PassTheNoteKids Privacy Policy

Version 2026-11-01 · Last updated: October 21, 2026 · Effective: November 1, 2026

Applies to the passthenotekids.com website and the PassTheNoteKids app. PassTheNoteKids, from PassTheNoteKids LLC, a Florida limited liability company.

Applies to the PassTheNoteKids website (passthenotekids.com) and to the PassTheNoteKids app: the parent portal, the kids experience (the kids web app and the kids side of the iOS app), and the PassTheNoteKids iPhone app.

What changed in this version. This is our launch policy. It describes groups that a parent starts, friend codes and games (section 6A); family conversations between a child and their own grown-ups; co-parents; pictures in grown-up chat, which are checked before delivery; quiet hours and the switches you set for each child; the Family plan, bought on our website through Stripe; how information sent for the safety check is handled (section 5); how long we keep consent records (section 10); a possible future use of past safety check results to improve our built-in rules, which is switched off; and how account deletion works today.

Read this first

PassTheNoteKids is a messaging app for kids, set up and run by parents. A grown-up sets it up. Every contact needs a parent's approval first: a parent approves each friend a child can write to, and only a parent can start a group (section 6A). There are no social media features: no public profiles, no feeds, no followers and no search. There are no ads, and we do not sell your family's information. Notes and pictures a child sends are checked before they are delivered. Simple built-in rules can clear some plain text notes. Every other note, and every picture, is checked by our AI safety check (section 5). Game moves, stickers and reactions are fixed choices with no words or pictures, so they are not checked. No automated system detects all harmful content. Checks can miss things, and they can hold or block notes that were fine.

This policy explains what happens to your child's notes and the pictures they draw and send, who else can see them, and the current limits of the service.

PassTheNoteKids launches on November 1, 2026 on the web, with our iPhone app to follow in Apple's App Store, in the United States only. An Android app will follow; we have not announced a date for it. This policy describes how the service works and how information is handled today. Where a feature is designed but not yet finished, this policy says so.

1. Who we are

PassTheNoteKids is operated by:

PassTheNoteKids LLC, a Florida limited liability company.

5764 N Orange Blossom Trl, Suite 61522

Orlando, FL 32810

[email protected]

(888) 632-7401

PassTheNoteKids LLC is the only company that runs PassTheNoteKids. Other companies help us run it (hosting, email, payments, the safety check), and every one of them is named or described in section 7.

For anything about privacy, parental consent, or your family's information, write to [email protected]. For everyday help, and for any notice to us, write to [email protected].

2. What this policy covers

The App Store "App Privacy" summary is narrower than this policy. When our iPhone app is available, that summary on our product page will describe only what the iOS app itself collects. This policy covers the whole service (the parent portal and the website as well), so it names some things the App Store summary does not.

Where to find this policy. This page is always at passthenotekids.com/privacy.

How paid plans work, and what is offered. The Family plan is bought only on our website, through Stripe. If we later offer plans in the App Store or Google Play, a family may instead subscribe there, and Apple or Google processes that payment; a family pays through only one of these at a time. Until then, our iPhone and Android apps do not sell anything. Co-parent households, family conversations between a child and their own grown-ups, and groups started by a parent are offered and are described in this policy. Our iPhone app will not be listed in the App Store's Kids category. If we switch on something new, we will update this policy first, and where the change is material we will ask parents for consent again rather than assume it.

3. What we collect from grown-ups

When you create a parent account, we collect:

• Your email address and the display name you choose. Your email is how you sign in and how we reach you.
• Your password: handled by our sign-in provider, Supabase. We never see it or store it ourselves.
• An account identifier. We give your account, and each child's profile, an internal ID number so our records stay tied together. It is ours, it means nothing outside PassTheNoteKids, and it is not your device, your phone number, or any advertising ID.
• Your consent record: your name and email address, the child account it covers, the date and time, the method, the payment reference from Stripe, the amount charged and refunded, the version of this policy and our Terms you agreed to, and the exact words you agreed to (section 8).
• Your plan and billing state: whether you are on a free trial or the Family plan; how many children your plan covers; whether your family holds a founding place; when it renews or ends; and a customer reference number from our payment processor, Stripe (or, once app-store purchases are available, a purchase reference from Apple or Google). We never receive or store your card number.
• Some small settings: whether you want email notifications, whether you want push notifications on your own phone, whether you finished setup, whether you have dismissed the product tour, and whether you have allowed notifications on each of your children's devices.
• A device push token for your own phone, if you turn notifications on there. It is the same kind of token described in section 4, and section 10 says how long we keep it.
• An optional profile picture of yourself, if you add one for grown-up chat. It is checked before anyone sees it (section 5) and stored privately.
• Your co-parent's email address, if you invite another grown-up into your household. Once they join, they have their own account and give their own consent (section 8).

