Privacy Policy

1. Who we are

SteadyBounds is provided by Vantaryn Labs LLC (“Vantaryn Labs,” “we,” “us” or “our”), a Wyoming limited liability company. We are responsible for the personal information described in this Privacy Policy. You can reach us at hello@steadybounds.com, by phone at (307) 393-5609, or by mail at 30 N Gould St #69108, Sheridan, WY 82801, United States.

This policy explains how we handle information when you use the SteadyBounds app for iPhone and iPad (the “app”), our website at https://steadybounds.com (the “website”) and our support channels (together, “SteadyBounds”). Please read it together with our Terms of Use.

In this policy, “parent” means a parent or legal guardian who uses SteadyBounds to manage a child’s device, and “child” means a child whose profile a parent adds. Apple provides the App Store, Apple Accounts, Family Sharing and the Screen Time system on your devices. Apple’s own privacy policy, not this one, governs how Apple handles information.

2. Information we collect

What we collect depends on the features your family uses. To use SteadyBounds, a parent must give us an email address and password and, for each child, a name or nickname and an age from 3 to 17. Everything else is either created as your family uses the app or is optional.

Information parents give us

• Parent account. Your email address, your password, the account ID we assign, the display name you choose and an optional profile photo. We ask you to confirm your email address by entering a code we email to it. If the code isn’t entered within 7 days, we delete the sign-up, including the email address. Our sign-in provider stores your password only in a scrambled (hashed) form, so we can’t see it.
• Family details. Your family’s name (optional), its time zone (taken from your device), and which parents belong to the family and whether each is the owner or an invited parent.
• Invitations. If you invite another parent, the email address you enter. We keep it only in a scrambled (hashed) form that we use to check that the right person accepts.
• Child profiles. Each child’s name or nickname (a nickname is fine), age, lesson level and Fresh Math limit, an avatar or an optional photo you choose, and settings such as school days and whether your child may ask for more time. We use age to choose starting learning levels, limit how far Fresh Math can step down, and apply the teen protections described in Section 7.
• Rules and settings. Daily limits, bedtimes, school time, breaks, pauses, extra time you give, Time Bank settings, learning and reward settings, website rules (the web addresses you type) and the apps you choose. Section 3 explains how app choices are handled.
• Saved places (optional, part of SteadyBounds Premium). Places a parent saves for place alerts: the name you give each one (such as Home or School), a point on the map and the size of the circle around it. When you search for an address to save a place, Apple Maps receives the text you type (Section 6).
• Family activity. Chores and tasks you create and their instructions, rewards you describe, your approvals and declines, a family plan if you write one, and messages you send in family chat.
• Reports and support messages. Chat safety reports you submit, and anything you send us by email.
• Consent records. Which version of this Privacy Policy and our Terms you accepted, and when; which version of our notice to parents we emailed you, when, and when you entered its code; whether you gave or declined consent in the app, and when; when we sent the confirming emails described in Section 7, and whether they could be delivered; and whether and how consent was withdrawn or disputed, and when. We don’t receive card details.

Information from children’s use of SteadyBounds, set up by a parent

Children use SteadyBounds on a device their parent has connected. They do not create an account, sign in with an email address or give us contact information. When a child uses the app, we collect:

• Learning activity. Answers your child submits, results (including how many steps or questions your child got right on the first try), progress, completed activities and time earned. Most activities send answers when your child finishes; in adaptive math practice, each answer is sent when your child checks it. Hints your child uses and the detailed miss and wrong-choice history for fixed lessons stay on the device.
• Requests and tasks. Requests for more time, including any reason or note your child adds, and chores your child marks as done.
• Family chat. If a parent adds your child to a family conversation, the messages your child sends and any chat safety reports, blocks or mutes your child uses. Children can chat only with their own parents and guardians in the family (Section 7).

Information collected automatically from devices

• Device and connection details. A name for each connected device (usually a general name such as “iPad,” or one that includes a nickname entered during setup), an ID we assign to it, a sign-in credential for that device (we keep only a scrambled version), pairing records, which child the device belongs to, when it last connected and whether it has applied your latest settings.
• Screen Time status and daily time totals. Described in Section 3.
• Notification token. If you allow notifications, the token Apple provides so we can send notifications to that device.
• Technical information. Like most online services, our servers and service providers receive your device’s IP address and the basic technical details a device sends when it connects, such as app and operating system version. We use this to run SteadyBounds, keep sign-ins secure and limit abuse. For example, we limit repeated pairing attempts using a scrambled form of the IP address, which expires after a day and is then deleted during routine cleanup.
• Location (optional). Only if a parent turns on location sharing for a child’s device and that device also grants Apple’s location permission: the device’s most recent location, how accurate it is and when it was recorded. Parents’ devices do not share their location.
• Place arrivals and departures (optional, part of SteadyBounds Premium). Only if a parent turns on place alerts for a child, and that child’s device has location sharing on and allows Apple’s “Always” location permission: when the device arrives at or leaves one of the places the family saved, which place it was, and when. The device checks this itself with Apple’s location services and sends us only the place, whether it arrived or left, and the time. It doesn’t send its position for this, and we don’t keep a route or a map of where it went. If place alerts aren’t available to your family because it doesn’t have Premium, the device stops checking and we collect no new arrivals or departures.
• Widget and alert credential (parents’ devices, part of SteadyBounds Premium). If you use SteadyBounds Home Screen widgets or place alerts, the app on your phone gets a separate, read-only credential. It lets the widget refresh each child’s time left and the number of waiting requests, and lets a place alert show the child’s first name and the place name, while the app is closed. We keep only a scrambled version of it, with a random ID for that app installation, your account, when it was issued, when it expires and when it was last used. It can only read that information. It can’t change anything.
• Bedtime activity (optional, part of SteadyBounds Premium). Only if a parent turns on bedtime activity alerts for a child: the date and time Apple reports that the child’s device was first used during a bedtime period. It does not include which apps were used or every time the device was unlocked. If bedtime activity alerts aren’t available to your family because it doesn’t have Premium, we collect no new bedtime activity, even if the setting is on, and observations we already have are still deleted once they are 30 days old.
• Crash reports from Apple. If you have turned on the iOS “Share with App Developers” setting, Apple may share crash reports and basic diagnostic information about SteadyBounds with us. You can turn this off in Settings > Privacy & Security > Analytics & Improvements.

