Know what is saved.
Choose what to share.

TidyKid is currently operated personally from Minnesota, United States. It is not currently an LLC. Contact support@tidykid.ai. Full legal operator identity and the applicable public mailing address and telephone details must be completed before real-family enrollment.

Family registration is closed. The owner preview uses fictional profiles. Separately enabled parent accounts can save the family setup entered by an adult across devices, as described below. Connecting children and activating a protected household are separate steps.

When account saving is enabled for your parent account, TidyKid saves the setup you enter so you can continue on another device using the same linked account. This parent draft is separate from connecting children.

• Resume your progress: profiles, chore choices and your current setup step are stored as an encrypted draft. The service holds the keys. Only your authenticated parent account can open it.
• Keep control: unfinished account setup is kept for seven days after your latest save or return to the saved setup. Returning while it is active renews those seven days. Setup reminders arrive after 2, 24 and 72 hours of inactivity; at 72 hours, four days remain. Turn reminders off in Account settings. Completing setup stops these reminders and removes the unfinished-setup deadline. Removed or expired account drafts are held encrypted for 14 days for administrator-assisted recovery, then cleared from this active service. Existing browser and backup copies follow their separate retention controls. In Account settings, you can remove the account draft and pause saving. Your notice and acknowledgement record remain available there.
• A simple acknowledgement: after setup, a short welcome notice explains account saving. You can choose I understand or read more later. Acknowledgement is not required to save progress. Email me a copy is optional and unchecked; no email reply is needed.
• Apple Hide My Email: a relay address can remain your sign-in address. If you request an email copy, you may optionally enter another address for that copy or skip it. This does not link or change your sign-in account.

Required sign-in and security checks remain in place. Optional AI, content analytics, child connections and final family activation are separate. Failed or pending saves are shown in the workspace; edits that have not reached the account can be lost if the page is closed.

Messages and reactions are encrypted on connected devices. Each chosen group of children has a separate conversation. The service stores encrypted content and the delivery metadata needed to identify participants, maintain unread counts and enforce access. Typing presence contains no typed text and expires after seven seconds.

Messages expire after 14 days by default. A parent can explicitly choose 30 days for a conversation; the archive view covers messages older than 14 days until that expiry. New owner-preview conversations can keep a service-encrypted recovery copy of their key, accessible only through current account and device authorization. Older conversations retain their device keys until a recently signed-in parent explicitly enables account recovery. Keep a connected device until that transfer is complete. Administrator key custody does not authorize routine staff browsing.

Only a parent can deliberately select message text for the local Tidy chore helper, review a proposed chore and choose Save. This action sends only that selected text to TidyKid for processing; no external AI service receives it. A parent may also review selected text and confirm an email copy to their own verified address after a recent sign-in. The email provider can read that copy. Photos and unselected messages are excluded, and no email is sent automatically. Protected family photo permissions remain separate.

The owner preview saves unfinished choices in this browser’s session storage so you can return to them. Retained browser drafts can be reviewed when you return; signing out explicitly clears browser setup drafts. Closing a tab may remove session storage, depending on browser session restoration. A draft is not a saved household or an accepted cash promise. Protected family setup explains draft saving before you enter details. After you choose to continue, edits are sent to the service and stored as an encrypted unfinished draft under the existing core processing permission. The service holds the keys; only the current account holder can recover the unfinished draft. A draft expires 24 hours after its latest successful save, is no longer returned after expiry, and is cleared when next accessed. Finishing setup, withdrawing permission or a quarantined backup restore clears draft content. Reads and retries do not extend its expiry. Edits that have not saved may be lost if the page closes. The final terms acknowledgment is separate and is never inferred from a draft save.

A profile uses a first name or nickname. Age group, exact age, pronouns, a profile image and home region are optional; no date of birth, school, street address or child email is requested in setup. You choose chores, parent notes, schedules, rewards and family earning rules. Saved activity includes requests, reviews, approvals, points and recorded payments.

Choosing a profile photo processes a small image in your browser and removes image metadata. Saving the household includes the chosen profile image. Taking a photo uses your browser’s chosen camera action; access does not begin merely by viewing the profile. Detect location explains the request first, makes a one-time browser check and asks you to confirm a coarse region. Raw coordinates are used locally for that suggestion and are not sent or stored by this setup. Manual region selection works without location permission. TidyKid does not turn on background location or live weather through this choice.

