Privacy Policy

This Privacy Policy explains what information MyKidIsBad.com (the "Service") collects, how we use it, and the choices you have. We don't sell your data.

Information we collect

• Quiz answers and child's age range — what you enter when taking a test, used to score your results and generate your report. A small number of optional free-text questions let you type your own words about what's going on; that written content is stored encrypted, the same as Calm-Down Session content — see below.
• Email address — if you choose to save a report, create a free account, download our free guide, or contact us. Not required to take a test.
• Account sign-in information — if you register or sign in with a password, we store your email and a securely hashed password. If you choose to sign in with Google or Facebook instead, we receive and store the basic profile information those services share when you authorize it (your name, email, and profile photo/avatar), plus an identifier from that provider so we can recognize your account on a future sign-in. We never receive your Google or Facebook password.
• Child profiles — if you're a registered member, you can optionally add a name, age range, and private notes for one or more children, so your quiz results and calm-down sessions can be organized under that child over time. This is entirely optional — you can use every part of the Service without creating a child profile.
• Calm-Down Session content — if you use the Parent Stress Management tool, we store what you write about what's going on (your stated reason for the stress), the reflections you enter during the guided steps, the next step you choose, and your self-reported stress level before/after. This content is written by you, about your own experience in the moment, and is stored encrypted — see "How we protect sensitive free-text content" below.
• Report feedback — if you rate a report (thumbs up/down) and optionally add a comment, we store that rating and comment (encrypted, same as above) to improve future reports.
• Community Story Hub submissions and replies — if you share a story (a situation, what you tried, and an optional question) or reply to someone else's story with the guided feedback prompts, we store what you write (encrypted, same standard as above), your child's age range, and the topic you chose. It's posted under an anonymized display name we generate for your account — never your real name or email — and is reviewed (see "How we use it" below) before it's shown to other members. Reacting to a story or reply (an optional thumbs up/down) is stored against your account so you can change or remove your own reaction, but is shown to others only as an aggregate count, never who reacted.
• Community profile — Pro members can optionally add a short bio, how many kids they have, and a few custom sections to the public profile page attached to their anonymized display name. This is entirely optional, stored encrypted (same standard as above), and is never your real name or any other account detail — please don't include your child's name, your school, or your city. Any signed-in member (free or Pro) can view a community profile; only its owner can edit it.
• Chores & routine progress — if you build a chore/routine list, we store the routine's title, its schedule, the items you add, and which items get checked off on which day (so we can show progress and streaks). This is not sensitive content and is not encrypted, the same as any other structured list you build in the app.
• Levels and rewards — your points (XP), your current level, and which profile rewards you have earned, so the app can show your progress and pay each reward once.
• Parent Tips, Learning Circles and the Elder Circle — a tip you write on a guide, a Learning Circle you create or join, your check-ins in a circle, and your votes in Elder Circle polls. Tips and check-ins are free text, are stored encrypted, appear under your anonymized display name, and can be reported by other members and reviewed under our Community Guidelines. Poll votes are shown only as totals.
• Payment information — handled entirely by PayPal. We receive confirmation that a payment succeeded and a payer email if PayPal provides one; we never see or store your card or bank details.
• Technical and usage data — pages visited, where you click and scroll, how long you stay on a page, which form fields you use (never what you type), the page you came from and your journey between pages, a hashed version of your IP address (not the IP itself), a coarse device type (mobile/tablet/desktop), and a random visitor ID stored in a cookie. This is self-hosted analytics we run ourselves — we don't use third-party ad trackers. Only recorded if you choose "Accept all" in the cookie banner; see our Cookie Policy.
• Your consent choices — when and which version of this policy you accepted, and each kid-card/marketing/cookie consent you've given or withdrawn, with a timestamp and a hashed IP address — kept as our own record that we honored your choices, viewable in your own account's Privacy & Data page.

How we use it

• To score your quiz and generate your personalized report.
• To run the Parent Stress Management (Calm-Down Session) tool, including saving your progress through the guided steps so you can pick back up if you close the tab.
• To build the child profile view available to members — a private history and pattern view (for example, quiz scores over time and word-frequency "what keeps coming up" themes drawn from your own written stress reasons) for a child you've added. As of this writing, this is a browsable history and insights view only — it does not currently personalize or change how your AI-generated quiz reports or Calm-Down Sessions themselves are produced. If that changes in the future, we'll update this policy first.
• To process payments and unlock paid content.
• To email you a saved report, if you ask us to, or the free guide you requested.
• To improve future reports, using the ratings/comments you optionally leave on a report.
• To review a Community Story Hub submission before it's shown to other members — an automated check (batched, not sent the moment you submit) looks for personal information, harmful content, or spam/non-genuine submissions; a person on our team can also review or override that decision. Approved stories and replies are shown to other logged-in members under your anonymized display name.
• To occasionally email registered members about their account — for example a reminder if you've been away for a while, or a note about referral progress. Every one of these emails includes a one-click unsubscribe link, and we never send them to a report-only/non-member email address.
• To send the chore/routine reminders you set up by email.
• To show your progress and pay profile rewards, and to run Parent Tips, Learning Circles and Elder Circle polls, including safety review of what members post.
• To understand how the site is used and improve it (aggregate analytics only).
• To respond if you contact us.

