1. Information we collect
For adult accounts we collect email, first name, authentication timestamps, consent records, security events, and privacy-protected abuse-prevention identifiers. Passwords are handled by Supabase Auth and are not stored in Little Stewards application tables.
2. Child and family information
Child profiles are created and managed by an authorized adult. Little Stewards does not require a child’s email, phone number, or full birthdate.
3. How information is used
We use account data to authenticate adults, verify email ownership, recover accounts, prevent abuse, protect families, provide requested features, and communicate essential service information.
4. Service providers
We use Supabase for authentication and PostgreSQL data, Cloudflare Turnstile for abuse prevention, Resend for transactional email, and hosting/monitoring providers needed to operate the application. Each provider processes data under its own terms and contractual safeguards.
5. Security and retention
We use encrypted transport, server-only secrets, Row-Level Security, credential-free audit records, and access controls. No online service can promise absolute security. Retention schedules and production incident procedures require final legal and operational review.
6. Choices and requests
Adults may request access, correction, or deletion by contacting privacy@littlestewardsapp.com. Identity verification may be required. Some consent and security records may be retained when law or safety requires it.
7. Children’s privacy
The grown-up account is adult-only. A final children’s privacy and parental-consent analysis, including COPPA and applicable state or international requirements, must be completed by qualified counsel before child-facing production launch.
8. Contact and changes
Privacy questions may be sent to privacy@littlestewardsapp.com. Material changes will update the displayed version and may require renewed acknowledgement.