The owner-preview household is a server file that an administrator can read; it is not end-to-end encrypted. In the protected family design, the service holds keys and decrypts household content for syncing and automated chore, schedule, points and reward checks. This is server-managed encryption. Routine staff browsing is not permitted. Human inspection requires current, scoped customer consent or an applicable legal obligation, with authorization and auditing. New owner-preview file storage encrypts attachments before upload and keeps its encryption key wrapped under the administrator-managed service keyring. A signed-in owner can reopen those files on another device without keeping a recovery file. Older file vaults retain their original key until the owner explicitly connects the original recovery file once; that transfer does not rewrite attachment bytes. Conversation recovery is a separate capability; older message keys are not adopted automatically. Administrator key custody does not authorize routine staff browsing.

Under Account settings → Privacy & your data, the owner preview offers optional note retention, a scoped export and removal of service-held support copies. Protected account holders have a separate optional-data view for their own household. Notes are off by default; choose 7 or 30 days. Pinned notes also expire. Shortening retention shortens existing notes; turning it off removes active notes. Saved notes are service-encrypted and are not private device-encrypted conversations. Optional family AI remains unavailable pending a separate provider and consent review, including applicable child-data safeguards. No setting or general “I understand” acknowledgment activates it. store:false alone does not establish provider Zero Data Retention. Request-attempt limits are separate from dollars or measured provider charges.

For optional family AI, the same reviewed Zero Data Retention protection is required for every age group, including unknown ages. Safety checks still run. Restricted operators can review family-linked categories, request identifiers, review priorities, actions taken, parent reports and appeals. This audit keeps metadata for 90 days; it does not copy the selected photo, prompt or reply. A flag is not proof of abuse, and a service failure is not inappropriate use. Reports do not automatically suspend an account or contact an outside authority. Applicable provider image-safety exceptions and separate TidyKid storage and backup policies still apply.

Owner preview can offer an optional assistant and setup suggestions when configured. A setup suggestion sends coarse age/routine preferences; names, exact ages and task notes are excluded from that request. Text you deliberately send to an AI assistant may be processed by its configured provider, so use fictional material in preview. Protected family mode keeps optional AI off. Optional usage and reward measurements are also off until the account holder enables them for the household. The choice covers connected parent and child apps and is separate from required processing permission. For new owner-preview households, limited feature-use measurement is optional and on by default. Existing saved choices stay unchanged. You can turn it off at any time under Privacy & your data → Help improve TidyKid. Optional measurements include page categories, visible active tab time in 15-second steps, reward designs and saved values, explicit card selections, and confirmed purchases, approvals, returns, expirations and uses. Cash-card measurements separately count requested amounts, parent or automatic approvals, parent payment reports, child receipt confirmations, missing-payment reports and card uses; they do not verify a bank transfer. Custom cards use opaque identifiers; names, custom titles and descriptions, messages, photos, raw page addresses and device fingerprints are excluded. Measurements are retained for up to 90 days. Turning sharing off removes that household’s measured contributions. Public website measurement is a separate, initially off browser choice available at the bottom of public pages; it uses a random identifier to count return visits for up to 90 days. Browser and installed web-app launches are distinguished where detectable. There is no native-app tracking. Owner testing and local fixtures remain separate from real-family statistics. Security and billing audit records are separate and are not turned off by this choice. Required processing permission does not enable optional AI or content analytics.

These tools start off. In the family workspace you can choose them separately and remove their active data. Reviewed reusable encouragement messages run locally; saved-record insights summarize chore completions and help requests for an authorized parent. They do not measure screen time, browsing or location. Weekly goals follow the calendar you approved and do not add work.

For outdoor planning, choose a public US city for the National Weather Service forecast. The service receives that city’s public coordinates and the server request, not your home coordinates, children or chores. Forecasts are cached for one hour. A parent reviews any suggested schedule change.