Third parties we use

We rely on a small number of service providers to run the Service — this list is generated from the same registry our own admin team uses, so it can't drift out of date:

• PayPal — Payment processing for one-time report/deep-test purchases and recurring Academy subscriptions. Data shared: Purchase amount, a payer email PayPal provides on capture. We never see or store card/bank details.
• Anthropic (Claude API) — Generates the written explanation/action plan in a quiz report, and screens Community Story Hub submissions against posting guidelines before they're shown to other members. Data shared: Quiz answers (incl. optional free-text). Story submissions/replies are sent only for the guideline check, in a small batch. Never email, payment details, child-profile notes, or Calm-Down Session content.
• Mailgun — Sends transactional and account-related email (report links, receipts, reminders, the free guide). Data shared: Recipient email address and the email content being sent.
• Google (Sign-in with Google) — Optional OAuth sign-in/registration. Data shared: Basic profile info Google shares when authorized: name, email, profile photo, and a provider identifier.
• Facebook (Sign-in with Facebook) — Optional OAuth sign-in/registration. Data shared: Basic profile info Facebook shares when authorized: name, email, profile photo, and a provider identifier.
• Google reCAPTCHA — Bot/abuse prevention on registration, login, password-reset, and support-ticket forms. Data shared: IP address and interaction data needed to assess the request.

We don't sell your personal information, and we don't share it with any of these providers for advertising. The only advertising-related sharing is the optional Meta Pixel described under Cookies below, which is off unless you accept it. See Your Privacy Choices.

Cookies

We use first-party cookies (plus a small invite-link cookie, mkb_ref, if a member's invite link brought you here), described fully in our Cookie Policy: a login session cookie (strictly necessary — no way to opt out and stay signed in) and an analytics visitor ID for our own first-party analytics, which you can switch off at any time by choosing "Necessary only" in the cookie banner (or by sending a Global Privacy Control or Do Not Track signal). If you choose "Accept all," we also load the Meta Pixel on our public pages to measure and deliver our advertising on Facebook and Instagram; this shares the page you viewed and browser information with Meta, which may count as "sharing" for cross-context advertising under some state laws. It is off unless you accept, and it is never loaded in the admin area or your signed-in member dashboard, or when your browser sends a Global Privacy Control signal. You can change your choice at any time via "Cookie Preferences" in the footer.

Your rights, and how to exercise them

Regardless of where you live, you can: know what personal information we have about you; get a copy of it in a portable format; correct inaccurate information; delete your personal information; and opt out of the sale or sharing of your personal information (which, again, we don't do). If you're in the EEA, UK, or a jurisdiction with similar law, these map to your GDPR rights of access, portability, rectification, erasure, and objection/restriction, and you also have the right to lodge a complaint with your local data protection authority.

If you have an account, sign in and go to My Account → Privacy & Data for instant self-service: download all your data, manage your marketing preferences, or request account deletion. Anyone — with or without an account — can use Your Privacy Choices to file any of these requests by email; we respond within 30 days.

The legal basis we rely on for processing depends on what it is: taking the quiz and generating your report runs on your consent (given by using the feature) and our legitimate interest in providing the Service you asked for; a purchase runs on contract performance; marketing communications run on your explicit opt-in consent, which you can withdraw at any time using the methods described throughout this policy.

Data retention

Free and unlocked reports are automatically deleted after 48 hours unless you save them by entering your email, in which case we keep the report until you ask us to delete it. Village Journey progress, Parent Tips, Learning Circle check-ins, any older journal entries saved with your account (kept unused until you delete them or your account), child profiles, chore/routine history, Calm-Down Session history, Community Story Hub submissions/replies, your reactions, and your community profile (bio, kids count, custom sections) are kept for as long as your account exists, or until you ask us to delete them. Removing ("archiving") a child from your account stops it appearing in your lists but keeps its history intact under your account, in case you add that child back later — a full deletion is available on request (see "Your choices" below). Anonymous/aggregate analytics data is retained only as long as needed for the purposes described above.

Retention schedule: what we keep, for how long, and why

This table is generated from the same list our cleanup jobs use, so what it says is what runs. "Automatic" means a job deletes the data on schedule. "While your account exists" means it stays until you delete it or your account. Deleting your account purges your profile, photos and phone numbers at once and removes the rest within 30 days, except the payment and privacy records listed below.

How we protect sensitive free-text content

Anywhere you type your own words rather than picking from a list — what you type into a Calm-Down Session (your stated reason for the stress, your written reflections, and the next step you choose), private notes you add to a child profile, answers to the quiz's optional free-text questions, a saved report's email address, any comment you leave on report feedback, a Community Story Hub submission or reply (the situation, what you tried, your question, and the three guided reply prompts), your community profile's bio and custom sections, Parent Tips, Learning Circle check-ins, and any older private journal entries saved with your account — is encrypted at rest in our database, using the same field-level encryption across all of it. A child's phone number saved for text reminders is encrypted the same way, even though it isn't freeform text, since it's a piece of contact information for a minor. This content is never shown to your child (aside from the reminder texts they've been consented to receive), never shared with anyone else beyond what's described above, and is used only for the purposes described in this policy. An approved Community Story Hub submission or reply is the one exception by design — that's the point of posting it — and even then it's shown only under your anonymized display name, never your real name or email.

