Skip to content

Last updated: July 2026

Privacy Policy

KeenClimb is a family-managed learning platform. This policy explains what information we collect from parents and child profiles, how we use it, what we do not do with it, and how families can review, correct, export, or delete their data.

Who controls a KeenClimb account

  • A KeenClimb account must be created and managed by an adult parent or legal guardian.
  • Children use child profiles under the adult account; children cannot create independent accounts.
  • The adult account holder is responsible for choosing child settings, reviewing progress, and deciding whether a child profile remains active.
  • If a school, tutor, or organization helps a family use KeenClimb, the parent or guardian still controls the family account unless a separate written agreement says otherwise.

Information we collect from adults

  • Account information: email address, display name, password hash, locale, and basic account status.
  • Security information: login events, refresh-token records, CSRF token state, IP address, device/browser metadata, and fraud-prevention signals.
  • Consent records: time, IP address, account email, and policy version accepted for Terms, Privacy, COPPA, and other required notices.
  • Billing information if you subscribe: plan, billing status, invoices, and payment processor identifiers. Card numbers are processed by Stripe and are not stored by KeenClimb.
  • Support messages and operational communications you send to us, including attachments or details you choose to include.

Information we collect about child profiles

  • Profile details chosen by the adult: first name or nickname, date of birth or age band, country/locale, and learning experience mode.
  • Learning activity: assigned lessons, answers, attempts, completion status, timing, progress events, skill state, mastery estimates, and review history.
  • Support preferences selected by the adult, such as pacing, reading support, interface preferences, or learning accommodations.
  • Offline learning state needed to resume lessons and sync progress when the device reconnects.
  • We do not require a child email address, phone number, mailing address, exact location, photo, video, voice recording, or government ID.

Information we intentionally do not use

  • We do not sell personal information or children's information.
  • We do not use child profile data for behavioral advertising, retargeting, or ad measurement.
  • We do not allow social profiles, public child profiles, open chat, follower systems, or direct messaging for children.
  • We do not ask for diagnoses or medical labels. Support preferences are functional learning settings selected by the adult.
  • We do not knowingly collect precise geolocation from children.

How we use information

  • Provide the learning service: create accounts, run lessons, remember progress, sync offline activity, and show parent dashboards.
  • Personalize learning: select age-appropriate content, adapt pacing, choose review/remediation tasks, and apply support preferences.
  • Keep the service secure: authenticate sessions, prevent account abuse, enforce rate limits, investigate incidents, and maintain audit logs.
  • Operate subscriptions and support: process payments, send account notices, respond to support requests, and communicate material service or policy changes.
  • Improve the product using aggregated or de-identified information that does not identify a child or family.

Legal bases and children's privacy

  • For parents and guardians, we process account data to perform the service contract, comply with law, protect legitimate security interests, and honor consent where consent is required.
  • For children under 13, KeenClimb is designed around verifiable parental consent and parent-managed child profiles.
  • For users in the UK or EEA, we apply data minimization, purpose limitation, high privacy defaults for children, and family-accessible explanations.
  • Where laws conflict or require a different process, we will apply the higher child-privacy protection where reasonably possible.

When we share information

  • Service providers may process data for hosting, infrastructure, email delivery, payments, security, monitoring, and customer support, under contracts that restrict their use of the data.
  • Stripe processes payment details when you subscribe; KeenClimb receives billing status and processor identifiers, not full card numbers.
  • We may disclose information if required by law, court order, or a valid government request, and we will challenge overbroad requests where appropriate.
  • We may share limited information to protect users, investigate abuse, prevent fraud, or respond to security incidents.
  • If KeenClimb is involved in a merger, acquisition, financing, or asset transfer, we will require continued protection of family and child data and notify affected users where required.

Your rights and choices

  • Access: request a copy of account, child profile, consent, billing status, and learning progress data we hold about your family.
  • Correction: update inaccurate account or child profile information from settings or by contacting us.
  • Deletion: delete a child profile or family account, subject to limited legal, security, billing, and audit retention requirements.
  • Portability: request an export of your family data in a structured format such as JSON.
  • Objection and restriction: ask us to limit certain processing where applicable law gives you that right.
  • To exercise any privacy right, contact [email protected] from the email address associated with your account.

Retention and deletion

  • Active account and child profile data is retained while the account is active or as needed to provide the service.
  • After account or child-profile deletion, production data is scheduled for deletion within 30 days unless a longer period is legally required.
  • Backups and security logs may persist for a limited period before automatic rotation, but are not used for ordinary product features.
  • Consent, billing, tax, dispute, security, and audit records may be retained as needed to meet legal obligations, resolve disputes, and protect the service.
  • Aggregated or de-identified statistics may be retained longer when they no longer identify a child, parent, household, or device.

Security

  • KeenClimb uses HTTPS/TLS in transit, encrypted storage where supported, hashed passwords, short-lived access tokens, httpOnly refresh cookies, CSRF protection, and server-side refresh-token rotation.
  • Access to production systems and personal data is limited to authorized personnel and service providers with a need to know.
  • No internet service can be guaranteed perfectly secure. If we discover a breach that affects personal data, we will notify affected families and regulators where required by law.