Privacy Policy

Last updated: September 25, 2026

Children do not have accounts

A child never creates an account, and never provides an email address or password. Only a parent — whose identity is verified through Apple or Clerk sign-in as an adult — creates and fully controls each child profile from within the app.

What we collect

Parent data

Collected via Clerk, our authentication provider:

• Email address, display name, and login credentials (managed entirely by Clerk — we never see the password).
• Subscription and entitlement status (via RevenueCat — see below).
• An optional preference for whether to receive email reports.

Child data

Entered or generated only inside the app, and controlled by the parent:

• The child's first name, used as their display name in the app.
• An avatar selection — a stylized illustrated icon the child picks, not a photo.
• Their current reading level.
• Reading activity: which passages they've read, time spent, completion status, which multiple-choice answer option they selected on quizzes (we store which option was picked, not free-text answers), whether responses were correct, response timing, streaks, XP, and badges earned.

This activity data is used to personalize passage difficulty and to generate progress reports for the parent.

No ads, no third-party analytics or tracking

LevelReads shows no advertising, includes no third-party analytics or advertising SDKs, and does not track users across apps or websites. We do not sell or share any data for advertising purposes. Subscription handling via RevenueCat is configured with device-identifier collection explicitly disabled, and no advertising-attribution identifiers are collected.

Service providers

• Clerk — manages parent sign-in and authentication; holds the parent's email and login credentials.
• Convex — our application database and backend; stores the parent and child data described above.
• OpenAI — generates the weekly written reading-progress report shown to parents. The child's real name is never sent to OpenAI — the request uses a generic placeholder ("the reader") in its place, and the child's name is swapped back in afterward, locally, before the report is shown to the parent. What is sent: the titles and reading levels of the passages read that week; the app's own computed weekly reading results (accuracy, comprehension, reading-rate, and time-on-page classifications, with the plain-language explanations behind them); how many passages were read and re-read that week; an effort classification for each read (engaged, rushed, or an effortful miss); for missed questions, which comprehension skill was involved and how the wrong answer and its timing are classified — never the answer text itself; and, in some weeks, how many passages were started but not finished. Raw quiz questions, answer text, and any persistent identifier are not sent. Some daily-summary reports are generated automatically from stored statistics without contacting OpenAI at all.
• RevenueCat — manages subscription purchases and entitlement status; receives only the parent's account identifier (never a child's), and device-identifier collection is disabled.
• Apple — processes App Store subscription payments and, for Sign in with Apple users, authentication.

Terms of Use

LevelReads Pro and LevelReads Family are auto-renewing subscriptions purchased through the App Store. By subscribing, you agree to Apple's standard terms for auto-renewing subscriptions, in Apple's Licensed Application End User License Agreement: Apple's Standard EULA.

Retention and deletion

Data is kept while the account or child profile exists.

• A parent can permanently delete a single child's profile (removing that child's reading history, progress, and badges) from Parent Mode → tap the child → "Delete Profile".
• A parent can permanently delete their entire account and all child profiles under it from Settings → "Delete My Account" (two confirmation steps).

Both are immediate, permanent deletions, not deactivations. Parents can also request deletion by emailing support@kvalabs.com.

Data retention policy

This section sets out, as required by the COPPA Rule, what children's personal information we keep, why, for how long, and how it is deleted.

• What is kept: the child data described above — first name, avatar selection, reading level, and reading activity (passages read, time spent, completion status, which multiple-choice option was selected, streaks, XP, and badges).
• Why: to operate the app's reading personalization (choosing the right passages and difficulty for that child) and to generate the parent's progress reports. We do not use this data for advertising or marketing.
• How long: until the child's profile or the parent's account is deleted. There is no fixed retention period beyond that — the data is not kept indefinitely, and is not retained past the purposes above.
• How it's deleted: permanently and immediately, using the "Delete Profile" and "Delete My Account" mechanisms described above, or by emailing support@kvalabs.com — not a deactivation or soft-delete.

Third parties that receive children's personal information

The COPPA Rule requires us to identify each third party that receives children's personal information and the purpose for that disclosure. Only two do:

• Convex — our application database. It stores all of the child data listed above, for the sole purpose of running the app (nothing is disclosed to Convex beyond what's needed to store and serve it back to the app).
• OpenAI — receives the titles and reading levels of the passages read that week and the app's own computed weekly reading results, for the sole purpose of generating the weekly written parent progress report. It never receives the child's real name (see "Service providers" above for the full detail on what is and isn't sent).

Clerk and RevenueCat do not receive any child's personal information — they only ever see the parent's own account identifier (email/login for Clerk, subscription/entitlement identifier for RevenueCat).

How we keep data secure

LevelReads maintains a written information security program appropriate to the data it handles.

• Encrypted in transit: all connections between the app and our service providers use encrypted HTTPS/TLS.
• Encrypted at rest: Convex and Clerk, our database and authentication providers, encrypt data at rest.
• Limited access: the operator is the only person with administrative access to the systems described here.
• No passwords handled by us: sign-in is managed entirely by Clerk — we never see or store a parent's password.
• Parental gate: a parent must solve a quick math check before reaching Parent Mode (including Settings) or before any outbound link, such as this policy or our support page, opens from within the app.
• No ads or tracking: as described above, LevelReads shows no advertising and includes no third-party analytics or tracking SDKs.
• Breach notification: if a security incident affects your data, we will notify affected parents by email as soon as possible.

Parental rights

A parent may at any time:

• Review what's stored about their child from within the app.
• Delete a child's profile or their whole account, as described above.
• Stop further collection simply by deleting the relevant profile or account.
• Contact support@kvalabs.com with any request or question.

COPPA statement

LevelReads is used by children, and only a parent can sign in. We do not knowingly collect personal information directly from children. All child profiles are created and controlled by a parent; a parental gate (the parent's Face ID or device passcode, or their LevelReads account sign-in) stands between a child and any purchase flow, parent area, or link that leaves the app. We collect only what is needed to operate the reading and progress-tracking features described above, and we do not use child data for advertising or marketing.

Where data is stored

Application data is stored in our Convex database (Convex's cloud infrastructure). Authentication data is held by Clerk. OpenAI processes this data only to generate the response; per OpenAI's API terms, API data is not used to train their models.

Changes to this policy

We'll update the "Last updated" date above and, for material changes, note them on this page.

---