Privacy Policy
- Effective date
- Last updated
1. Who we are
KinderStep is a child development milestone tracker for families in Bangladesh and Bangladeshi families abroad, offered in English and Bangla.
We are responsible for the personal information described in this policy.
Contact for anything in this policy, including privacy requests: support@kinderstep.app
2. The short version
We think you should be able to understand this without reading all of it.
| What we hold | Your email and name; your children's names, birth dates, and the milestones you tick off |
|---|---|
| Why | To run the app, save your progress, and email you reminders you asked for |
| Do we sell it? | No. Never. |
| Do we share it? | Only with the services that run the app for us — listed in section 6. Meta is told a page was visited, a checklist was downloaded, or an account was created — never anything about your children |
| Where is it? | Servers in Singapore |
| Can you get it out? | Yes — export a PDF report anytime from your dashboard |
| Can you delete it? | Yes — email us and we'll delete it. Self-service deletion is coming |
| Advertising | We do not sell, rent, or share your information with advertisers, and we do not use your children's information to target ads |
3. What we collect
3.1 Information you give us
When you create an account
- Your email address
- Your name, if you provide one
- Your preferred language (English or Bangla)
- Your password — stored only as a cryptographic hash by our authentication provider. We never see it and cannot recover it.
When you add a child
- The child's name (or nickname — see the note in section 4)
- Date of birth
- Gender, if you choose to provide it
- Any notes you write
When you track milestones
- Which milestones you've marked as not yet, emerging, or achieved
- The date a milestone was marked as achieved
- Any notes you add to a milestone
When you download a free checklist
- Your email address, only if you choose to enter it. The checklist download itself never requires an email and never will.
- Which age band you selected, and which language you were browsing in
When you send feedback
- Your email address, your name if given, and your message. You can send feedback without an account.
What we do not collect We have no photo or file upload anywhere in KinderStep. We do not collect your address, phone number, payment details, or your child's medical records.
3.2 Information collected automatically
Always on. We use Vercel Web Analytics, which counts page views without cookies and without building a profile of you. It does not identify you, and it does not follow you to other websites. Admin pages are excluded from it entirely.
Advertising measurement. We use the Meta Pixel so we can tell whether our Facebook posts are reaching parents who find KinderStep useful. It runs on the public pages of our website and sets cookies in your browser.
It reports three things to Meta:
- That a page was visited
- That someone downloaded a milestone checklist, and which age band it was for
- That someone created an account
We do not send Meta your name, your email address, your children's names or birth dates, or any milestone information. We never will.
What Meta receives regardless. We want to be straightforward about something that is true of every advertising pixel on every website, not just ours: when the pixel runs, Meta automatically receives your IP address, your browser type, the address of the page you are on, and a cookie identifier. If you are signed in to Facebook in the same browser, Meta may be able to connect that activity to your Facebook account. This happens as a function of how the pixel works, not because we send it. We are telling you because “we don't send personal information” would be technically true and practically misleading.
How to opt out. You can stop this at any time:
- Block third-party cookies, or use your browser's tracking protection — most browsers, including Safari and Firefox, block this kind of cookie by default.
- Use Meta's own Off-Facebook Activity controls in your Facebook settings to disconnect this activity from your account.
- Use a content blocker.
We do not currently show a cookie banner. We are telling you this directly rather than burying it, so you know what to expect.
Standard server logs (IP address, browser type, time of request) are generated by our hosting provider as a normal part of serving the site and keeping it secure.
4. Your children's information — read this one
This is the part of the policy that matters most, so it gets its own section.
Children do not use KinderStep. Parents and caregivers do. We do not knowingly allow anyone under 18 to create an account. Everything we hold about a child was entered by an adult who chose to enter it.
We do not use children's information for advertising, profiling, or any automated decision-making. Milestone data is never used to train advertising models and is never shared with Meta, Google, or anyone else for marketing.
KinderStep is not a medical device and does not diagnose anything. Milestone ranges are general developmental guidance. Children develop at different rates, and a milestone not yet reached is not a diagnosis. If you have concerns about your child's development, please speak to a paediatrician.