Notes you write to other grown-ups in the app, and theirs to you. The other grown-ups in that conversation can read them. We do not check their words, and no child can see them. Grown-up chat can also include pictures, doodles, stickers, reactions and game moves; pictures and doodles are checked for child sexual abuse material before delivery (section 5). If a note is reported to us, our safety team reads the reported conversation.

Notes between you and your own child. In a family conversation, you and your child can write to each other. These notes go through the same safety check as any child's note (section 5).

When you invite another family so your child can write to theirs, we collect that other grown-up's email address, and optionally the first name you type for their child so they know who the invite is about. That person has not signed up with us at the time you send it. We store the invite so it can be accepted.

If you write to us (a support message, a suggestion, a reply in a support thread), we keep what you wrote and our replies. If we decide to act on a suggestion, our team may copy its words, never your name or email address, into our private work tracker on GitHub. AI assistants our team uses, such as Anthropic's Claude, may also read a suggestion's words, without your name or email address, and with any names or details about a child removed first, to draft a reply that a person on our team approves before it is sent (section 7).

We record when you last opened a conversation, so unread counts work. We do not record anything else about how you use the app: no taps, no screen views, no session analytics.

To see whether the service is working, our own server also adds up daily totals from the information described in this policy (how many families sent notes that day, for example), and those totals are counts only: they are never sent to anyone, they cannot identify you or your child, a total that would come from fewer than five families is left blank, and they are deleted after 90 days.

4. What we collect from children, and how little

We designed the kids' side to hold as little as possible.

We collect from a child:

• A display name and, if they choose one, a nickname.
• An age band: young child, tween, or teen. Chosen by you.
• A safety level: Guardian (strictest), Trusted (the default) or Independent (most lenient). It sets how strict the automated check should be for that child. Chosen by you, not by them.
• An avatar they build from parts (see below).
• The notes they write: the words, kept in full.
• The pictures they send: a photo they pick, or a doodle they draw.
• If they use the "this doesn't feel right" button: the reason they picked, the conversation, and (in the kids web app) an optional short note in their own words. A safety report goes to our safety team so a grown-up can act on it, and our team can see the child's name and anything the child typed. We do not tell the other child that a report was made. Your child sees a short, neutral message, such as "Thanks for telling us. A grown-up on our safety team will review this." We do not automatically tell parents about every report a child makes; our safety team decides after review, especially where telling a parent could put the child at risk.
• Which notes they have opened.
• Settings you choose for your child: quiet hours (a weekly schedule and your time zone; notes sent during quiet hours wait until they end), and switches for sending pictures, games, groups and friend codes, and for how much a notification on their device may say.
• A friend code your child can share in person, and any friend requests made with it (section 6A).
• Game moves, stickers and reactions your child picks from fixed options.
• The devices your child is signed in on: whether each one is the iOS app or the web, and when it was last used, so you can see and sign out each device.

We do not collect from a child:

• No date of birth. We ask for an age band, not a birthday.
• No email address. Children do not have one in our system.
• No phone number, no home address, no school.
• No location permission. No app on any platform asks for location permission, and we never ask a child where they are. When your child picks a photo in our iOS or Android app, the app sends it as a JPEG. The Android app uses the system photo picker and receives access to the picture you choose, rather than requesting access to your whole photo library. Our server accepts JPEG, PNG, GIF and WebP pictures and does not accept other formats, such as HEIC. It removes GPS and other camera metadata from JPEGs, from the copy sent to the safety check and from the copy we store and serve back to you. It does not yet remove metadata from PNG, GIF or WebP pictures, and it does not convert them to JPEG. We do not use location data. Until we remove it from every format, location data inside a PNG, GIF or WebP picture may stay in the stored copy and in the copy sent to the safety check.
• No microphone, no camera, no voice notes. The iOS app asks for three device permissions: Face ID (to check a grown-up is opening a grown-up area), read-only access to the photo library (so a child can pick a picture to send), and notification permission. On a child's device it asks for that third one only after a parent has allowed notifications for that specific device, from the Devices screen in the grown-up side of the app; a child's device is never asked before that. On the grown-up side, the app asks for notification permission only when you turn on "Notify me on this device" in Settings, never during sign-in. There is no camera permission and no contacts permission.

Push notifications, and the device token that makes them possible. When push notifications are switched on for a child's device, or for your own, Apple on iOS or Google Firebase Cloud Messaging on Android gives the app a push token (an identifier for that one app on that one device), and we store it so we can ask that provider to deliver a notification. We treat that token as personal information belonging to whoever the device belongs to, including a child. It is stored only while the device is signed in: signing out, re-linking a child to a new device, removing a child, or deleting the account all revoke it, and deleting your account erases it outright.

