Skip to content

Instantly share code, notes, and snippets.

@henzard

henzard/PRIVACY.md

Last active July 4, 2026 18:12
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save henzard/fd29da0fc78743a5ef8c40d449b05ee3 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save henzard/fd29da0fc78743a5ef8c40d449b05ee3 to your computer and use it in GitHub Desktop.
Download ZIP
Privacy Policy — Junior Chat Bot (com.henza.juniorchatbot)
Raw
PRIVACY.md

Privacy Policy — Junior Chat Bot

Developer: Henzard Kruger Contact: henzardkruger@gmail.com Effective date: 4 July 2026 Applies to: the "Junior Chat Bot" Android app (com.henza.juniorchatbot)

Plain-language policy describing what this app collects, stores, and sends. The short version: nothing leaves the device except the API calls to OpenAI that make the conversation work, and almost nothing is stored.

What is collected and shared

  • Off-device: nothing, except direct calls to the OpenAI API during an active conversation. This means the following data is transmitted to OpenAI (a third-party service provider) for processing, using the API key the parent supplies:
    • voice audio (the child's recording), sent for speech-to-text and deleted after transcription — never stored by this app;
    • conversation text, sent to generate the reply and to OpenAI's moderation safety check. This includes up to the last 10 conversation turns sent as context (distress-flagged and blocked lines are always excluded from that context);
    • the child's profile — if the optional Personalisation feature is on (it is on by default and can be switched off in the Parent Zone), the child's name, age, and remembered facts (e.g. "likes puppies") are included in the AI request so the character can respond personally. Facts can be entered by the parent or learned automatically from what the child says.
    • All requests set store: false, instructing OpenAI not to retain the conversation. Transmission uses TLS encryption.
  • The app is used by children under a parent's supervision. Because the parent supplies their own OpenAI API key, the parent — not the developer — is the operator of this data flow. The developer runs no server and receives no data whatsoever.
  • There are no analytics, advertising, tracking, or crash-reporting services, and no data is sold or shared with any party other than the OpenAI processing described above.

What is stored on the device

  • Settings (including the parent's OpenAI API key, guardrail configuration, session-limit configuration, and the COPPA consent record) are stored in encrypted storage (MMKV encrypted with a key held in the Android Keystore).
  • Conversation history is not stored. Conversations live in memory only and disappear when the session ends. (A crash-recovery snapshot of the current session may be kept briefly and is cleared on normal close; any flagged or blocked lines are redacted from it.)
  • Child profile (Personalisation). The child's name, age, and remembered facts are stored encrypted on this device alongside the settings. The parent can edit the name/age, delete any individual fact, turn Personalisation off entirely (nothing is then sent or learned), or wipe the whole profile with Delete All Data.
  • Crisis flags are metadata-only. If a possible distress pattern is detected, the app records the date/time, active character, and turn count — deliberately never the child's words. See docs/PARENT_GUIDE.md for why.
  • Usage and cost estimates (minutes used today, estimated spend) are stored locally to enforce session and spending limits.

Parent control: Delete Everything

The Parent Zone has a Delete All Data button that permanently wipes all of the above in one action: encrypted settings, the stored API key, consent records, crisis flags, the child profile (name, age, and facts), onboarding state, and usage data — including the encryption key itself.

COPPA / POPIA posture

This is a household-use app: the parent installs it, supplies their own OpenAI API key, records consent during onboarding, and is the sole operator of the child's data. There is no developer-run service collecting personal information from children — data flows only between the family's device and the parent's own OpenAI account (with retention disabled). Within that posture the app still follows COPPA/POPIA-minded practice: verifiable parental consent at setup, data minimisation (no conversation persistence, metadata-only crisis flags), encryption at rest, and a one-tap full erase.

Retention

  • Voice audio: not retained anywhere; discarded after transcription.
  • Conversation text: in-memory only; gone when the session ends.
  • Child profile (name, age, facts): retained encrypted on the device until the parent edits or deletes it (per-fact delete, Personalisation off, or Delete All Data) or uninstalls the app. It is transmitted to OpenAI only inside prompts while Personalisation is on, with retention disabled (store: false) — it is never stored server-side.
  • Local settings and usage counters: retained on the device until the parent deletes them (one tap) or uninstalls the app.
  • OpenAI-side: requests are sent with retention disabled (store: false); see OpenAI's API data-usage policies at https://platform.openai.com/docs/guides/your-data.

Contact

Questions or data requests: henzardkruger@gmail.com.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment