LvlUpKids Privacy Policy

Effective: September 27, 2026 · Last updated: November 4, 2026

This policy explains what information LvlUpKids collects, why, how we protect it, who can see it, how long we keep it, and the choices you have. It covers the LvlUpKids app and the LvlUp Companion app on iPhone, iPad and Android, and our website. We wrote it in plain language. If anything is unclear, email admin@lvlupkids.com.

1. Who we are

LvlUpKids and LvlUp Companion are operated by GIFTY App Solutions ("LvlUpKids", "we", "us"), 3385 E Russell Rd., Ste B, Las Vegas, NV 89120, United States. We decide how and why the information described here is processed, which makes us the "controller" or "business" under privacy laws. Contact: admin@lvlupkids.com.

"Parent" means the parent or legal guardian who creates the family account, and any co-parent or guardian they invite. "Child" means a child profile a parent creates. "Service" means our apps, website and support.

2. Information we collect

We collect information that parents give us, that the apps create as your family uses them, and that your child's phone shares with you through Companion, if you pair one. We also receive website-usage information when a visitor permits optional website analytics, as described in Section 2.8.

2.1 Parent account

2.2 Child profiles (entered by a parent)

A parent creates each child profile. It may include a first name or nickname, a preset avatar, an age, an optional birthday (day and month only, no year), and a PIN (stored as a secure hash). We use age to suggest fitting quests and set the guide's voice, and the birthday for birthday celebrations. Please do not enter a child's last name, address, school, email, phone number or photo in any field.

2.3 What your family creates in the app

• Quests, rewards, penalties and settings, and the XP, levels, streaks, savings goals, piggy-bank activity and progress that follow from them.
• Family feed posts, cheers and comments.
• Messages: secret chat (messages shown under a playful alias) and one-on-one family messages with text, emoji and stickers. Message text is end-to-end encrypted (Section 3). Parents can read their children's messages. Secret chat hides who wrote a message from other family members; our systems keep a technical identifier with each message so the app can show your own messages on your side.
• Family voice calls: calls go directly between your family's phones and are encrypted. When phones cannot connect directly, an encrypted relay carries the audio (Section 7). Calls are never recorded. To connect a call, the app briefly exchanges connection details, such as network addresses, between the phones; these are removed when the call ends. The family's call list keeps who started a call and when.
• Mini-games (such as Bingo and Memory): room codes, player names you enter, and game progress. Game rooms are deleted when they go idle.
• Device schedules: lock times a parent sets for a child's phone (for example Bedtime from 9 pm to 7 am), which phones they apply to, and any extra time a parent grants. They are stored with the family's data and sent to the child's paired phone.
• PIN change requests: when a child or co-parent asks to change a child's PIN, we keep who asked, which child it is for, and the new PIN as a secure one-way hash until the main parent approves or declines. The people involved are notified of the result.
• Login requests: when a child signs in on a new phone, the parents are asked to approve it, in the app and with a notification.
• Quest routines, goals and plans: the quest packs and paths a parent sets or makes, the goal a child picks, and a child's birthday treat plan.
• Pack codes: when a parent shares a quest pack, we store its title, schedule, quest names and XP under a short code such as PK-7KQ2 for 30 days. Anyone who has the code can see them, without signing in. No family or account details are included, so please don't put a child's name or other personal details in a pack you share.

2.4 From your child's phone, through LvlUp Companion (optional)

If a parent pairs a child's phone with Companion, it shares with that parent's family:

• Precise location, including in the background, so parents can see where the phone is and find it.
• The list of installed apps, so parents can choose which to pause, and screen-time and phone-use activity (such as time on screen and phone pick-ups) for the family's activity timeline.
• Device and pairing details needed to link the phone to your family and keep settings in sync, and the phone's protection status.

Companion also receives the device schedules a parent sets and follows them on the phone, even without an internet connection. Calls and emergency features always keep working.

Companion does not read call history, text messages or contacts, does not record what a child does inside apps, and its local VPN never sends internet traffic to us. See the LvlUp Companion notice for details.

2.5 Location in the parent app

The parent app shows how far away and in which direction your child's phone is. To do this it uses your own phone's location on your phone only; your location is not sent to us. The app does not load a map inside the app. When you tap Open in Maps, the child's phone location is handed to the maps app you choose (for example Apple Maps or Google Maps), at your request, and that app's own privacy terms apply.