A notification never contains the note. It carries no message text, no picture, no name (not the sender's and not your child's), and nothing about a safety decision. It says only that something new is waiting (or, if you turn this on in your child's settings, what kind of thing is waiting, such as a new note or a game move); the app shows what it is after the person opens it. This is a safety measure: a notification that has already been delivered to a lock screen cannot be recalled, so if a note is later withdrawn by a safety check, anything the notification had already displayed would be impossible to take back. A child's device gets no notification for a note that is held, blocked, or under review, not even a silent or generic one. If you have turned on notifications on your own phone, a held or blocked note produces the same generic notification as anything else waiting for you, and it never says what happened (section 5). The app icon may show a number. If you allow badges, it counts how many things are unread in PassTheNoteKids, and that number is the only thing the badge says: not what they are, not who they are from, not which child they are about, and not whether anything was checked.

On Android, Firebase also creates a Firebase Installation ID and receives technical app and device information, such as the app and operating-system versions, to register the installation and deliver notifications. The notification data sent through Firebase contains a fixed kind, opaque references and, when applicable, a count and keys for fixed wording stored in the app. It contains no names, note text, images or moderation reasons. We do not enable Firebase Analytics or notification-delivery export to BigQuery. Revoking a token on our server does not itself erase identifiers held by Google. Google documents removal of an installation ID from its live and backup systems within 180 days after an installation-deletion request.

No advertising identifiers and no tracking. Apart from the Android Firebase installation identifier described above, there are no device identifiers beyond that push token. The push token described above is the only device-level identifier we hold; we hold it only while that device is signed in, and we use it only while notifications are on for it. When our iPhone app is available, the App Store "App Privacy" summary will list it as "Device ID". (We do give each child profile an internal ID of our own; see section 3.)

Nothing a child writes or draws is ever public. PassTheNoteKids has no social media features: no public profiles, no feeds, no followers, no search, and no way for a child to publish anything to the open internet. A child's notes, pictures, nickname and avatar go only to people a parent approved first: the specific friends both parents approved, the members of a group that a parent started and that you approved your child joining (section 6A), you and any co-parent in your household, and those children's parents. There is no feature that lets a child make their own information publicly available.

Avatars work differently for kids and grown-ups. A child builds their avatar out of parts: no camera, no photo upload; this is enforced in the code, not just by policy. When a child proposes a new avatar, we save the parts they picked, not a picture, and you approve it before friends see it. Earlier versions of the app also uploaded a picture made from those parts. Those pictures never went through the picture safety check. We stopped showing them and keep them in private storage. They are deleted when the request is decided, and when the account is erased. A parent, in the web parent portal, can upload an actual photograph of their child as that child's picture. If you do that, you are giving us a photo of your child. It is checked by the safety system and stored privately.

Some things stay on the device and never reach us. The Sketchbook (every drawing your child saves but does not send) lives only on that device. It has no server and no sync. The same is true of the grown-up PIN, which is stored only as a scrambled fingerprint, never as the digits themselves. If your child is offline, a note they wrote waits on the device until the connection returns, and is then sent to us as normal.

5. How notes are checked before delivery, and what that means

This section explains how notes and pictures are checked before they are delivered.

Every note is checked before it is delivered, and the result of that check decides what happens next. In a narrow case where the same note is judged twice, a later judgment does not pull back a note that has already been delivered; when that happens we record both judgments. There is one exception: the child sexual abuse rule in section 14 is enforced even after delivery. Some things are not checked because they contain no words or pictures of their own: a game move, or a sticker or reaction picked from a fixed set.

One kind of note is not checked: the words in a note between grown-ups. There are three kinds of grown-up conversation: one with the other grown-ups in your own household; one between your family and the family of your child's approved friend, which includes every grown-up in both families, including co-parents; and one-to-one chats with a single grown-up contact. Grown-ups in those families become your contacts automatically, and they can see your name and any profile picture you add. There is no search, and no way to add a grown-up who is not in your household or in the family of your child's approved friend. The words in these conversations are not checked: neither our automated check nor our team reads the words before they are delivered, and a child can never see them. Pictures and doodles that grown-ups send each other, and a grown-up's profile picture, are different: each one is checked by our AI safety check for child sexual abuse material before anyone sees it, and it is not delivered if that check cannot finish. Either grown-up can close the conversation at any time, or report a note to our safety team, and our team can then read the notes that were reported.

Here is what happens when your child taps send:

• The note is saved to our database.
• Simple built-in rules look at the words. A clearly harmless, text-only note can be cleared right here and go no further.
• If a note with identical wording and context was already judged very recently, that earlier judgment can be reused.
• Otherwise (and always, without exception, for any picture), the content is sent to Claude, an AI model provided directly by Anthropic, for an automated safety judgment.
• The result decides: deliver, hold for a grown-up to look at, or block. Clearly inappropriate notes are blocked. The AI check is used at all three safety levels, Guardian, Trusted and Independent, and the level changes how readily a note is held or blocked. At every level, an unclear note is held for a parent to look at, and a note that the check blocks stays blocked. When two children write to each other, the stricter of their two levels applies.

