Privacy Policy

A note for parents (COPPA)

Kirbo is intended to be set up and controlled by a parent or legal guardian. We comply with the U.S. Children's Online Privacy Protection Act (COPPA) and its 2025 amendments. We do not knowingly collect personal information from a child until the parent or guardian who created the family account has (1) reviewed this Privacy Policy and our direct notice, and (2) provided verifiable parental consent inside the Kirbo Guardian app.

As a parent or guardian, you can at any time: review the personal information we have collected from your child; refuse to allow any further collection or use; request that we delete your child's information; and revoke your consent. We do not require a child to disclose more information than is reasonably necessary to use Kirbo. To exercise any of these rights, use the controls in the Guardian app (Settings → Privacy & Data) or email us at hi@kirbokids.com.

Information we collect

From parents and guardians

• Account information: email address, password (stored only as a salted hash), and optionally your name and gender.
• Profile and household details you choose to provide, such as your city and your preferred language.
• Device and notification data: push notification tokens and basic device information needed to deliver real-time safety alerts and reports.
• Communications you send us (e.g., support requests) and consent records, including the date and time consent was granted.

From and about children

We minimize what we collect from children. We do not ask for a child's real name, address, phone number, or precise location. With your consent, a child profile includes:

• A nickname (not the child's legal name), chosen by the parent or child.
• Birth month and year, used to set age-appropriate tone and safety filters.
• Gender (optional), used only for correct grammatical agreement in Spanish and English.
• An avatar and Kirbo color the child selects.
• A login PIN, stored only as a secure hash.
• Conversation content: the messages your child exchanges with Kirbo (text, and where used, voice converted to text), so Kirbo can respond, monitor for safety, and generate your reports.
• Learned preferences: interests, likes, and topics that help Kirbo personalize responses within your family rules.
• Safety signals derived from conversations (for example, whether a message matched one of our safety categories).

How we use information

We use personal information only for the purposes described below, all of which support providing Kirbo to your family:

• To operate the service: authenticate users, deliver conversations between your child and Kirbo, and apply your Family Value Pillars.
• To keep children safe: monitor conversations in real time across our safety categories and send you immediate alerts when something serious comes up.
• To create insights for you: generate session summaries and daily, weekly, and monthly reports, including conversation starters.
• To support and secure the service: troubleshoot problems, prevent abuse and fraud, and maintain the security and integrity of our systems.
• To communicate with you: send service messages, safety alerts, and (only if you opt in) product updates.
• To comply with law and protect people: respond to legal obligations and protect the rights, safety, and property of children, families, you, and Kirbo.

Internal use, analytics, and product improvement

We may use de-identified and/or aggregated data — information that no longer identifies and cannot reasonably be linked to your child — to measure how Kirbo performs and to improve it. This includes evaluating and improving the accuracy of our safety detection, fixing bugs, understanding which features families use, and conducting internal research and analytics. We maintain technical and contractual measures so that de-identified and aggregated data is not re-identified.

AI, safety monitoring, and reports

Kirbo is an AI companion. Your child's messages are processed by AI models to generate responses and to detect safety concerns across 30+ categories (such as bullying, self-harm, abuse, or online danger). A summary of every conversation, and the full conversation, is available to you in the Guardian app. From your child's perspective Kirbo behaves like a friend and does not reveal that a parent reviews conversations — except in a genuine safety crisis, where Kirbo responds in a way designed with child psychologists and you receive an immediate alert.

AI model training

We do not use your child's personal information — including conversation content — to train third-party or general-purpose ("foundation") AI models, and we do not allow our AI providers to use it to train their models. Where we work to improve Kirbo's own systems (for example, the quality of our safety detection), we use de-identified and/or aggregated data as described above. We will not use identifiable children's data to train AI models without separate, verifiable parental consent.

How we share information

We do not sell your or your child's personal information, and we do not use it for behavioral or targeted advertising. We never show third-party ads in Kirbo. We share information only in these limited cases:

• Service providers (processors): vetted vendors that host our infrastructure, deliver notifications, or provide AI processing strictly on our behalf, under contracts that require them to protect the data and use it only to provide services to us.
• Within your family: both linked parent/guardian accounts on a family see the same dashboards, alerts, and reports.
• Safety and legal: when we believe in good faith it is necessary to comply with the law, enforce our Terms, or protect the safety of a child or other person.
• Business transfers: if Kirbo is involved in a merger, acquisition, or sale of assets, data may transfer subject to this Policy; we will notify you of any change in control or use of personal information.

