Privacy Policy

Last updated: September 29, 2026 · Approved October 1, 2026

1. Data controller

Kai'Ros International Technologies ("KAIR"), operating TheWay, is the controller of the personal data collected through this service. Contact: support@trainup.family.

2. What we collect

• Account data: email, display name, timezone, password hash (via Supabase Auth).
• Family data: child names, dates of birth, avatars, developmental stage.
• Journal content: text entries, photos, videos, and audio you upload — including entries written by your child via invite code.
• Coaching data: messages you send to AI coaching, and summaries (not full transcripts) of those conversations.
• Billing data: Stripe customer ID, subscription status. We do not store card numbers — Stripe handles that.
• Trial record: when your free trial started and ends, and a one-way fingerprint (hash) of your email address, kept even after an account is deleted so a trial is given only once per address.
• Usage data: page views, feature use, and error reports for product improvement. Error reports are stored in our own database.
• Advertising measurement: on our public pages, sign-in, sign-up, the plans page and the settings page, Meta's browser identifiers (the _fbp / _fbc cookies Meta sets) and your browser's user agent.

3. How we use it

• To deliver the features you signed up for.
• To send account email (e.g., child-write notifications, badges, trial reminders) via Resend. We record whether an email was delivered and opened, to know if our reminders are useful; you can turn each kind of email off in Settings.
• To generate AI coaching via Anthropic's Claude API. Prompts sent to Anthropic are governed by Anthropic's data policies; Anthropic does not train on API inputs.
• To process payments via Stripe.
• To detect and prevent abuse (rate limiting, handled within our own servers).
• To monitor errors and uptime (in-house error logger + external uptime monitors).
• To measure our advertising on Facebook and Instagram: we tell Meta when one of these happens — a visit to a public page, a sign-up, a trial starting, your first night at The Table, viewing our plans, and a purchase (with its price).

4. Processors we share data with

• Supabase — database, authentication, file storage (entrusted-media bucket).
• Vercel — hosting and edge delivery.
• Anthropic — AI coaching (prompt + response, no training on API data).
• Stripe — payments.
• Resend — transactional email.
• Cloudflare — DNS for trainup.family, and delivery of messages you send to support@trainup.family (forwarded to our support inbox and our support log).
• Browser push services (Apple, Google, Mozilla) — delivering notifications, only if you turn them on.
• In-house error logger — errors stored in our own Supabase database, auto-purged after 90 days.
• Meta Platforms (Facebook, Instagram) — advertising measurement. For the events listed in section 3 we send Meta a one-way hash of your email address and of our account id, Meta's browser identifiers, your browser's user agent and IP address, and, for a purchase, the plan and price. Meta's browser pixel runs only on our public pages, sign-in and sign-up, the plans page, and the settings page you return to after paying, with its automatic data collection turned off. We never send Meta your children's names or profiles, your journal, your coaching, or anything you write, record or upload.

We do not sell personal data. We do not share journal content with marketing partners or advertisers.

5. Children's data

TheWay is designed for use by parents about their children. Children may write entries through invite codes issued by a parent; that writing is stored under the parent's account and visible only to the parent and (optionally, at age 18) the child via the Entrusted delivery. We do not advertise to children. Parents may delete child content at any time.

6. Row-level security

Every database table has Row-Level Security enabled. You can only read or write your own records. The server-side service role is used exclusively inside our API — never exposed to the browser.

7. Retention

Journal content is retained for the life of your subscription and for up to 18 years after a child's birth date to support Entrusted delivery, unless you delete it sooner. Billing records are retained for the period required by tax law. Error reports are auto-purged from our database after 90 days.

8. Your rights

• Access — request a copy of your data by emailing support.
• Correction — edit most fields from settings; email for the rest.
• Deletion — delete your account from settings, or email support. Deletion is applied within 30 days, subject to legal holds.
• Export — download your Entrusted journal as a PDF from the Entrusted page at any time.

9. Security

All traffic is TLS-encrypted. Passwords are hashed by Supabase Auth (bcrypt). Secrets (API keys, service role) live in Vercel environment variables and never in source code. We use rate limiting to mitigate abuse. Error logs are stored in our own database and auto-purged after 90 days.

10. International transfers

Our infrastructure providers (Supabase, Vercel, Anthropic, Stripe, Resend, Cloudflare, Meta) operate in the United States. If you use TheWay from outside the US, you consent to your data being processed in the US under these providers' data protection frameworks.

11. Changes to this policy

We will notify active users by email before material changes take effect.

Questions? Email support@trainup.family.