What is sent for the safety check:

• The full text of the note being checked.
• Up to 20 earlier notes from that same conversation, for context. That includes notes written by the other child.
• For a picture: the entire image file. Every photo. Every doodle. Every profile photo a parent uploads. The text of a nickname a child proposes goes through the same check. The name of a group is checked the same way. Every picture, doodle and profile picture a grown-up sends is also sent, and checked only for child sexual abuse material.
• The words on a doodle, as text. Words a child types onto a doodle are sent as text beside the picture and checked the way a note is, and on iOS the app also reads any lettering drawn in the doodle, on the device, and sends what it read as text for the same check. A doodle is delivered only if the picture and the words both pass, and you can see the words under the picture.
• Not names. In the material we send, the children are described as "the child being moderated" and "the other child." Their account names are not included. A name a child types inside a note is part of the note's words and is sent with it.
• GPS and other EXIF data are stripped from JPEGs before the image is sent. Metadata inside PNG, GIF or WebP pictures may remain in the copy sent to the safety check.

Anthropic processes this information for our AI safety check. It does not use this data to train AI models. We do not use it for advertising, and there is no advertising in PassTheNoteKids. Amazon Bedrock and Microsoft PhotoDNA matching are not active in the current implementation. Before using a different processor or adding matching, we will update this policy and obtain any required consent.

Your consent to the safety check, and choosing "Not now". You agree to the safety check when you give parental consent at sign-up (section 8). In the app we also ask you for a separate permission for the AI safety check. If you choose "Not now", until you allow it, your child can still use stickers and games as part of your plan. Notes and pictures your child tries to send are not sent and not stored: they are not delivered and not sent for the safety check until you turn the check on. You can change this anytime in Settings → Privacy.

Improving our built-in rules (switched off). We may in future use a scheduled job that reviews the words of past notes, with account details and display names removed, together with the score each received, and uses our AI safety check to suggest updates to our built-in rules. This job is switched off. We will not switch it on unless we have updated this policy and, where required, asked parents for consent first. We do not use your family's notes or pictures to train AI models, and we do not build our own AI model.

How long Anthropic keeps it. Anthropic may keep data sent for our safety check for up to 30 days, or longer if its systems flag it. It does not use that data to train AI.

If the safety check cannot finish, we hold the note. A timeout or an outage never results in a note being let through; the note is held instead.

We keep a record of every check. That record includes the decision, the score, the model's written reasoning, and a copy of exactly what was sent for review, which means a second copy of your child's words, and of the other child's recent words, exists in that record. Deleting a note would not by itself remove that copy.

Blocked notes are kept, not thrown away. If a note is blocked, the note still exists and you can still see it in the parent portal, with the exception described in section 14. This allows you to see what your child tried to send.

Your child is not told why, and if we push an alert to your phone, it does not say why either. A note that is blocked or held simply looks to your child like it did not send. A note held on its way to your child simply never appears; there is no placeholder and no notification. You can see it; your child cannot. Held and blocked notes appear in your parent portal when you open it. We do alert you when a note is held or blocked, in up to three ways: a notification always appears in your parent portal; unless you have turned parent emails off in your settings we also send you an email; and if you have turned on notifications on your own phone, it gets the same generic "Something new is waiting" push that any other item in your notifications produces; it never says what happened, which child it concerns, or who wrote the note. Turning email or push off changes how you are told, never whether you can see the note: the in-app notification is always written and the portal always shows the note. And there is one case where you are told nothing at all: when a note is blocked under the child sexual abuse rule in section 14, no alert reaches you (not in the portal, not by email, and not by push), and we may be legally barred from telling you a report was made. Moderation is designed to be invisible to children, with the limits described in this section.

When a note sent one-to-one between two children is held, only a parent or co-parent of the child it was sent to, with permission to approve notes, decides whether it is delivered; the sending child's parents are told that a note was held. When a note sent in a group is held, a parent or co-parent of the child who sent it, with permission to approve notes, decides for the whole group whether it is delivered. Approving delivers it to every member, and blocking blocks it for everyone. Other families in the group do not see another child's held note.

The strictest category cannot be turned off. If the safety check indicates apparent child sexual abuse material, the content is blocked outright. No setting, no plan, and no parental preference can override that, and it is handled as described in section 14.

Automated checks have limits. No automated system detects all harmful content. They can miss things, and they can hold or block notes that were fine. They help, but they do not replace a grown-up's supervision.

6. What a parent can see, including the other family's child

The parent portal shows you your child's conversations, including notes that were held or blocked, and the moderation decision behind each one. This applies if you are the main parent, or a co-parent who has been given permission to view conversations. The one category we do not surface to you is described in section 14.

Three things follow from this. Please read them before you invite anyone.

First: you can see both sides of your child's conversations. When your child writes to another child, the other child's notes are in that conversation, and they are visible to you.