Browser notifications require your browser permission. Push services receive the encrypted generic reminder, a device subscription and technical delivery information. Names and chore details are excluded. Device subscriptions are service-encrypted and stop being used after 30 days without renewal; delivery-attempt history is limited to 14 days. Unconfirmed attempts are not automatically resent. Notifications use the current parent connection; after a server restart, reopen TidyKid to resume it. SMS stays unavailable until a separately reviewed provider, verified parent recipient, opt-out arrangement and cost limits are configured.

Similar-size family comparisons require a separate explicit choice. They use rounded household counts and planned minutes, excluding names, task text, rewards, photos and individual child results. Owner preview is excluded. A range appears only with at least 20 other consenting households of a similar size. Contributions expire after 30 days, and opting out removes your current contribution. Inactive encrypted records are excluded after expiry and removed on a later write. Removing active tool data does not establish deletion from provider records, recipient devices or backups.

A parent can deliberately type and submit a generic chore idea for admin review. Saved family chores are not submitted automatically. The admin may edit the generic idea before publication in the shared library. Published library content is separate from the original family record.

Email sign-in uses the configured mail provider. Essential cookies maintain authenticated parent and paired-child sessions; protected token representations, request limits, device records, security events and operational logs support access and reliability. Hosting, mail and any explicitly enabled optional provider receive only the information needed for their role. A current named provider, operator-contact and retention schedule must be confirmed before real-family enrollment; this preview notice is not that activation approval. No advertising scripts or automatic purchases are enabled by setup.

KWS is not currently enabled. If TidyKid offers Kids Web Services (KWS) to verify that you are an adult, we will show its provider notice before you continue. Adult verification is separate from your permission for TidyKid to process family information.

KWS controls its own reusable verification record in AgeGraph. This can include your hashed email address, verification status and method, dates, country, and application and transaction references. It can help you verify with other services using KWS. KWS also handles technical information and the information you enter in its verification flow under its own privacy policy.

Deleting your TidyKid account does not automatically delete KWS-controlled records. You can request AgeGraph removal using the opt-out link in KWS's verification-confirmation email or by contacting privacy@kidswebservices.com. KWS handles those requests under its own policy and applicable legal requirements. Contact support@tidykid.ai if you need help identifying the appropriate provider request.

TidyKid handles its own records separately under the retention, deletion and recovery rules in this notice. Applicable retained security or billing records, encrypted backup copies and provider records can have separate rules; a recorded request is not proof of completed erasure. The planned KWS adult-verification flow excludes child names, family photos, recordings, conversations, chore schedules and completion histories. Other TidyKid information can be handled by our disclosed hosting, storage/backup and mail providers with the protections described here; it is not promised to stay on one physical server.

KWS verification and confirmation emails are part of its process. Receiving an emailed copy of TidyKid's policy remains optional.

The optional-data view lists separate data scopes and records access, correction, deletion and provider-removal requests for review. Account deletion review requests have a 14-day cancellation period. A parent can cancel within that period. After it ends, the administrator records separate outcomes for nine data locations before completing the review. A completed review is not a claim that retained backup or provider copies were deleted. Recording a request does not perform the requested deletion, send email, establish verified consent or promise staff delivery. You can quote its request number to support@tidykid.ai. Request metadata is retained for up to 365 days; optional AI request metadata for up to 93 days. Current service support copies can be exported or removed separately and otherwise expire after 30 days. Removing an active service copy does not remove a recipient’s email or establish removal from backups. Household deletion, account closure, key destruction, backup reconciliation and provider deletion require their own verified outcomes.

The current preview offers an unencrypted JSON export. A replacement archives the prior sample and disconnects its old paired devices; it does not silently erase history. In protected family mode, permission-scoped export, consent withdrawal and verified deletion remove active content and revoke access. Operational security records and backups need separate retention and deletion reconciliation; restoring a backup must not resurrect deleted or revoked access. Server-held keys support controlled recovery but do not guarantee recovery without verified backups and custody arrangements.

A changed policy page does not itself permit staff browsing, optional AI, content analytics or a new use of previously collected information. A material change needs a clear notice and any required fresh permission before that use. Contact support@tidykid.ai for questions or a data request. Real-family operator details, retention periods and consent procedures remain prerequisites for opening enrollment.