2.6 Collected automatically in the apps

• Account and device identifiers: an account ID and push-notification tokens, so we can sign you in and deliver notifications.
• Error logs: short technical records of errors (for example which feature failed and when), so we can fix problems. They do not contain message text, names or locations.
• Optional analytics and crash reports: off unless a parent turns them on. If turned on, we learn which features are used and receive crash reports, without advertising identifiers. Children's sessions never send analytics.
• App security checks: our backend verifies that requests come from our genuine apps.

2.7 What our apps do not collect

Our apps do not collect advertising identifiers, contacts, browsing history, health information, payment card details, photos or recordings. We do not use your information to build advertising profiles.

2.8 Optional website analytics

Our website uses Google Analytics only after you choose Allow analytics or return with an unexpired saved choice. Google Analytics uses cookies to help us understand website visits, app-store link clicks, worksheet-download clicks and use of the chore-chart Print button. It also records standard session information. This website choice does not enable analytics in the LvlUpKids or LvlUp Companion apps or in children's app sessions.

We send the public page title and path, recognized campaign labels, and the origin of recognized search, social or AI referral websites. We exclude raw query strings, referrer paths and fragments, and do not send names, quest text, reward text or anything you type into the chore chart. Google receives analytics cookie identifiers and technical website-usage information, including browser, device and network information associated with your requests. We do not enable advertising personalization or Google Signals for this website measurement.

Choose No thanks to leave website analytics off. You can change your choice using Analytics preferences in the website footer. We remember your choice in this browser for up to 180 days, and our configured analytics cookies expire after up to 180 days unless cleared sooner. Withdrawing permission stops future analytics events from this integration and clears its standard analytics cookies; it does not erase data already sent or cancel requests already in progress.

This choice applies to Google Analytics, not other existing website services. For information about Google's handling of information, see Google's privacy policy.

2.9 LvlUpKids in ChatGPT and Claude (optional)

You can use LvlUpKids inside ChatGPT (OpenAI) or Claude (Anthropic) to browse ready-made chore and routine plans and get a plan code to add one to the app. This works without signing in to LvlUpKids.

• What we receive: only the choices needed to build a plan from our own catalog, such as a plan type (for example morning routine), a general age range (for example ages 7 to 9) and which listed quests and rewards to include. Our tools do not accept names, ages, free text or any information about your family. We do not receive your conversation.
• Plan codes: when you ask for a code, we store the chosen plan (catalog items only, with no personal information) under a short code such as LVL-7KQ2 for 30 days. Anyone who has the code can see that generic plan at lvlupkids.com/p/ followed by the code. A plan is only added to a family when a signed-in parent enters the code in the LvlUpKids app and chooses which children get it.
• Abuse prevention: to limit how many codes can be created, we keep a counter based on a one-way hash of the network address and the hour. It cannot be used to identify you and is deleted automatically within a few days.
• ChatGPT and Claude themselves: OpenAI and Anthropic process what you type in their apps under their own privacy policies. Please don't share your children's details in those conversations.

3. End-to-end encryption

Family messages (secret chat, one-on-one family messages and feed comments) are end-to-end encrypted. The text is locked on the sender's phone with a key that only your family's approved phones hold, and unlocked on the recipient's phone. Our servers store only the locked version, so neither we nor our service providers can read it.

• A parent approves each new phone before it can read family messages.
• When encryption is set up, the parent receives a recovery key. It is the only way to restore access to encrypted messages if every family phone is lost. We do not have a copy and cannot recover it for you.
• Notifications about new messages say who a message is from, never what it says.
• Some information cannot be end-to-end encrypted because the service needs it to work, such as your sign-in details, push tokens, subscription status, and XP and quest status that drive rewards and weekly summaries. That information is still encrypted in transit and at rest (Section 11).

4. Phone permissions

5. How we use information

We use information only to:

• provide the Service to your family: accounts, profiles, quests, rewards, the feed, messages, calls, games, location and screen-time features;
• keep accounts and families secure: sign-in, PINs, approvals, abuse prevention;
• send the notifications you enable;
• answer support requests and privacy requests;
• fix problems and improve the apps, using error logs and, only if a parent turns them on, app analytics and crash reports;
• understand website visits and use, only when the visitor permits website analytics; and
• meet legal obligations.

We do not sell information. We do not use it for advertising, marketing to children, or behavioral profiling. We do not use children's information to train artificial intelligence models. We do not make automated decisions with legal or similar effects on anyone. Our legal bases, where the law requires them, are performing our contract with you, your consent (which you can withdraw), our legitimate interest in a secure and working service, and legal obligations.

6. Children's privacy

LvlUpKids is built for families and is managed by parents.