Second: the moderation record we show you includes the snapshot described in section 5, which contains recent notes from the other child as well as your own. So the other family's child's words can appear in your view.

Third: approving a contact is how you consent to this. When you approve a contact, you are agreeing that your child's notes and pictures in that conversation (and the safety records about them) will be visible to the other child's parent, including in any copy of their information that parent asks us for. The other child's parent agrees to the same about their child. That is what a dual-approved contact means. Both grown-ups approved it, and both grown-ups can see it. If you are not comfortable with that, do not approve the contact; if you change your mind, revoke it.

Either parent can revoke a contact at any time, from the parent portal or the iOS app. Revoking it closes the channel for both children immediately.

Co-parents. If either family has added a co-parent with permission to view conversations, that co-parent can see the same conversations, including notes sent before they joined, once they have completed their own consent and been given that permission. They can also see the family conversation between a parent and that child.

6A. Groups, friend codes and games

Only a parent can create a group. A group is started from a parent account, and only a parent adds children to it. Children cannot create groups and cannot invite anyone to one. Your child takes part only in groups you created or approved. Groups are private: they can't be searched for or browsed, and their notes can't be shared or forwarded outside the group.

Joining a group. A parent can invite children who are already approved friends of a member. Before another child joins, that child's own parent is shown who is in the group and is asked to approve; the child does not join until their parent says yes. There is no public link to a group. A group needs the Family plan and the groups switch for your child.

What a group means for your child's information. In a group, your child's notes and pictures are seen by every member and by those members' parents, including children who are not your child's one-to-one approved friends. Approving your child joining a group is how you consent to this. Notes and pictures in a group are checked before they are delivered, the same way as any child's note (section 5).

Groups made up only of grown-ups are not offered. If we offer them, or change how groups work in a material way, we will update this policy first and, where needed, ask parents for consent again.

Friend codes. Each child can have a short friend code, shown in their profile, to share in person. It changes when your child asks and after it is used. If a child enters a friend's code, the request goes first to that child's own parent, and then to the other child's parent. Nothing is shared between the two children until both parents approve. A child can try five codes a day. There is no search and no directory of children. You can turn friend codes off for your child.

Blocks. You can block another child. A block applies everywhere, including to friend codes.

Games. Approved friends can play simple turn-based games in their conversation. Grown-ups can play too: with their own child in a family conversation, with a co-parent, and with the parents of their child's approved friends. A move is picked from fixed options and contains no words or pictures, so moves are not sent to the safety check. The words in Hangman come from our own list, and no one types them. You can turn games off for your child.

7. Who we share information with

We do not sell your family's information. We do not share it for advertising. There is no advertising network, no analytics service, and no attribution or tracking SDK anywhere in the website, the parent portal, the kids app, or the iOS app. In the parent portal, the kids app, and the iOS app, automated tests fail our build if a known advertising, attribution, or analytics package is added.

These are the companies and organizations that receive information, what they get, and why:

The companies above use their own service providers to run their services. We review changes to those providers and will update this page if a change matters to your family’s information.

When we copy a suggestion into our work tracker on GitHub, we remove any names or details about a child first. We delete the copy 90 days after the work item is closed, or right away if you delete your account.

Backend error reporting is configured. Our production backend is configured to send the scrubbed error events and redacted backend log lines described above to Sentry. Sentry performance tracing is disabled. None of the apps (iOS, parent portal, or kids app) contains a crash-reporting, diagnostics, or performance SDK. If that changes, we will update this list and, where it applies, our App Store privacy details.

What our own staff can see. Our internal moderation tools show decisions, scores, and case references, not your child's note text or pictures, except a reported conversation or a safety case (sections 5 and 14), which our safety team can read. Separately, when a child uses the "this doesn't feel right" button, our safety team sees that report, including the child's name and anything the child typed in their own words, so we can act on it. Every action a staff member takes in those tools is written to an append-only log: our application is blocked from editing or deleting entries in it.

8. Parental consent

A child cannot sign themselves up for PassTheNoteKids. A grown-up creates the account, creates each child's profile, and approves every contact first: a contact between two children only opens when both children's parents have approved it, and a child joins a group only after their own parent approves (section 6A).

How we ask for consent. As the first step of setting up your account, in the parent portal in a web browser, we ask you to:

• Confirm that you are at least 18 and are the child's parent or legal guardian, and
• Complete a $0.50 charge on a payment card, which we refund immediately.

A card charge shows up on the cardholder's statement, so the person consenting has to control an adult payment card. We refund it immediately: it is a check, not a fee. Starting the Family plan's free trial then asks for a card again at checkout; that second step is for the subscription, not for consent.

A co-parent gives their own consent. If you invite another grown-up into your household, they must confirm they are 18 or older and the child's parent or legal guardian, complete their own refunded card charge, and tick the box described in our Terms of Use, section 2, before they can see or manage your children.

