every table is protected by row-level security: a parent can only ever read or write their own family's rows, enforced by the database rather than by the app.
The parent PIN is bcrypt-hashed in a column the app has no permission to read, and locks for 15 minutes after five wrong attempts.
API keys live only in server-side secrets and are never in the app.

Changes

If we change this policy in a way that affects what we collect about a child, we will ask for consent again rather than relying on the old one.