• Parent-managed. Only an adult parent or guardian can create an account, and doing so requires a verified phone number. Children never create accounts or give us contact details. A child opens their view with a PIN or a QR code that a parent approves.
• Parental consent. Laws such as the U.S. Children's Online Privacy Protection Act (COPPA) require verifiable parental consent before collecting a child's information. The parent is the account holder and decides what is entered and whether Companion is installed. We treat the parent's creation of a phone-verified account and of each child profile, and the pairing of Companion, as that consent. A parent can withdraw consent at any time by deleting the profile, unpairing Companion, or deleting the account.
• Family only. A child can see and message only members of their own family. There are no public profiles, no search and no contact with people outside the family. (Mini-game rooms are the only place a family may invite others, by sharing a room code. A parent may also share a quest pack with another parent by code; children cannot.)
• No ads, no sale, no profiling. We never show ads, sell children's information, or use it for marketing or profiling.
• Parents' rights. A parent can review a child's information in the app, correct it, delete it, refuse further collection, or ask us to do any of this (Section 10).

If we learn that we collected a child's information without a parent's involvement, we will delete it. Tell us at admin@lvlupkids.com.

7. Service providers

We use the following providers to run the Service. Optional website analytics is separate from app services and is described in Section 2.8.

Our apps contain no advertising networks, data brokers, or social media tracking tools.

8. When information is disclosed

We do not sell, rent or trade personal information, and we do not share it for cross-context behavioral advertising. We disclose information only:

• within your family, as the app is designed to (for example, parents see their children's activity and messages);
• to our service providers in Section 7, to run the Service;
• at your direction, for example when you open a location in your maps app or share a game room code;
• for legal reasons: if required by law, subpoena, court order or other legal process; to protect the safety of a child or anyone else; to investigate fraud, abuse or security incidents; or to enforce our terms. Where lawful, we will tell you first. End-to-end encrypted messages cannot be read by us and so cannot be disclosed in readable form; and
• in a business transfer, such as a merger or sale of the business, in which case this policy continues to apply to your information.

9. How long we keep information

When information is deleted, it is removed from our active systems. Copies in our providers' routine backups expire on those providers' schedules.

10. Deleting your information

• In the app: a parent can delete individual items, a child profile, or the whole family account (Settings). Deleting the account removes the family's data from our active systems.
• Without the app: use the data deletion request form, or email admin@lvlupkids.com from or about the phone number on the account.

We verify that a request comes from the parent who controls the account before acting, and we reply within 30 days (or sooner where the law requires).

11. How we protect information

• End-to-end encryption for family messages (Section 3).
• Encryption in transit (TLS) for everything, and encryption at rest on our providers' servers.
• Backend access rules that limit each family's data to that family, and each child and device to what they need.
• PINs and access codes stored only as one-way hashes; parent approval for new phones and child logins.
• App security checks so only our genuine apps reach our backend.

No system is perfectly secure. If a security incident affects your information, we will notify you and authorities as the law requires.

12. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your information, to object to or restrict certain processing, to withdraw consent, and to complain to a data protection authority. You can do most of this in the app. For anything else, email admin@lvlupkids.com. We will not treat you differently for using your rights. You may use an authorized agent; we may ask them to show your permission.

13. United States state privacy notice

This section applies to residents of California and other states with consumer privacy laws. In the last 12 months we collected these categories: identifiers (phone number, account ID, push tokens, and website analytics cookie identifiers only if a visitor opts in); personal records (names); commercial information (subscription status); internet or network activity (error logs, app usage only if a parent opts in, and website usage only if a visitor opts in); geolocation (a child's phone location, through Companion, if paired); and other information you create in the app (quests, feed, encrypted messages). Sources, purposes and recipients are described above. We do not sell or share personal information as those laws define it, and we have no actual knowledge of selling or sharing information of anyone under 16. We do not use sensitive personal information for purposes that would require a right to limit. California residents under 18 may ask us to remove content they posted by emailing us.

14. EEA, United Kingdom and Switzerland

If you are in these regions, you have the rights in Section 12 under the GDPR or equivalent laws, and you can complain to your local data protection authority. The legal bases we rely on are listed in Section 5.

15. International transfers

We are based in the United States, and our providers store and process information in the United States and possibly other countries. Where the law requires, we rely on safeguards such as the European Commission's Standard Contractual Clauses offered by our providers.

16. Changes to this policy

We will post changes on this page with a new "Last updated" date. For significant changes, we will tell parents in the app before they take effect.

17. Contact us

GIFTY App Solutions · LvlUpKids
3385 E Russell Rd., Ste B, Las Vegas, NV 89120, United States
Privacy, deletion and support: admin@lvlupkids.com
Deletion requests: lvlupkids.com/data-deletion-request.html