← Plan AI

Plan AI — Children's Privacy Notice

Effective date: `TO BE SUPPLIED: effective date

DRAFT — not yet publishable. The app has no age gate and no verifiable parental-consent mechanism. Until those exist, this notice cannot truthfully describe how consent is obtained. See COMPLIANCE-GAPS.md §1–§3.

This notice supplements the Privacy Policy. It is written for parents, guardians, and teachers, and it applies to every child who uses Plan AI.

1. Who this is for

Plan AI is a planner for children of roughly primary and lower-secondary school age (about 8–13). Children use it to organise homework, routines, and goals. A parent, guardian, or teacher is the responsible adult for the account.

Because our users are children, we hold ourselves to COPPA (United States), GDPR Art. 8 and the GDPR-K guidance (EEA), the UK Age Appropriate Design Code, and KVKK (Türkiye) — and we apply the strictest of them to everyone, rather than varying protection by country.

2. Our commitments

  1. We collect the least we can. An account so the child's plans are not lost,

and the plans themselves. Nothing else.

  1. No advertising, ever. No ad networks, no advertising identifiers, no

profiling for ads, no sponsored content.

  1. No tracking. No analytics SDK is active in the app. We do not measure which

screens a child visits or what they tap.

  1. No selling or sharing. We do not sell personal data and do not share it for

anyone else's marketing.

  1. No social features. There is no chat, no messaging, no friend list, no

public profile, no user-to-user contact of any kind. A child cannot be contacted by a stranger through Plan AI.

  1. No public content. Nothing a child writes is visible to any other user.
  2. No behavioural nudges to spend. Purchases live behind an adult-facing

screen, and the reward system uses only in-app points and prizes that the responsible adult defines themselves — never purchasable currency.

  1. No dark patterns. We do not use guilt, countdowns, or streak-loss pressure

to keep a child in the app.

3. What we collect from a child

Exactly what is listed in Privacy Policy §3. In short:

We do collect: an email address and optional display name for the account; the tasks, routines, and goals the child writes; their planning-style questionnaire answers; their theme choice; and, if they use it, a photo they choose to upload for the AI to read a timetable from.

We do not collect: location, camera or microphone access, contacts, biometrics, advertising identifiers, analytics or usage tracking, or any persistent identifier used to track the child across other apps or websites.

Stays only on the device: the entire reward system — points, the prize list, which wheels have been spun, and the parent PIN.

4. The planning-style profile is not an assessment

The in-app questionnaire produces a working-style summary used to suggest good times of day for different kinds of work.

It is not a psychological, medical, educational, or diagnostic assessment. It does not diagnose anything, it is not shared with schools or anyone else, it is not used to make decisions about the child, and it produces no score or ranking. It is a scheduling aid, and the child or the adult can delete or rewrite it at any time.

5. The AI features, explained plainly

When a child asks the app to build a plan, or uploads a photo of a timetable, the text or image is sent to our server, which passes it to Google's Gemini AI service and returns suggested tasks.

What this means for a parent:

  • Content leaves the device for that request. It goes to Google's AI service.
  • We do not store the uploaded image. Only the tasks produced from it are saved.
  • Nothing is automatic. Every suggestion can be edited, ignored, or deleted.
  • **Please talk to your child about not uploading photos of other children's

faces, home addresses, or medical or school records.** We show a reminder, but a conversation is more effective than a warning screen.

TO BE SUPPLIED: written confirmation from Google that paid Gemini API prompts are not used for model training. This is a children's-data question and must not be asserted on assumption. See COMPLIANCE-GAPS.md §7.

6. Parental consent

TO BE SUPPLIED: the consent mechanism does not exist yet. COPPA requires verifiable parental consent BEFORE any personal information is collected from a child under 13; GDPR Art. 8 requires consent from the holder of parental responsibility below the applicable age of digital consent. See PARENTAL_CONSENT.md for the proposed design and COMPLIANCE-GAPS.md §1–§2 for what must be built.

What must not be claimed: the app's 4-digit reward PIN is not parental consent. It is a local convenience lock stored unencrypted on the device (see §8). It must never be described, in this notice or anywhere else, as consent or as verification of an adult's identity.

7. Rights of the parent, guardian, or school

At any time you may:

  • See all personal data we hold about your child;
  • Correct anything inaccurate;
  • Delete your child's data and close the account;
  • Withdraw consent, after which we stop processing and delete the data;
  • Refuse any specific processing while continuing to use the rest of the app,

where that is technically possible;

  • Object to processing based on our legitimate interests.

Exercising any of these will never be made a condition of anything else, and we will not degrade the child's experience as a penalty for it.

Contact `TO BE SUPPLIED: privacy contact email address`. We verify that a request comes from the responsible adult before acting on it, so we do not disclose a child's data to the wrong person. We respond within 30 days.

Reviewer note, remove before publication: deletion and export are manual today — there is no in-app path. COMPLIANCE-GAPS.md §4–§5.

8. The parent PIN — an honest warning

The reward settings are protected by a 4-digit PIN so a child cannot casually change their own prize list.

  • It is stored unencrypted in the app's local storage on the device.
  • Anyone with technical access to the device can read it.
  • It is not a security control and not consent.

Do not reuse a PIN or password from anywhere else. Treat it as a lid, not a lock.

9. Schools and classroom use

If a school deploys Plan AI, the school is normally responsible for the lawful basis for its pupils' use, including any consent required under local law, and should carry out its own data-protection assessment.

TO BE SUPPLIED: a decision on whether school/classroom deployment is actually offered. The app currently has no class, roster, or school-tenancy features at all (COMPLIANCE-GAPS.md §3), so either this section should be removed or the features built. Do not publish a school offering the product cannot deliver.

10. If we learn we hold a child's data without proper consent

We delete it promptly and, where required, notify the parent or guardian and the relevant authority.

11. Changes

Material changes affecting children's data will be notified to the responsible adult, and where the law requires it we will obtain fresh consent rather than rely on notice alone.

12. Contact

TO BE SUPPLIED: registered legal entity name · TO BE SUPPLIED: registered company address in Türkiye · TO BE SUPPLIED: privacy contact email address