Information from Apple and RevenueCat

• Purchases. When a parent buys SteadyBounds Premium, Apple processes the payment. Apple and RevenueCat send us the purchase records we need to confirm and provide Premium to your family, and to send the subscription emails the law requires, such as transaction and product IDs, purchase and renewal dates, the price charged, and whether a subscription is in a free trial, active, set to renew, expired or refunded. When a parent subscribes, we also record which version of the Premium purchase screen and our Terms was shown. We don’t receive your card number or your Apple Account password.
• Screen Time. Apple’s Screen Time frameworks provide the information described in Section 3.
• Age range (only where state law requires it). Where a state law requires it and the device supports it, Apple tells SteadyBounds the age range of the person using the device. It is used only on that device, as Section 7 explains, and is not sent to us.

What we don’t collect

• We don’t collect payment card or bank details, your contacts, or text messages, iMessages or emails from other apps.
• The app does not use the microphone or the camera. Read-aloud plays recordings built into the app or uses a voice already on the device, and lesson text is not sent to any speech service.
• The app doesn’t get access to your photo library. When a parent picks a profile photo for themselves or a child, the app receives only that photo: it crops it to a small image and removes its location and camera details before saving it. Family chat is text only, so photos can’t be sent in chat.
• We don’t collect your device’s advertising identifier, biometric information or browsing history, and our servers don’t receive app-by-app usage reports.
• Some information stays only on your family’s devices, such as hints your child uses and your child’s choice of Home background. We don’t receive your parent PIN. It is kept on devices only as a protected check value, and when your phone passes that check value to your child’s device during setup, it is encrypted so that our servers, which relay it, can’t read it.

3. Screen Time (Apple Family Controls) data

SteadyBounds uses Apple’s Screen Time frameworks (Family Controls, Managed Settings and Device Activity) to apply the rules a parent chooses. Apple requires a parent or guardian in the child’s Apple Family Sharing group to approve this on the child’s device, and Apple’s system enforces the rules on the device. Here is what that involves.

• App and website choices. When you choose apps or categories, Apple gives SteadyBounds private tokens instead of app names, and SteadyBounds does not get a list of the apps installed on a device. The tokens are stored on your family’s devices. When your choices need to move between your phone and your child’s device, the sending device encrypts them with keys that only your family’s connected devices hold. Our servers relay and store the encrypted data but do not have those keys, so they can’t read your choices. Our servers do see basic details needed for the transfer, such as how many apps and categories were included and when. Website rules are saved as the web addresses you type. They are settings, not a record of browsing.
• Detailed usage stays on the device. Apple’s detailed Device Activity reports, which show which apps were used and for how long, are displayed on the device through Apple’s report feature. They are not sent to us.
• Daily time totals. To keep one shared daily allowance across a child’s devices, each child device sends us a running total of screen time used that day, counted across all apps or across the apps you selected, depending on your rule. The total comes with the time it was measured, the day and time zone, technical details about Apple’s daily reset, version numbers for the rules, app choices and permissions in effect, and how many minutes of learning in SteadyBounds were not counted toward the limit (a number only). It does not include app names, websites or browsing history.
• Status. Whether each device has applied your latest rules and whether Apple’s Screen Time permission is in place.
• Bedtime activity. If a parent turns it on, the time of first use during a bedtime period, as described in Section 2.

We use this information only to provide SteadyBounds’s Screen Time features to your family: to apply your rules, show remaining time, share one allowance across devices, run requests, extra time and the Time Bank, and show parents device status and reports. Within SteadyBounds, it is shown only to the parents in your family and on the child’s own devices. Our hosting provider stores it for us, and authorized people who work for us can access it only as Section 6 describes. We do not sell Screen Time data. We do not use it for advertising, marketing, data mining or profiling, we do not share it with RevenueCat, and we do not disclose it to anyone for any other purpose, except where a law or valid legal process requires us to.

You stay in control. A parent can disconnect a device or remove a child at any time, and Apple’s Screen Time settings also let a parent turn off SteadyBounds’s access. Once Apple’s permission is turned off, SteadyBounds can no longer apply rules on that device.

4. How we use information

• To provide SteadyBounds. We create and secure accounts; connect and manage devices; apply your rules through Apple’s Screen Time system; keep one daily allowance across a child’s devices; handle requests, approvals, extra time and the Time Bank; grade learning activities, choose the next practice questions within the level you set, and track progress and earned time; and run chores, family chat, profile photos, optional location sharing, optional place alerts, optional bedtime activity, Home Screen widgets and parent reports.
• To send notifications. We tell the right device when something needs attention, such as a request, a decision or a place alert. The notifications we send through Apple don’t include names, place names, message text or locations. A place alert arrives on a parent’s phone as a general message; the SteadyBounds app on that phone then asks our servers, over an encrypted connection, for the child’s first name and the place name and shows them in the alert, for example “Emma arrived at School”. If it can’t, the alert keeps its general message.
• To provide Premium. We verify purchases with Apple and RevenueCat, restore them, and turn Premium on for the family it was bought for.
• To understand how Premium is doing. We look at subscription reports that RevenueCat prepares from purchase records, such as how many families start, renew or cancel Premium. These reports contain no children’s information.
• To keep SteadyBounds safe and secure. We protect accounts, ask for a parent’s password before sensitive changes, prevent abuse and unauthorized access, review chat safety reports and enforce our Terms. Family chat automatically blocks a short list of clearly abusive phrases before a message is posted. This is a simple automated filter, and it can’t catch everything. We don’t monitor conversations; people who work for us see messages only in the situations described in Section 6.
• To support you and communicate with you. We answer your questions, send account and subscription emails (such as our notice to parents with the code that confirms your email address, the emails confirming your consent described in Section 7, resetting your password, and the Premium confirmations, receipts and renewal reminders described on our Subscriptions, Cancellation & Refunds page) and tell you about important changes to SteadyBounds, our Terms or this policy. If we ever email parents news about SteadyBounds, each message will include a way to unsubscribe. We don’t send marketing messages to children. A child’s device never shows prices, plans, purchase buttons or requests to ask a parent to buy Premium.
• To fix problems and improve reliability. We use support conversations, technical records and any crash reports Apple shares with us. Apart from RevenueCat’s subscription reports, we don’t use third-party analytics tools.
• To comply with the law and respond to lawful requests.

