Privacy Policy

Cubsly — AI for curious kids and careful parents · Last updated: 11 July 2026

The short version: Cubsly is built for parents. Your child's data belongs to your family: it is encrypted with keys unique to your family, every conversation is visible to you, we never show your child ads or engagement tricks. Active deleted data is removed immediately (or after the family grace period); encrypted backups expire within 7 days and deletion tombstones prevent deleted records from being served after a restore.

Who we are

Cubsly ("we", "us") provides an AI learning tutor for children with full parental visibility, operated from the United Arab Emirates. Contact: privacy@cubsly.com.

What we collect

From you (the parent): your email address, a password (stored only as a cryptographic hash) or your Google sign-in identity, and payment details (held by Stripe — we never see card numbers).

About your child (created by you): a display name, age band, language preference, and the content of your child's conversations with the tutor, plus learning signals we derive from them (topics, skills, vocabulary) to produce your weekly insight.

We collect no advertising identifiers, no location data, and no data from third-party trackers. There are no ads.

How your child's data is protected

Per-family encryption. Personal data is encrypted at rest with a key unique to your family; each child additionally has their own sub-key.
Safety screening. Every message to and from the tutor passes safety classification, in English and Arabic, before your child sees a reply.
Full parental transparency. You can read every conversation. Your child is told this inside the app — there is no secret monitoring.
No AI companionship. The tutor is designed to teach, never to form an emotional bond, claim feelings, or pull your child back to the screen.

Who processes data on our behalf

OpenAI — powers tutoring and safety classification. Conversations are processed to generate replies; we send no names, addresses, or account identifiers with them.
Stripe — subscription payments and invoices.
Microsoft 365 — transactional email (verification codes, notifications).

We do not sell or share personal data with anyone else.

Consent

A child profile only works after you, the parent, give explicit consent for data processing and AI interaction (voice input and weekly insights are separate, optional consents). You can revoke consents at any time in Settings; revoking makes the child profile inert.

Retention and deletion

Raw conversation transcripts older than 12 months are automatically trimmed; derived learning insights persist until you delete them.
Delete one child: permanently removes that child's data and destroys their encryption sub-key. Siblings are unaffected.
Delete your family: after a 14-day grace window (children are paused immediately; any parent can cancel), active data is deleted. Encrypted backups may retain records for no more than 7 days. A write-once tombstone is replayed before restored systems start. You receive a deletion receipt.
Export: you can download all of your family's data as JSON at any time from the Privacy tab.

Your rights

In line with the UAE Personal Data Protection Law (PDPL) and comparable frameworks, you may access, export, correct, or delete your family's data — all available directly in the app, or by writing to privacy@cubsly.com.

Duty of care

If a conversation indicates a child may be at risk (for example self-harm), we notify the parent and our safeguarding review. Indications of abuse are escalated to our safeguarding review only, in the child's interest.

Cookies and local storage

Cubsly uses no advertising, analytics, or tracking cookies. We set only what the service strictly needs to work: two sign-in cookies (one for the parent session, one for a child session) and one security cookie that protects forms against forgery. Your browser also remembers two preferences on your device — language and light/dark theme. None of this identifies you to third parties or follows you across the web, which is why we don't show a cookie consent banner: the law reserves consent for tracking, and we don't track.

Changes

We will post any changes here and, for material changes, notify you by email.