Cubsly — AI for curious kids and careful parents · Last updated: 10 July 2026
The short version: Cubsly is built for parents. Your child's data belongs to your
family: it is encrypted with keys unique to your family, every conversation is visible to you, we
never show your child ads or engagement tricks, and when you delete your data we destroy the
encryption keys so it is unrecoverable — including from backups.
Who we are
Cubsly ("we", "us") provides an AI learning tutor for children with full parental visibility,
operated from the United Arab Emirates. Contact: privacy@cubsly.com.
What we collect
From you (the parent): your email address, a password (stored only as a
cryptographic hash) or your Google sign-in identity, and payment details (held by Stripe — we never
see card numbers).
About your child (created by you): a display name, age band, language preference,
and the content of your child's conversations with the tutor, plus learning signals we derive from
them (topics, skills, vocabulary) to produce your weekly insight.
We collect no advertising identifiers, no location data, and no data from third-party trackers.
There are no ads.
How your child's data is protected
Per-family encryption. Personal data is encrypted at rest with a key unique to
your family; each child additionally has their own sub-key.
Safety screening. Every message to and from the tutor passes safety
classification, in English and Arabic, before your child sees a reply.
Full parental transparency. You can read every conversation. Your child is told
this inside the app — there is no secret monitoring.
No AI companionship. The tutor is designed to teach, never to form an emotional
bond, claim feelings, or pull your child back to the screen.
Who processes data on our behalf
OpenAI — powers tutoring and safety classification. Conversations are processed
to generate replies; we send no names, addresses, or account identifiers with them.
Stripe — subscription payments and invoices.
Microsoft 365 — transactional email (verification codes, notifications).
We do not sell or share personal data with anyone else.
Consent
A child profile only works after you, the parent, give explicit consent for data processing and AI
interaction (voice input and weekly insights are separate, optional consents). You can revoke
consents at any time in Settings; revoking makes the child profile inert.
Retention and deletion
Raw conversation transcripts older than 12 months are automatically trimmed; derived learning
insights persist until you delete them.
Delete one child: permanently removes that child's data and destroys their
encryption sub-key. Siblings are unaffected.
Delete your family: after a 14-day grace window (children are paused
immediately; any parent can cancel), everything is deleted and your family's encryption key is
destroyed — making remaining ciphertext unrecoverable, including in backups. You receive a
deletion receipt.
Export: you can download all of your family's data as JSON at any time from the
Privacy tab.
Your rights
In line with the UAE Personal Data Protection Law (PDPL) and comparable frameworks, you may access,
export, correct, or delete your family's data — all available directly in the app, or by writing to
privacy@cubsly.com.
Duty of care
If a conversation indicates a child may be at risk (for example self-harm), we notify the parent
and our safeguarding review. Indications of abuse are escalated to our safeguarding review only,
in the child's interest.
Changes
We will post any changes here and, for material changes, notify you by email.