We do not use your family’s information for advertising or to build marketing profiles, and we do not make decisions with legal or similarly significant effects about anyone based solely on automated processing.

5. Where SteadyBounds is offered

SteadyBounds is offered only in the United States. We make the app available only on the U.S. App Store, we sell SteadyBounds Premium only in U.S. dollars, and SteadyBounds is intended only for families who live in the United States. We do not offer SteadyBounds to, or direct it at, people in the European Economic Area, the United Kingdom, Switzerland or any other country.

If your family uses SteadyBounds while traveling outside the United States, we handle your information as this policy describes, and it is processed as Section 14 explains. Wherever you are, you can use the tools in Section 10 to see, download, correct or delete your family’s information, or email us.

6. How we share information

Within your family, by role

• Parents in a family can see and manage the family’s information, including each child’s profile, rules, device status, learning, requests, tasks, screen time reports, and location, saved places, place alerts and bedtime activity if turned on. Every parent you invite gets this access, sees the messages your children send in conversations they are in, and can add children to the family. Invite only another parent or legal guardian of your children whom you trust, not a step-parent, relative or caregiver who isn’t their legal guardian. When someone joins your family as a parent, we email the family owner.
• A child’s device receives what it needs for that child, such as the child’s rules, requests, tasks and conversations, and, while place alerts are on for that child, the family’s saved places, whose names it shows to the child.
• Names, avatars and profile photos are visible to members of your family.
• Family chat messages are visible to the people in that conversation. Only parents can create family conversations and choose who is in them, and they must include themselves. Children can chat only with their own parents and guardians in the family: a conversation can include one child and the family’s parents and guardians, and children can’t message each other (Section 7). People added to a conversation see messages from the time they joined. Messages that someone has already seen, or that a parent has exported, can’t be recalled.

Service providers

• Supabase: hosting, database and storage, sign-in (authentication) and server functions.
• Apple: Apple Push Notification service delivers our notifications, which contain only a generic message. Apple’s Screen Time frameworks run on your family’s devices, and Apple’s location services let a child’s device notice when it arrives at or leaves a saved place. Apple Maps shows the maps in the app and, when a parent searches for an address to save a place, receives the search text. Apple processes App Store purchases under its own terms and privacy policy.
• RevenueCat: keeps track of subscription status. Its software is part of the app, but SteadyBounds turns it on only when a signed-in parent opens the Premium or purchase screens, and it then stays active until the app is closed. SteadyBounds does not turn it on for a child’s device. It receives a random ID we create for your family’s purchases (not your name or email address), the App Store transaction, product and subscription details, and the technical information its software sends to provide its service, such as the device’s IP address and app and system versions. We turn off its automatic device-identifier collection and its diagnostics, and we do not send it children’s information, messages, locations, photos, learning records, Screen Time data or your email address. RevenueCat also uses these purchase records to show us overall subscription reports, such as how many families start, renew or cancel Premium.
• Email providers: to deliver account emails, including our notice to parents with its code and the confirming emails described in Section 7, and subscription emails, and to run our support mailbox. Our account, consent and subscription emails don’t include your child’s name or any information from your child.
• Website hosting provider: to deliver our website.

We give each service provider only the information it needs. Each provider other than Apple has agreed, in its terms or data processing agreement with us, to keep that information confidential and secure, to use it only to provide, secure and improve the services it gives us, and not to sell it or use it for advertising. Apple handles the information its services receive under its developer agreement with us and its own privacy policy. We rely on these commitments so that your information receives the same or equal protection to what this policy describes. Service providers are not “third parties” that use your family’s information for their own purposes.

People who work for us

Authorized people who work for Vantaryn Labs can access information only when needed to provide support, review a chat safety report, keep SteadyBounds secure or comply with the law.

Legal and safety reasons

We may disclose information if we believe in good faith that it is necessary to comply with the law or legal process, respond to lawful requests from public authorities, protect the safety of a child or anyone else, report suspected child sexual exploitation to the National Center for Missing & Exploited Children as the law requires, or protect the rights, property and security of SteadyBounds, our users or the public.

Business transfers

If Vantaryn Labs is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, information may be transferred as part of that transaction. Any successor must protect it as this policy describes, or with at least equal protection, and must ask for any parental consent the law requires before using children’s information in a materially different way. We will notify you before your information becomes subject to a materially different privacy policy.

When you choose to share

When you save or send a family export or a conversation export, you decide who receives it. Exports contain private family information, so store and share them carefully.

What we don’t do

• We don’t sell personal information.
• We don’t share personal information for cross-context behavioral (targeted) advertising, and we don’t use it for targeted advertising ourselves.
• There are no ads in SteadyBounds, and the app contains no advertising, tracking or crash-reporting software from other companies. Apart from RevenueCat’s subscription reports (above), we don’t use outside analytics.
• We don’t give or rent your family’s information to data brokers or to other companies for their own purposes.