Consent to the safety check. Every picture, and every note that our built-in rules do not clear, is checked by our AI safety check before it is delivered (section 5). When you give parental consent at sign-up, you consent to our AI safety check receiving the information described in section 5 for that purpose. In the app we also ask you for a separate permission for the AI safety check, and you can choose "Not now". Until you allow it, your child can still use stickers and games as part of your plan. Notes and pictures your child tries to send are not sent and not stored: they are not delivered and not sent for the safety check until you turn the check on. You can change this anytime in Settings → Privacy. We do not disclose your child's information to any other third party except as set out in sections 7 and 14. You can agree to our collection and use of your child's information without agreeing to its disclosure to third parties, except disclosure that is integral to the service.

We record: your name and email address, the child account it covers, the date and time, the method, the payment reference from Stripe, the amount charged and refunded, the version of this policy and our Terms you agreed to, and the exact words you agreed to. We never see your card number. The checkbox text is: "I am at least 18 years old and the parent or legal guardian of each child I add to PassTheNoteKids. I have read the notice to parents and the Privacy Policy, and I consent to PassTheNoteKids collecting, using and disclosing my child's information as they describe, including the automated AI safety check." The notice to parents is the short notice we show you on the consent screen before you agree.

The iOS app does not take a card. It sends you to the parent portal in a browser to do this.

9. Your rights as a parent, and what we can do today

You have the right to see the information we hold about your child, to stop us collecting more, and to have it deleted. This section describes the current status of each.

Seeing it

Sign in to the parent portal, then email [email protected] from the address on your account. We will confirm it is you (by asking you to complete a confirmation step in the parent portal while you are signed in) before we send anything.

There is a built-in export that gathers, in one file: your account, each of your children's profiles, their approved contacts, their note and moderation history, any safety reports, your recorded consent, and your household. It only ever returns your own family's records. There is no self-serve download button yet; a person on our team runs the export and sends it to you.

Note that an export of your child's conversations will contain notes written by the other child in those conversations, for the reasons in section 6.

Stopping further collection

• Revoke a contact. In the parent portal or the iOS app. It takes effect immediately for both children.
• Delete a child's profile. Deleting a child's profile stops that child's access at once and revokes their contacts so no new notes are sent or received. We erase the profile and that child's information within 30 days after a 30-day restore window. It is separate from removing a child from your paid plan, which changes your price at your next renewal and does not delete anything (Terms of Use, section 6).
• Close your account. In the parent portal (Settings) or the iOS app. This closes the account and schedules it for deletion in 30 days. Read "Deleting it" below for what that does and does not remove.
• Let your trial or plan end. When a free trial ends without a paid plan, or a paid plan ends, you can still sign in and view your family's information, but your children cannot send notes and cannot use groups or games until a paid plan starts again. PassTheNoteKids has no free plan. We do not delete your family's information because a payment ended; to have it deleted, close your account.
• Turn features off for a child. You can switch off pictures, games, groups and friend codes for each child at any time. You can remove your child from a group at any time, and group notes and names can be reported like any note.

Deleting a child's profile or closing your account stops new information from being collected. It does not by itself erase what is already stored. Read the next part.

Deleting it

Deleting your account does not erase everything right away. The "Delete account" control in the parent portal or the iOS app closes your account and starts a 30-day window, during which our support team can restore it if the deletion was a mistake. After that window, a person on our team runs our deletion tool, which permanently erases a closed account's information, except for what is described below. We complete erasure within 30 days after the 30-day window ends, and we confirm to you by email when it is done.

What you can do now: email [email protected] and we will tell you exactly what we hold about your family and where your request stands.

We will update this section when deletion runs automatically, and we will describe what it removes and how long it takes.

One exception will always remain. If content is caught up in a suspected child sexual abuse case, we are required by federal law to preserve it, and it is deliberately excluded from deletion. We have built that exclusion into the deletion tool itself, so that when it runs it cannot erase preserved material: the tool stops rather than guesses. We will not confirm or deny whether any specific case exists.

Consent records. When you give consent, we keep a record of it: your name and email address, the child account it covers, the date and time, the method, the payment reference from Stripe, the amount charged and refunded, the version of this policy and our Terms you agreed to, and the exact words you agreed to. If you withdraw consent or ask us to delete your child's information, we also record that request and when we completed it. We keep these records while your account is open, or for one child, while that child's profile exists. The retention period for records covering the account or the child's profile you delete is 3 years from the date you ask us to delete your account (or your child's profile), or the date your account closes if earlier. Deleting one child's profile starts this period only for the part of the record about that child. We keep them only to show that we asked for and received your permission and honored your choices, and to respond to legal claims or regulators. They are stored apart from your child's information, with restricted access. These records never include your child's notes, doodles, photos or other content, which we delete as described in this section. After that period, we delete them.

We also keep billing records the law requires, which hold no child information.

