Privacy Policy

Last updated: 25 July 2026

WritenDraw is operated by LOVEUAD LTD (Company No. 16838046), registered in England and Wales. We take child privacy seriously. This policy explains what we collect, why, and how it is protected.

Who this service is for

WritenDraw is for children aged 5–13. Parents or legal guardians create the account and provide explicit consent before any child uses the service.

What we collect about children

• Age only — we do not store names, gender, school, location, or any other identifying information about children.
• Learning progress — topic scores, session duration, XP earned. Used only to generate the weekly plan and parent progress report.
• Session activity — which domains and topics were visited, time spent. Used for usage cap enforcement and reporting.
• Distress flags — a short anonymised summary (maximum 10 words, no personal content) if our AI detects a child may be distressed. Shared only with the linked parent.
• Uploaded images — drawings or homework photos sent for Cosmo feedback. Processed in real time and not stored after the response is sent.

What we collect about parents

• Email address and Google account ID (via Supabase Auth / Google OAuth)
• Billing information — handled entirely by Stripe. We never store card details.
• Consent timestamp and version — to record that you agreed to these terms.
• Push notification subscription — to send distress alerts and updates.

What we do not do

• We do not sell data — ever, to anyone.
• We do not store child conversation transcripts after a session ends.
• We do not serve advertising.
• We do not build behavioural profiles for commercial purposes.
• We do not share data with third parties except where strictly required: Supabase (database hosting), Stripe (billing), Google (authentication and Gemini AI processing).

AI and distress detection

Our AI companion Cosmo uses Google Gemini to process conversations. When Cosmo detects that a child may be distressed, it responds with warmth and calm, and sends a silent alert to the linked parent. Cosmo never gives advice, never suggests actions, and never refers children to external services. The decision on how to respond always rests with the parent.

Conversation content is sent to Google's Gemini API for processing. Conversations are not stored by Google for training purposes under the API terms of service.

Data retention

• Learning progress and session data: retained while the account is active.
• Distress flags: retained until marked as seen by the parent, then deleted after 30 days.
• Uploaded images: processed in real time, not stored.
• On account deletion: all data is permanently deleted within 72 hours.

Your rights (GDPR / UK GDPR)

You have the right to access, correct, export or delete all data we hold about your family. To exercise any of these rights, email kanchan.g12@gmail.com. We will respond within 30 days.

You may also delete your account at any time from the parent dashboard. This permanently removes all associated data.

Cookies

We do not use tracking cookies. We use browser localStorage only to remember your session token and family link code on your device.

Security

All data is encrypted in transit (HTTPS). Sensitive values are encrypted at rest using Fernet symmetric encryption. We use Supabase Row Level Security so the database cannot be accessed without server-side authorisation.

Children under 13 (COPPA)

Accounts are created by parents only. Children do not provide personal information directly — they interact via an age-only profile set up by the parent. If you believe a child has provided personal information without parental consent, contact us immediately and we will delete it.

Contact

LOVEUAD LTD
Leeds, UK
Email: kanchan.g12@gmail.com