7. Children’s privacy

SteadyBounds is designed for parents to use with their children, including children under 13. This section describes our practices for children’s information. It includes the notice required by the U.S. Children’s Online Privacy Protection Act (COPPA) and our written retention policy for children’s information. The operator responsible for children’s information collected through SteadyBounds is Vantaryn Labs LLC, 30 N Gould St #69108, Sheridan, WY 82801, United States; hello@steadybounds.com; (307) 393-5609. We give every child profile the protections described in this section, whatever the child’s age, and every child starts with location sharing, place alerts and bedtime activity turned off.

How a parent sets up a child and gives consent

Children cannot create a SteadyBounds account. We ask for a parent’s consent before we collect any information from a child. For everything SteadyBounds does, we use one method: our emailed notice with a code, the parent’s consent in the app and two confirming emails.

1. A parent creates a parent account with an email address and password. We email that address our notice to parents, which explains what we collect from children, how we use and share it, how to give consent and how to withdraw it, with a 6-digit code. The parent enters the code in the app to confirm the address. If the code isn’t entered within 7 days, we delete the sign-up, including the email address.
2. Before the family is created and before any child is added, the app shows the parent a summary of what SteadyBounds collects about children and how it is used and shared, with our full notice and links to this Privacy Policy and our Terms. To give consent, the parent turns on a switch confirming that they are an adult and the parent or legal guardian of each child in the family, and that they consent to the collection and use of their children’s information described in our notice and this policy. The same switch accepts our Terms. The app accepts the switch only within 24 hours after the parent entered the code from our notice; after that, we first email the notice again with a new code. We record whether the parent gave or declined consent, when, which versions of our notice and this policy applied, and which notice email we sent.
3. Right after the parent gives consent, we email the parent’s confirmed address to confirm it, repeat the notice and explain how to withdraw consent. A child’s device can be connected only after that email has been sent. About 24 hours later we send a second confirming email with the same information. If you get one of these emails and did not give consent, or you change your mind, use the withdraw link in the email (it works for 30 days and opens a page where you confirm), reply to the email or write to us. We will stop collecting information from your child and delete it as described below (step 4 explains what happens when an invited parent withdraws). If someone tells us they didn’t give consent, we treat that consent to collect children’s information as not given. If we learn that we can’t deliver these emails, or one of them is reported as spam, we stop collecting information from the child at once, tell the parent in the app, and delete the child’s information as described below unless the parent gives us a working email address within 7 days. If the email address on an account changes, we send our notice and a code to the new address, and any confirming email still due goes to both addresses.
4. A parent or guardian who joins a family by invitation goes through the same steps: our notice and code by email, the same kind of switch before accepting the invitation, and the same two confirming emails. When someone joins, we email the family owner to say who joined and how to remove them. If an invited parent withdraws consent, we remove them from the family and tell the family owner. The children’s information then stays under the family owner’s consent; an invited parent who also wants us to stop collecting a child’s information can remove the child in the app or ask us to, as described below. If we learn that we can’t deliver these emails to an invited parent, or one of them is reported as spam, we suspend their access to the family at once and tell them in the app, and we remove them and tell the family owner unless they give us a working email address within 7 days. Invite only someone who is a parent or legal guardian of your children.
5. Family chat is only with parents and guardians. In family chat, the messages a child sends are seen by the people in that conversation. Children can chat only with their own parents and guardians in the family: a conversation can include one child, and children can’t message each other, so a child’s messages are never shown to another child. Any parent in the family can turn off all chat for a child at any time.
6. To turn on Screen Time controls, Apple separately requires a parent or guardian in the child’s Apple Family Sharing group to approve SteadyBounds on the child’s device with their Apple Account. This is Apple’s own requirement, in addition to the consent above.

We don’t collect information from a child’s use of SteadyBounds until a parent has given this consent and connected the child’s device. Optional features that collect more information, location sharing, place alerts and bedtime activity, stay off until a parent turns them on. Location sharing starts only after someone using the child’s device agrees on that device, first in SteadyBounds and then in Apple’s location permission. Place alerts build on location sharing: they work only while location sharing is on for the device and it allows Apple’s “Always” location permission, and they stop whenever location sharing stops. For a teen, bedtime activity also starts only after the teen agrees on that device. While location sharing is on, the child’s device shows that it is on and lists the places it watches for place alerts, and the child can stop both there at any time. Before we collect, use or disclose children’s information in a materially different way, we will notify parents and, where the law requires, ask for their consent again.

Age information from Apple

Some state laws require app stores to confirm their users’ ages and to tell apps each user’s age range and whether a parent has consented. Where one of those laws applies and the device supports it, SteadyBounds asks Apple, through Apple’s age range feature, for the age range of the person using the device (under 13, 13 to 15, 16 to 17, or 18 and over). We use the answer only on that device, and only to keep parent accounts for adults, to apply the protections in this section and to comply with those laws. We don’t send the age range to our servers, store it with your family’s information or share it with anyone. If Apple reports that someone is under 18, we treat that person as a child under this policy, whatever age was entered in SteadyBounds.

What we collect about children, and how

• From the parent: the child’s name or nickname, age (3 to 17), lesson level and Fresh Math limit, an avatar or optional photo, and the rules and settings the parent chooses. We use age to choose starting learning levels, limit how far Fresh Math can step down, and apply the teen protections described below.
• From the child’s use of the app: learning answers, results (including how many steps or questions the child got right on the first try) and progress; requests for more time and any notes; chores marked as done; and, if a parent adds the child to a family conversation, the messages the child sends and any chat safety reports, blocks or mutes the child uses.
• Automatically from the child’s device: a name for the device, the device ID we assign, its sign-in credential, its notification token, its IP address and basic technical details, whether it has applied the latest settings, daily Screen Time totals (Section 3), and, only if a parent turns them on, the device’s latest location, when it arrives at or leaves a place a parent saved, and bedtime activity.