We will obtain separate verifiable parental consent before disclosing a child's personal information to any third party for that third party's own purposes.

Data retention and deletion

We keep personal information only as long as needed for the purposes in this Policy, and we do not retain children's personal information indefinitely. Conversation data is retained to power your reports and is then aged out under our retention schedule. You can delete an individual child profile, or perform a full account deletion ("hard delete"), from the Guardian app at any time. A hard delete permanently removes your family account and cascades to delete parent and child profiles, conversations, reports, and related records from our active systems, with residual copies purged from backups on a rolling basis. Deletion is irreversible.

Security

We maintain a written information security program appropriate to the sensitivity of children's data. Measures include encryption of conversations in transit and at rest, hashing of passwords and child login PINs, access controls, and ongoing monitoring. No method of transmission or storage is 100% secure, but we work hard to protect your family's information and will notify affected users and regulators of a breach as required by law.

Your rights and choices

Regardless of where you live, through the Guardian app (Settings → Privacy & Data) or by emailing hi@kirbokids.com you can: access and review the information associated with your family; correct inaccurate information; export your data; delete a child profile or your entire account; and withdraw consent. We respond to verified requests within the timeframes required by applicable law.

Regional disclosures

United States (COPPA)

As the operator, Kirbo Labs, Inc. collects children's personal information only after verifiable parental consent and uses it as described above. Parents may review, delete, and refuse further collection of their child's information and revoke consent at any time using the controls described in the "A note for parents" section. Our contact details are at the end of this Policy.

California

We do not sell or "share" (as defined under the CCPA/CPRA) personal information, and we do not use it for cross-context behavioral advertising. California residents have rights to know, access, correct, and delete personal information, and the right not to be discriminated against for exercising them. Personal information of consumers under 16 is never sold or shared.

Canada (PIPEDA and Quebec Law 25)

We collect, use, and disclose personal information only for the purposes identified above and with meaningful consent. For children under 13 (and under 14 in Quebec), we rely on consent from a parent or guardian. We apply privacy-protective defaults for minors. You may access and correct your personal information and ask questions about our practices by contacting our Privacy Officer at hi@kirbokids.com. You also have the right to complain to the Office of the Privacy Commissioner of Canada or your provincial regulator.

Mexico (LFPDPPP)

For users in Mexico, Kirbo Labs, Inc. acts as data controller ("responsable"). We process personal data of minors prioritizing the best interest of the child, with consent provided by a parent or guardian under applicable civil-law rules of representation. The purposes of processing are those described in "How we use information." You may exercise your ARCO rights — Access, Rectification, Cancellation, and Opposition — and limit the use or disclosure of your data by emailing hi@kirbokids.com. This Policy serves as our privacy notice ("aviso de privacidad"); we will communicate material changes through the apps and on this page.

International data transfers

Kirbo's infrastructure and AI processing are hosted entirely in the United States, with reputable cloud and AI service providers acting on our behalf; we do not store or process your data outside the U.S. Kirbo Labs, Inc. is based in Calgary, Alberta, Canada. This means that if you and your child are located in Canada, Mexico, or elsewhere, your information is transferred to and processed in the United States, where it may be subject to U.S. law. By using Kirbo you understand and consent to this transfer, which is carried out under contractual and technical safeguards designed to protect your information consistent with this Policy and applicable law.

Age of users

Kirbo Guardian is for adults (18+) acting as a parent or legal guardian. Kirbo Kids is for children 4–16 whose parent or guardian has set up their profile and provided consent. We do not knowingly allow children to create accounts on their own. If you believe a child has used Kirbo without proper consent, contact us at hi@kirbokids.com and we will delete the information.

Changes to this Policy

We may update this Policy from time to time. If we make material changes — especially changes to how we collect or use children's information — we will notify parents through the Guardian app and, where required, obtain new consent before applying the change to previously collected information. The "Last updated" date shows the latest revision.

Contact us

Questions, requests, or complaints about privacy can be sent to our Privacy Officer at hi@kirbokids.com. Kirbo Labs, Inc., based in Calgary, Alberta, Canada, is the operator and data controller responsible for your family's information.