Privacy Policy

Nurtoora collects only the minimum information necessary to provide our service. This includes: • Child profile information: nickname, age range, and gender (not full name or date of birth) • Daily tracking logs you enter (mood, milestones, activities, behaviours) • App usage analytics (anonymised) to improve the product • Device information for crash reporting We do not collect or store full names, addresses, phone numbers, or any government-issued identification.

Your data is used exclusively to: • Provide and personalise the Nurtoora experience • Generate AI-powered insights and progress reports • Improve app features and performance • Respond to support requests We never sell your data to third parties. We never use your child's data for advertising purposes.

Nurtoora is designed for parents and caregivers, not for direct use by children. We comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information directly from children under 13. All data is entered by parents or guardians on behalf of their child.

We take the security of your family's data seriously: • All data is encrypted in transit (TLS) and at rest • Authentication is handled by Supabase Auth with secure token management • Row-level security policies ensure each user can only access their own data • We conduct regular security reviews

You can delete your account and all associated data at any time from within the app. Upon deletion: • All child profile data is permanently removed • All tracking logs, milestones, and reports are deleted • Deletion is permanent and irreversible We retain anonymised, aggregated analytics that cannot be linked back to any individual.

Nurtoora uses the following trusted third-party services: • Supabase — database and authentication (SOC 2 compliant) • Google Gemini AI — for generating developmental insights (see below) • RevenueCat — subscription management • Firebase/Google Analytics — anonymised usage analytics Each service has its own privacy policy and we encourage you to review them.

When you use AI-powered features (daily insights, weekly reports, Ask AI, smart activities), Nurtoora sends the following data to Google Gemini AI (operated by Google LLC): Data sent: • Child's nickname and age range • Daily log entries (mood, sleep quality, food intake, notes) • Recorded milestones and small wins • Assessment notes and professional recommendations • Activity completion history How your data is protected: • All data is transmitted over encrypted connections (TLS) • Google Gemini processes your data in real-time and does NOT retain it after generating a response • Your data is NOT used to train or improve Google's AI models • We only send the minimum data necessary for each specific request Your consent: • You are asked for explicit permission before any data is sent to Google Gemini • You can revoke this permission at any time in Help > Privacy within the app • If you revoke permission, AI features will be disabled but all other app features continue to work normally • Revoking consent does not affect any data already processed prior to revocation

Depending on your location, you may have the right to: • Access the personal data we hold about you • Correct inaccurate data • Request deletion of your data • Export your data in a portable format • Opt out of analytics collection To exercise any of these rights, contact us at [email protected]

If you have questions about this privacy policy or how we handle your data, please contact us: Email: [email protected] We aim to respond to all privacy inquiries within 72 hours.