How we use children’s information

We use it only to provide SteadyBounds to the child’s family: to apply the parent’s rules, keep the child’s daily time in sync across devices, deliver and grade learning activities, choose the next practice questions within the level the parent sets and adjust practice from recent answers, show parents learning reports and practice suggestions, track progress and earned time, handle requests and tasks, deliver family messages, show parents optional location and bedtime activity, send place alerts, send notifications, keep the service secure and meet legal requirements. We don’t use children’s information for advertising or marketing, we don’t build profiles of children for those purposes, and we don’t sell it.

Persistent identifiers

The device ID we assign, the device’s sign-in credential, its notification token and its IP address are persistent identifiers. We use them only to support the internal operations of SteadyBounds: to sign the device in, keep its rules and time in sync, deliver notifications, limit abuse such as repeated pairing attempts, and keep the service working and secure. Apart from the notifications described in Section 4, which go only to the child’s own device and only if that device allows notifications, we don’t use or disclose them to contact a child, to build a profile about a child, for advertising or for any other purpose. We make sure of this by keeping them only in our own systems and our service providers’ systems, by not putting any advertising software in the app, and by limiting our service providers, by contract, to using them only to provide their services to us.

Children can’t make their information public

SteadyBounds has no public profiles, no public posts and no way to find or message people outside your family. A child can message only the people a parent adds to a conversation. Children can chat only with their own parents and guardians in the family, never with each other. Children can’t create conversations or add people to them.

Who receives children’s information

• People in the child’s family. The parents and guardians in the family can see and manage the child’s information, including the messages the child sends in conversations with them. Other children in the family never see them. This is part of how SteadyBounds works.
• Our service providers. Supabase hosts it, Apple delivers notifications to the child’s device, and our email provider handles anything a parent sends us by email and anything we email a parent at their request, such as a copy of their child’s information. They process it only on our behalf, to run SteadyBounds (Section 6). RevenueCat does not receive it.
• People who work for us. Authorized people may see it only when reviewing a chat safety report, providing support or keeping the service secure.
• Legal and safety reasons. Where the law requires or permits it, as Section 6 describes, for example to respond to legal process, to report apparent child sexual exploitation to the National Center for Missing & Exploited Children as federal law requires, or to protect a child’s safety.

We don’t disclose children’s information to any other third party, including advertisers, data brokers or companies that would use it for their own purposes. A child’s messages are never shown to other children. If we ever want to disclose children’s information to a third party in a way that is not part of how SteadyBounds works, we will first ask for a parent’s separate consent.

Only what’s needed

We do not condition a child’s participation in any activity in SteadyBounds on the child disclosing more personal information than is reasonably necessary for that activity.

A parent’s rights, and how to use them

• Review. See your child’s information in the app, or download a copy of most of your family’s information in Settings > Account & Family Data > Prepare Family Export. The download leaves out your child’s latest location, saved places, place alerts and website lists, which you can see in the app, daily time totals from earlier days, and chat safety reports, and family conversations are exported separately (Section 10). Email us and we will send you any of these, or anything else we hold about your child, within 45 days, unless the law allows us to hold something back to protect a child’s safety.
• Correct. Change your child’s profile and settings in the app. If you can’t change something yourself, email us and we will correct it.
• Delete. In Settings, tap Remove a child or device. Under your child, tap Devices & Removal, open Remove Child, then tap Remove [your child’s name] from SteadyBounds and confirm. Your child’s information is deleted as described below once all of your child’s devices have disconnected. If one of those devices is lost or can’t get online, the app can’t finish removing that one child, so email us and we will delete your child’s information. You can also delete your whole family (Section 10).
• Refuse further collection or use. Turn off optional features, disconnect your child’s device, remove your child, or email us. We can’t provide SteadyBounds for a child without the basic information it needs, but refusing does not affect your own parent account.
• Withdraw consent. Any parent in the family can turn off all chat for a child in the app: your child is removed from every conversation, and the chat cleanup described in the next paragraph happens right away. To withdraw consent entirely, remove your child or delete your family as described above, or email us. The withdraw link in our confirming emails also works; for a parent who joined by invitation, it removes that parent from the family (step 4 above).

What happens to chat when you remove one child but keep your family: once the removal finishes, the text of every message your child sent is deleted, along with your child’s name and avatar on those messages. Each one is replaced by a short “Message removed” note from a “Former family member”, so the conversation still reads in order. Chat safety reports your child filed, and reports that include one of your child’s messages or a time request about your child, are deleted at the same time. What stays: messages other family members wrote, even if they mention your child, and internal security, consent and removal records that contain your child’s internal ID but no content from your child, for up to 24 months (see “Consent, security and removal records” below).

To make a request by email, write to hello@steadybounds.com from the email address on your parent account. We will confirm that you are the child’s parent or guardian before acting, and we complete a confirmed request to delete a child’s information within 45 days. We don’t ask for your password, parent PIN, pairing codes or the codes we email you.

Teens. If the law where you live gives teens their own privacy rights, a teen can ask us to see, correct or delete information the teen gave SteadyBounds, such as messages the teen sent or learning answers, by emailing hello@steadybounds.com. We will need to confirm that the request comes from the teen, and we may ask a parent in the family to help us confirm it. Deleting some information may mean parts of SteadyBounds stop working on the teen’s device. Wherever the family lives, before a device set up for a child aged 13 to 17 connects, it explains to the teen what SteadyBounds collects. Location sharing (and so place alerts) and bedtime activity for a teen also need the teen’s own agreement on that device. If the teen says no, we won’t ask again for 12 months, and the teen can stop either one at any time.