A practical suggestion. You never have to use your child's real name — a nickname or an initial works exactly the same way throughout the app. We mention this because the less identifying information exists anywhere, the less there is to lose.
Who can see it:
- You, when you're signed in.
- Nobody else using KinderStep. Database-level access rules prevent one parent's account from reading another's, and these are enforced by the database itself rather than by application code.
- Our administrators. A small number of KinderStep administrator accounts can view user and child records. This exists so we can provide support, investigate problems, and moderate feedback. We are telling you this plainly because it's true and because a policy that implied otherwise would be misleading. Access is limited to people who need it to operate the service.
Deleting a child's record. You can delete any child from your dashboard at any time. This removes the child's profile and every milestone record attached to it. It is immediate and cannot be undone.
5. Why we use your information, and on what basis
| What we do | Why | Legal basis (for EU/UK users) |
|---|---|---|
| Run your account, save your children and milestones | You asked us to — it's the product | Performance of a contract |
| Send milestone reminder emails | To help you keep tracking | Legitimate interests; you can opt out |
| Send the checklist follow-up email | You opted in | Consent |
| Reply to your feedback | You contacted us | Legitimate interests |
| Keep the service secure and working | To prevent abuse and fix faults | Legitimate interests |
A note for EU and UK users. Developmental milestone information can be considered health-related data under GDPR, which is treated as a special category requiring a higher standard. We rely on your explicit consent, given when you choose to add a child and record milestones. You can withdraw it by deleting the child record or your account.
6. Who we share it with
We do not sell your personal information. We have never sold it and we will not sell it.
We share it only with service providers that make the app work, each bound to use it only on our instructions:
| Provider | What it does | What it sees |
|---|---|---|
| Supabase | Database and sign-in | Everything you store in the app |
| Vercel | Hosting and cookieless analytics | Server logs, page view counts |
| Resend | Sends our emails | Your email address and the message content |
| Meta | Facebook advertising measurement | That a page was visited, a checklist was downloaded (with its age band), or an account was created. Plus your IP, browser, page address, and cookie ID, as all pixels do. Never your children's data. |
| Analytics | Page views — only with your consent. Never child data. |
We may also disclose information if the law requires it, or to protect the safety of a child or another person.
7. Where your information is stored
Our database and application are hosted on servers in Singapore.
If you are in the EU, the UK, or elsewhere, this means your information is transferred outside your country to be stored and processed. We rely on our providers' standard contractual protections for these transfers. If you would like details of the safeguards in place, email support@kinderstep.app.
8. How long we keep it
| Information | How long |
|---|---|
| Account, children, milestones | Until you ask us to delete it |
| A child you delete | Immediately and permanently |
| Checklist email address | Until you ask to be removed, or 24 months after your last interaction |
| Feedback messages | Up to 24 months |
| Server logs | As retained by our hosting provider, typically a matter of weeks |
9. Your rights
Whatever country you're in, you can ask us to:
- See what we hold about you
- Correct anything wrong
- Delete your account and everything in it
- Export your data — you can download a PDF report from your dashboard right now, without asking us
- Stop the reminder emails — every one has an unsubscribe link
- Opt out of the Meta Pixel using the browser and Facebook controls described in section 3.2
If you're in the EU or UK, you additionally have the right to object to processing, to request restriction, to data portability, and to complain to your national data protection authority.
To exercise any of these, email support@kinderstep.app. We'll respond within 30 days. We won't charge you, and we won't make you justify the request.
10. How we protect it
- All traffic is encrypted in transit (HTTPS).
- Passwords are hashed by our authentication provider. Nobody at KinderStep can see your password.
- Database access rules are enforced at the database level, so one account cannot read another's data even if the application has a bug.
- Our email list is deliberately not readable through the public interface.
- Administrator access is restricted to a small number of accounts.
No service can promise perfect security, and we won't pretend otherwise. If a breach occurs that puts you at risk, we will tell you and the relevant authority without undue delay.
11. Changes to this policy
If we change this policy in a way that materially affects you, we'll tell you by email or in the app before it takes effect. The date at the top always reflects the current version.
12. Contact
Email: support@kinderstep.app
Operated from: Bangladesh