If you say no

If you refuse to allow information that PassTheNoteKids needs in order to work (a display name, an age band, the notes themselves), we may not be able to keep the account open for your child. We will tell you if that is the case.

10. How long we keep information

We keep children's information only as long as reasonably necessary for the purpose we collected it, and never indefinitely. Each category below has a point at which it is deleted.

Words copied into our work tracker (section 7) are kept as described there.

Backups, replicas, and the records our providers keep on their own systems are governed by those providers and may persist after we delete something on our side. This includes the error events Sentry keeps and any picture the provider of our AI safety check keeps under the child sexual abuse material exception described in section 5.

11. What we store in your browser and on your device

Signing in stores a session in your browser's local storage so you stay signed in; our sign-in provider Supabase handles it. We also store small items there: an invite token while you sign in to accept an invite, whether you have seen the product tour, whether you have just finished the consent step, and whether a checkout is in progress. We use no cookies for advertising or analytics.

On iOS we keep your sign-in token in the system Keychain, and small display settings on the device: which tab you were on, which notes you have opened on that device, whether you have seen the welcome screens, and your saved Sketchbook drawings.

In the kids web app, the child's sign-in session and their profile are stored on that device, along with their Sketchbook and any note waiting to send while offline.

None of these are used to identify or contact anyone, none is an advertising or cross-site identifier, and none is shared.

12. Security

Our security measures include:

• All traffic runs over HTTPS/TLS. There is no custom cryptography in the app.
• Pictures are private. The storage areas holding notes' images, grown-up chat pictures, grown-ups' profile pictures and children's avatars are not publicly reachable. The app gets a short-lived signed link each time, after we check you are allowed to see it.
• Camera metadata is stripped on our server. Our server removes GPS and other EXIF data from JPEGs, from the copy sent to the safety check and from the copy we store. Metadata inside PNG, GIF or WebP pictures may remain in both copies.
• Our database refuses browser and app clients by default. Every table denies direct client access; only our backend can read it, and only after checking who you are.
• Our logs are designed to exclude sensitive information. They do not record request bodies or query strings. Anything that looks like a token, password, email address, note body, or child's name is removed and replaced with a redaction marker before it is written.
• The grown-up PIN is never stored as digits, only as a salted, hashed fingerprint on the device. On iOS, your login token is held in the system Keychain. On Android, login tokens are encrypted with a key held in the Android Keystore, and app data is excluded from Android backup. Face ID, Touch ID and Android biometric checks are handled by the operating system on your device; we never receive face or fingerprint data.
• Every staff action is written to an append-only log that our application is blocked from editing or deleting.
• IP addresses. We do not write parents' or children's IP addresses to our database. We hold them only briefly, in memory, to rate-limit abusive traffic. When one of our own staff takes an action in our internal console, we log that staff member's IP address as part of our accountability record. Our hosting and network providers necessarily see IP addresses as part of delivering the service.

No system is completely secure.

13. Children's privacy

PassTheNoteKids is built for children, including children under 13, and the whole design assumes that. Where a child is 13 or older, the same protections in this policy still apply. PassTheNoteKids is for children 17 and under. We do not collect birthdays, so parents are responsible for removing a child's profile when that child turns 18.

• Accounts are created by a grown-up. A child cannot register.
• We ask a parent for verifiable consent, by the card micro-charge described in section 8, and we keep the record for 3 years from the date you ask us to delete your account (or your child's profile), or the date your account closes if earlier (sections 9 and 10).
• Every contact needs a parent's approval first. One-to-one contacts, including those made with a friend code, require two parents' approval, and either can revoke instantly. Only a parent can start a group, and a child joins one only after their own parent approves.
• We collect an age band, not a birthday. No child email, no phone, no location permission, and no device identifier beyond the push token and, on Android, the Firebase installation identifier described in section 4.
• We do not condition your child's participation in any part of PassTheNoteKids (sending a note, drawing, choosing an avatar, adding a contact) on giving us more personal information than is reasonably necessary for that activity. A child needs a display name and an age band, and whatever they choose to write or draw. There is no birthday field, no email field, no phone field and no school field on a child's profile.
• Nothing a child writes or draws is public. PassTheNoteKids has no social media features: no feeds, no public profiles, no followers, no search.
• No advertising. No third-party analytics. No behavioral profiling of children. Nothing is used to track anyone across other apps or websites.
• Every note is checked before delivery, apart from fixed choices such as game moves and stickers (section 5). No automated system detects all harmful content.
• A parent can review their own family's notes and moderation decisions, stop further collection, and ask us to delete; see sections 6, 9 and 14 for what each of those does today and where the limits are.

We do not use your family's notes or pictures to train AI models, and we do not build our own AI model. We do not currently use past safety check results to improve our built-in rules; that possible future use is switched off (section 5). If we ever want to use your family's information in a new way, we will tell you before it happens and ask for your consent again.

We do not claim to be certified or approved by any regulator.