How long we keep children’s information (our data retention policy)

This is our written data retention policy for children’s personal information. It covers every child profile, whatever the child’s age. For each kind of information, it says why we collect it, why we keep it and when we delete it. We keep a child’s information only as long as reasonably necessary for those purposes. Every kind of information below has a set end point, so we never keep a child’s information indefinitely. Backup copies expire within 90 days (Section 8).

• Profile, rules, learning history, requests, tasks, rewards and Time Bank. We collect these to run the child’s limits, learning, progress, rewards and reports. We keep them so they keep working from day to day and when a device is replaced, and so earned time isn’t paid twice. We keep them while the child’s profile exists and delete them when a parent removes the child or deletes the family, or when we delete an inactive child profile or family (below).
• Daily time totals. We collect these to keep one daily allowance across the child’s devices. We keep each day’s totals for 30 days so we can answer a parent’s questions about a recent day, and then delete them automatically. They are deleted sooner if a parent removes the child or deletes the family.
• Profile photo. Kept to show the child’s picture to the family. If a parent or the child picks an avatar instead, the photo stays saved so a parent can switch back to it; only parents can see a saved photo that isn’t in use. Deleted when a parent uploads a different photo or taps Delete photo, removes the child or deletes the family.
• Location. Kept to show parents where the child’s device was most recently. We keep only the latest point. It is hidden after 24 hours and cleared by automatic cleanup shortly after. It is cleared right away when a parent turns sharing off. If sharing is stopped on the child’s device, it is cleared as soon as that device next connects to our service. When a device is disconnected, its location is hidden right away and cleared shortly after.
• Place alerts. Kept so parents can see recent arrivals and departures: only which saved place, whether the device arrived or left, and when. No coordinates or route. Hidden and deleted by automatic cleanup after 7 days. When the device is disconnected or the child is removed, they are hidden right away and deleted shortly after, and they are deleted right away if the family is deleted. Turning place alerts off, stopping location sharing, or the feature becoming unavailable because Premium ended stops new records; existing ones are still deleted after 7 days. Saved places are kept until a parent deletes them or the family is deleted, including when we delete an inactive family.
• Bedtime activity. Kept to show parents device use during bedtime. We keep at most the last 30 days. Older observations are no longer shown and are deleted by automatic cleanup. Turning the feature off, or the feature becoming unavailable because Premium ended, stops new observations, and existing ones are deleted once they are 30 days old, or right away if the child or family is deleted.
• Messages. We collect them to deliver family chat, and keep them so family members can read their conversation history. A child’s messages are kept until the child is removed or chat is turned off for the child (their text is then deleted, as described above), the family is deleted or we delete an inactive child profile or family, or sooner at a parent’s request. Turning off the Family chat switch in Settings pauses new messages for the whole family and doesn’t delete any.
• Chat safety reports. We collect them so our reviewers can look into safety concerns, and keep them for that review. Deleted automatically after 90 days, or sooner if the family is deleted. Reports your child filed, and reports that include one of your child’s messages or a time request about your child, are deleted when your child is removed or chat is turned off for your child. If a report shows apparent child sexual exploitation, federal law requires us to report it to the National Center for Missing & Exploited Children and to keep a copy of what we reported for one year. We keep that copy in a separate, secure place that only authorized reviewers can access, and delete it when the year ends unless law enforcement lawfully asks us to keep it longer.
• Device identifiers, credentials and notification tokens. Kept to connect and secure the device. Notification tokens are deleted when the device disconnects, credentials stop working when the device disconnects and expire after 90 days if not replaced, and the remaining records are deleted with the child or family.
• IP addresses. Not saved with a child’s profile. Pairing rate-limit records keep only a scrambled form, which expires after one day and is then deleted during routine cleanup. Our hosting provider’s technical logs may include IP addresses for a limited period (Section 8).
• Consent, security and removal records. We keep records of a parent’s consent, of security-related actions and of each removal, so we can show that a parent agreed, protect accounts and devices, stop an old request from being replayed and show that a deletion was completed. After a child is removed, these records, and the “Message removed” notes described above, keep only the child’s internal ID (a random code) and nothing else from the child. We delete these records, and remove that code from those notes, 24 months after the removal, or sooner if the family is deleted. Separately, when a family or parent account is deleted or a parent leaves a family, we keep a short record of that parent’s consent decisions (which notice we emailed and when, when its code was entered, and when consent was given, declined or withdrawn), with no information from children, for six years (Section 8).
• Inactive children and families. If a child’s profile goes unused for 24 months in a row (none of the child’s devices connects to our service and no parent changes anything for that child), we treat it as inactive and delete the child’s information, just as if a parent had removed the child. If, for 24 months in a row, no parent in a family uses SteadyBounds and none of the family’s child devices connects to our service, we treat the family as inactive and delete it, including all of its children’s information. We may email the family owner before we do.
• Legal holds. If the law requires us to keep specific information longer, for example material we must preserve after a report to the National Center for Missing & Exploited Children or information covered by a valid legal preservation request, we keep only that information, only for as long as the law requires, and then delete it.

Feature by feature

Supabase stores this information for us, and Apple delivers notifications. We don’t share children’s information with anyone else except as described above. Deleted information can remain in backups for a limited time, as Section 8 explains.

How Fresh Math chooses practice questions

Fresh Math, our adaptive math practice, uses a child’s own results to choose practice questions. A child starts at a practice level based on the age the parent entered, never above the Fresh Math limit the parent sets. It moves up a level after two recent sets with at least 6 of 8 questions right on the first try, again never above that limit. After two sets in a row with no more than one question right on the first try in each, it can move down one level for review. It does this no more than once a week, and never to more than two levels below the starting level for the child’s age. Sets that earn time use questions the child hasn’t seen before or, once those run out, questions the child last saw at least a week ago. Fresh Math uses only the child’s age, the parent’s settings, the child’s own answers and which questions the child has already seen.