Not a crisis or emergency service

The Parent Stress Management tool is designed for ordinary, everyday parenting stress — it is not a crisis service, and using it does not connect you to a counselor, therapist, or emergency responder of any kind. If you or your child are in danger, the tool itself displays the 988 Suicide & Crisis Lifeline (call or text 988) and the Childhelp National Child Abuse Hotline (1-800-422-4453) — please contact one of those, or your local emergency services, instead of relying on this tool.

Children's privacy (COPPA)

We comply with the U.S. Children's Online Privacy Protection Act (COPPA). In short: only adults can create an account, we don't knowingly collect personal information directly from children under 13, and a parent can review, correct or delete any information about their child, or refuse further collection, at any time from Privacy & Data or by contacting us (see "Contact"). Any information about a child comes from the parent, and we do not contact children directly.

The Service is intended for use by adults — parents, guardians, and caregivers — answering questions about a child in their care. It is not directed at children, and we do not knowingly collect personal information directly from children under 13. Registration requires you to affirmatively confirm you're that child's parent or legal guardian and at least 18 years old. The information you provide about your child — an age range, behavioral answers, an optional child profile name/notes, chore/routine progress, and anything written during a Calm-Down Session — is provided by you, the adult user, not collected from the child, and a child profile is never visible to the child it describes. If you believe a child has provided us with personal information directly, please contact us and we'll remove it.

Two features reach a child (or other members) more directly, both entirely optional and off by default:

• Kid Cards — a Pro member can optionally attach one of their child's photos to a Community Story Hub post, shown to other signed-in members as "[anonymized display name]'s kid · [age range]" — never your child's real name. This requires a separate, explicit consent checkbox each time it's turned on, and can be turned off, or the photo deleted outright, at any time from that child's profile.

Your choices

• You can take a test and view a free/unlocked report without ever providing an email address.
• Adding a child profile, and attaching a quiz result or Calm-Down Session to a specific child, is entirely optional at every step.
• You can archive a child profile yourself at any time from "My Children," or permanently delete a child profile and everything linked to it — see below.
• If you have an account, Privacy & Data in your dashboard lets you instantly download everything we have on you (every record linked to your account, including journey, circle and tip data), manage your marketing preferences, or delete your account — no need to email us and wait. You can also edit or clear your own community profile (bio, kids count, custom sections) yourself at any time from its edit page.
• Anyone can use Your Privacy Choices to request access, correction, deletion, or an opt-out record without needing an account.
• You can unsubscribe from account-related emails at any time using the link in any of those emails, from the Privacy & Data page, or by emailing us — this never affects a transactional email like a receipt or a report you specifically asked to be sent.
• Anyone with access to a phone number you provided for reminders can reply STOP to any reminder text to immediately and permanently stop texts to that number, or HELP for program info.
• You can change your cookie choice at any time via "Cookie Preferences" in the footer — see our Cookie Policy.

Translation and push notifications

If you choose a language other than English, page text and some community content may be machine-translated by an automated translation service; the text sent for translation is the page or post content, not your account details. If you turn on browser push notifications, your browser gives us a push endpoint and encryption keys so we can send the alerts you chose; you can turn them off any time in your notification settings or your browser.

Data security

We protect your information both in transit and on our servers. Connections use HTTPS. Free-text content you write is encrypted at rest in our database with field-level encryption, and the service is configured to refuse to start in production without its encryption key. Passwords are never stored — only a salted, slow hash — and we require passwords of at least 10 characters that aren't on common-password lists. Sign-in sessions are protected cookies that expire, are renewed at sign-in, and are ended on every device when you reset your password. Payment details never touch our servers. Access to production data is limited to people who need it, and we keep our software and dependencies up to date and scan them for known vulnerabilities. No method of storage or transmission is 100% secure, so we can't guarantee absolute security; if a breach affecting your information occurs, we will notify you and the authorities as the law requires.

Job applicants and team contractors

If you apply to work with us through /careers, we collect what you enter (name, email, optional phone, U.S. state, availability and your written answers), store it encrypted, and use it only to evaluate and contact you. If you are not hired we delete it after a set period (about 12 months). If you join as an independent contractor we also keep your signed agreement, time records, payment records and the Form W-9 you submit (your taxpayer ID is stored encrypted), and we keep these records for at least four years for tax and legal reasons. Team members are bound by confidentiality and child-privacy rules and see members' content only through a restricted review tool that hides email addresses and children's profiles. See the applicant privacy notice.

Changes to this policy

We may update this Privacy Policy from time to time. The "last updated" date above reflects the most recent changes.

Contact

Questions about this policy, or want to exercise any of the choices above? Email us at support@mykidisbad.com.