14. Law enforcement, safety, and mandatory reporting

We may disclose your child's notes and other information in the circumstances below.

Apparent child sexual abuse material. As a provider of a messaging service, we are legally required to report apparent child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), which shares reports with law enforcement. This duty is not optional, cannot be turned off by any setting, and does not depend on parental consent. Federal law also requires us to report apparent child sex trafficking and the online enticement of a child, and we do. When we make a report, federal law requires us to preserve what we reported for one year; we keep it longer only where the law allows it, for example to help combat online child sexual exploitation or because law enforcement asks us to.

A report includes the content itself, the account information of the child and the parent it came from, and the relevant dates and times.

If our system flags apparent material of this kind, we block it, preserve the evidence, suspend the account it came from, and report it to NCMEC's CyberTipline. We are registered with NCMEC to make these reports. If an account is suspended for this reason, we may not be able to tell you why. The same applies to pictures grown-ups send each other.

We do not send you an alert when this happens. PassTheNoteKids has no notification that tells you your child's content triggered this category, and content blocked on this path does not appear in your ordinary review queue. The note is blocked, our team is alerted, and a case is opened internally. Separately, we may be legally prevented from telling you that a report was made.

Intimate images shared without consent. Anyone, with or without an account, can ask us to remove an intimate image of them that was shared on PassTheNoteKids without their consent. Email [email protected] with the subject "Removal request", and tell us where the image appears and how to reach you. We remove a validly reported image within 48 hours of receiving the request, and make reasonable efforts to remove identical copies. An image of a minor is also handled under the child sexual abuse material process above.

Legal process. We disclose information in response to valid legal process, such as a subpoena or court order.

Emergencies. We may disclose information where there is a genuine emergency involving a risk of death or serious physical injury.

Current limits. Known-image matching using Microsoft PhotoDNA is not active. Our AI safety check looks for apparent child sexual abuse material in pictures. No automated system detects all harmful content.

15. State privacy rights

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. There is no advertising and no ad technology anywhere in PassTheNoteKids.

Depending on where you live, you may have rights to know what we hold, to correct it, to delete it, and to opt out of sale or sharing. Section 9 describes what we can do today for each of those, and applies to everyone regardless of state. Write to [email protected] to make a request.

PassTheNoteKids is built for families in the United States. Our backend servers run in United States regions (Ashburn, Virginia and San Jose, California) and our email provider is set to its United States region. Our database and file storage are hosted by Supabase; we do not make a data-residency commitment for them in this version of the policy. If we offer the service outside the United States, we will update this policy first.

16. The website and founding families

The marketing site at passthenotekids.com has no accounts, no advertising trackers, and no third-party analytics. We have Facebook and Instagram pages (@passthenotekids). Our website links to them with plain links. We do not put Meta's pixel, social plug-ins or any other social media tracking on our website, parent portal, kids experience or iOS app. If you message us on Facebook or Instagram, we use your message only to reply, and the platform's own privacy policies apply there.

Founding families. Families who sign up for the Family plan on our website between November 1, 2026 and 11:59 p.m. Eastern Time on December 1, 2026, finish the 14-day free trial, and make their first successful monthly payment may qualify for one of 50 founding places. Founding eligibility is applied automatically to the first 50 eligible website families whose first successful monthly subscription payment claims an available place. No coupon code or manual enrollment is required. The discount applies during the first 12 paid monthly billing periods (year one). A founding place is counted only when a family's first payment after the free trial goes through. Starting a free trial does not reserve a founding place. Founding families sign up the same way as everyone else, and we collect nothing extra from them; we record on the account that it holds one of the 50 founding places. Founding prices and the rules for keeping them are set out in our Terms of Use, section 6.

Our website and the parent portal load fonts from Google Fonts, which means your browser's IP address goes to Google when those pages load. The iOS app and the kids app do not do this.

17. If PassTheNoteKids is ever sold or transferred

If PassTheNoteKids LLC is acquired, merged, or sells its assets, family information could transfer with the business. If that happens, the buyer will be bound by the promises made in the version of this policy in force when the information was collected. We will notify parents, and if the buyer wants to handle information differently, we will ask you for fresh consent rather than assume it.

18. Changes to this policy

We will post the new version here with a new effective date and a short summary of what changed. For material changes, we will tell you by email at least 30 days before they take effect.

If we materially change what we collect from children, how we use it, or who we share it with, we will give parents direct notice and ask for consent again. We will not treat your continued use of the app as agreement to a material change, and we will not apply a new policy retroactively to information already collected under an old one.

19. Contact us

Privacy, parental consent, access, and deletion requests: [email protected]

Everyday support and notices: [email protected]

By post: PassTheNoteKids LLC, 5764 N Orange Blossom Trl, Suite 61522, Orlando, FL 32810

Phone: (888) 632-7401

If you believe a child's information has been collected without a parent's consent, write to [email protected] and we will act on it.