Learning reports for parents

The learning report in a parent’s app uses the child’s recent results to help the parent choose practice. It may point out a subject where the child’s recent first tries were hard, and suggest an easier lesson, a lesson to try again or a Fresh Math set. It may also suggest a next lesson to balance subjects. The parent’s app works this out from the family’s learning records. Only parents see it, and it doesn’t change the child’s levels, rewards or which activities the child can open.

Section 8 has more detail, including how long backup copies last. Parent accounts are for adults. If we learn that we have collected personal information from a child without a parent’s consent, or that a parent account belongs to a child, we will delete that information.

8. How long we keep information

We keep information only as long as we need it for the purposes described in this policy, and then delete it. Here is how that works for each kind of information.

After deletion, copies may remain in backups made by us or our hosting provider for up to 90 days, until those backups are deleted or replaced. We protect backups like the rest of our systems and use them only to restore the service. Information stored on a lost or offline device stays on that device until it is recovered, because our deletion tools can’t reach it. We may keep specific information longer only where the law requires it or where needed to protect someone’s safety or resolve a legal claim, and only until that need ends.

9. Security

We use reasonable administrative, technical and physical safeguards designed to protect your family’s information. For example:

• Information travels over encrypted (HTTPS) connections, and our hosting provider encrypts stored data.
• Our servers use access rules designed so that a parent, child or device can reach only the records their role and family allow.
• The app asks for parent passwords of at least 12 characters, and it asks for your password again before sensitive changes such as changing who has parent access to your family or deleting your family’s data.
• We don’t receive the parent PIN. Devices keep only a protected check value for it, and that check value passes from your phone to your child’s device in encrypted form that our servers can’t read.
• App choices are encrypted on the sending device with keys our servers don’t have, and we keep device sign-in credentials only in scrambled form.
• The notifications we send through Apple don’t include names, place names, message text or locations, and message history saved on a device is protected by iOS data protection and left out of device backups. A place alert gets its names from our servers on your phone (Section 4). Whether its text shows while your phone is locked depends on your iPhone’s notification settings for SteadyBounds.
• Home Screen and Lock Screen widgets that show family information stay hidden while the phone is locked, until it is unlocked. The widget and alert credential can only read your children’s first names and time left, the number of waiting requests and the names in a place alert, never change anything, and we keep only a scrambled version of it.

Family chat messages are encrypted in transit and kept on our hosting provider’s encrypted storage, but they are not end-to-end encrypted, so our systems can process them. No method of transmission or storage is completely secure, and we can’t guarantee absolute security. Please keep your password, parent PIN, pairing codes and the codes we email you private. If you believe your account has been compromised or you find a security problem, email hello@steadybounds.com. If we learn of a security incident that affects your information, we will notify you as the law requires, usually by email to the address on your parent account.

10. Your choices and rights

Controls in the app

• Change profiles, settings and photos, or delete photos.
• Turn location sharing on or off, turn place alerts on (with Premium) or off for each child, save or delete places, and turn bedtime activity alerts on (with Premium) or off. A child’s device can also stop sharing location, which stops place alerts too, in the app (Profile > Location sharing > Stop sharing location) or by turning off location access for SteadyBounds in iOS Settings. Place alerts also stop on a device whose location permission is changed from “Always”.
• Turn notifications off in iOS Settings.
• Block people or mute notifications in family chat.
• Turn off all chat for a child in that child’s settings (any parent).
• Download a copy of most of your family’s information in Settings > Account & Family Data > Prepare Family Export (Section 7 lists what the download leaves out and how to get it). Parents can also export their conversations: in family messages, open the options menu and tap Export my conversations.
• Disconnect a device or remove a child in Settings > Remove a child or device > Devices & Removal.
• Turn off Apple’s Screen Time or location permission for SteadyBounds in iOS Settings. SteadyBounds then stops applying rules, or stops sharing location and place alerts, on that device.

Deleting your account and family data

On your phone, tap your profile picture on Home to open Settings, then tap Account & Family Data.

1. If you own the family: tap Request Family Removal and confirm with your parent account password. Your child’s devices are asked to release SteadyBounds, so open SteadyBounds on them and keep them online.
2. When the devices have disconnected, tap Finish Removing Family, then Delete Family Records. This permanently deletes the family’s profiles, pictures, messages, learning and requests for all of its parents, except for the limited records described in Section 8.
3. If a device is lost or unavailable, you can choose Delete Without Unavailable Devices. SteadyBounds’s limits may stay on that device until you recover it and remove them there (see our Support page).
4. If you were invited to a family: tap Leave Family. The family and its shared history stay with its owner.
5. After you have left or removed every family, tap Delete Parent Account to permanently delete your sign-in.

Deleting your account, your family or the app does not cancel an App Store subscription. Cancel in Settings > [your name] > Subscriptions. A Premium purchase linked to a deleted family does not automatically move to another family.

Requests by email

You can also ask us to access, correct, delete or provide a copy of your information, or to stop using it, by emailing hello@steadybounds.com with “Privacy request” in the subject line, or by writing to us at the address in Section 16. Anyone may send us a request, wherever they live. Where a law gives you a privacy right, we honor it as that law requires, within the time it sets and subject to the exceptions it allows. A parent’s rights over their child’s information, described in Section 7, apply wherever the family lives.

Verification

To protect your family, we verify requests before acting on them. We will usually ask you to write from the email address on your parent account and may ask you to confirm details about your family. We don’t ask for your password, parent PIN, pairing codes or the codes we email you. If we can’t verify a request, we will tell you so and explain why.

Authorized agents

Where the law allows, you may use an authorized agent to make a request for you. We will ask the agent for your signed permission and may ask you to verify your identity with us directly. We may decline a request from an agent who does not provide this proof. A parent or legal guardian may make requests on behalf of their child.

Appeals

If we decline all or part of your request, you can appeal by replying to our decision, or by emailing hello@steadybounds.com, with “Privacy appeal” in the subject line. We will review the appeal and tell you in writing what we decided and why, within the time the law that applies to you requires. If you disagree with the outcome, you may contact your state attorney general, for example through the complaint form on the attorney general’s website.

No discrimination

We will not deny you service, charge you a different price or give you a different quality of service because you used a privacy right. Some requests, such as deleting your account or your child’s information, mean we can no longer provide SteadyBounds, or some features, to you or your child.

11. U.S. state privacy notice

This section adds to the rest of this policy for residents of California and other U.S. states with consumer privacy laws.

Categories of personal information we collect

We collect, and in the past 12 months have collected, these categories of personal information, from the sources described in Section 2 (you, your family’s devices, Apple and RevenueCat):

• Identifiers: name or nickname, email address, account and device IDs, notification tokens and IP address.
• Customer records: name, email address and purchase records.
• Characteristics of protected classifications: a child’s age.
• Commercial information: subscription and purchase records.
• Internet or other electronic network activity: how your family uses SteadyBounds, such as learning activity, requests, device status and daily Screen Time totals, plus technical information.
• Geolocation data: a child device’s latest precise location, only if a parent turns on location sharing, and, if a parent turns on place alerts, when it arrived at or left a saved place, and the places a parent saves.
• Audio, electronic, visual or similar information: profile photos.
• Inferences: limited to choosing which practice questions fit a child’s level, within the limit the parent sets, and, in the parent’s learning report, noting a subject where recent first tries were hard and suggesting practice (Section 7).
• Sensitive personal information: account sign-in credentials, precise location (optional), the contents of family chat messages and personal information of children.

Use, disclosure and retention

We use each category for the purposes in Sections 3, 4 and 7. We disclose it for business purposes only to the categories of recipients described in Section 6: our service providers, the members of your family you choose, and others where the law requires. We keep each category as described in Section 8.

No sale or sharing

We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. That includes the personal information of children and teens under 16. We do not use personal information for targeted advertising or for profiling that produces legal or similarly significant effects.

Sensitive personal information

We use sensitive personal information only to provide SteadyBounds and keep it secure, as the law permits. The only inferences we draw from it are the learning ones listed above, which run the learning features your family uses, and we don’t use it to infer anything else about anyone. Because we don’t use it for any other purpose, there is nothing for a request to limit its use to turn off. We collect a child’s information only with a parent’s consent (Section 7), and a child device’s precise location, and its arrivals at and departures from saved places, only when a parent turns location sharing or place alerts on and the device grants permission. We don’t use location or any other information to identify or infer anyone’s health.

Your rights

Depending on your state, you may have the right to know what personal information we collect, use and disclose and to get a copy of it; to correct it; to delete it; to receive it in a portable format; to opt out of its sale, sharing, targeted advertising or certain profiling (we do none of these); to limit the use of sensitive personal information; to appeal our decision; and not to be discriminated against for using these rights. Section 10 explains how to make a request, how we verify it, how to use an authorized agent and how to appeal.

Minors under 18

We know that children and teens use SteadyBounds. We do not sell any minor’s personal information, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, and we keep it only as Section 8 describes. SteadyBounds has no streaks, endless feeds, autoplay or notifications designed to bring a child back to the app. A child can message only the family members a parent adds to a conversation, so adults outside the family can’t contact a child through SteadyBounds. We collect a child’s precise location, and place arrivals and departures, only as Section 7 describes, and the child’s device shows when location sharing is on and which places it watches.

Other state notices

California residents: we do not disclose personal information to third parties for their own direct marketing purposes. Nevada residents: we do not sell covered information as defined by Nevada law.

12. Do Not Track and Global Privacy Control

Some browsers send a “Do Not Track” signal. There is no common standard for how to respond to it. SteadyBounds does not track you across other companies’ apps or websites, our website sets no cookies and uses no analytics or trackers, and no third party collects information about your activity on our website over time or across other sites. Our practices are therefore the same whether or not your browser sends a Do Not Track signal.

Because we do not sell or share personal information, a Global Privacy Control signal has nothing to turn off. Where the law requires, we treat it as a valid request to opt out of sale and sharing.

13. Our website

Our website does not set cookies or use analytics, advertising or tracking tools, and it does not load content from other companies: its fonts and images come from our own site. It has no sign-in and does not ask you to submit information. If you click an email link, your own email app creates the message, and we receive only what you choose to send.

Like any website, the servers that deliver our site receive the basic technical information your browser sends, such as your IP address, browser type, the page requested and the time. Our hosting provider may keep this for a limited time in server logs to deliver the site and protect it from abuse. We do not use it to identify or profile you. Links to other websites, such as Apple’s support pages and the App Store, take you to sites covered by their own privacy policies.

14. Where information is processed

Vantaryn Labs is based in the United States, and SteadyBounds is operated from, and offered only in, the United States (Section 5). Your information is processed and stored in the United States and in other countries where our service providers operate.

15. Changes to this policy

We may update this policy from time to time. We will post the new version on this page and change the “Last updated” date at the top. If we make a material change, we will tell parents in the app or by email before it takes effect. If a change would affect how we collect, use or disclose children’s information in a materially different way, we will ask for a parent’s consent where the law requires, by emailing our updated notice with a new code and asking you to turn on the consent switch again. Otherwise, continuing to use SteadyBounds after a change takes effect means the updated policy applies.

We keep each version of this policy at its own permanent web address, so you can always see the version you accepted. This version is at https://steadybounds.com/privacy/2026-10-05/.

16. Contact us

For questions about this policy, privacy requests or questions about your child’s information, email us at hello@steadybounds.com. Email is the best way to reach us. You can also write to us or call: