Privacy Policy

1. Who We Are

KONI Technologies LLC ("KONI," "we," "us," or "our") operates the KONI platform at koniapp.com — a Montessori planning and guidance platform for parents, caregivers, and educators. For privacy questions, contact us at hello@koniapp.com.

2. Information We Collect

2.1 Account Information

When you create a KONI account, we collect:

• Your name
• Email address
• Password (stored as a one-way hash — we cannot read your password)
• Role (Parent, Nanny, or Montessori Guide)

2.2 Onboarding Profile Information

During the setup wizard, you optionally provide:

• Your location (US state; optional city or school district)
• Your educational purposes and goals
• Whether you follow specific educational standards (e.g., Common Core, AMI/AMS Montessori)

2.3 Child Profile Information

You may add one or more child profiles, providing:

• First name or nickname (you do not need to provide a legal name)
• Age range (e.g., "3–4 years") — we do not collect exact birthdates
• Interests and developmental sensitive periods
• Learning differences or accommodations you choose to share (e.g., ADHD, dyslexia, sensory processing needs) — this is optional and entirely your choice

Children's information is entered by and belongs to the adult account holder. We do not collect information directly from children. See Section 4 (Children's Privacy) for COPPA compliance details.

2.4 Content You Create

• Observations and developmental notes
• Portfolio items (photos, documents, artwork — stored in encrypted cloud storage)
• AI coaching conversations (messages sent to and received from the KONI AI Coach)
• Messages you exchange with a guide through KONI messaging, which becomes available once you have a booking together. These are stored so both of you keep a record of the relationship, and may be reviewed by authorized KONI personnel for safety and quality, or to resolve a dispute — see our Terms of Service.
• Activity progress and notes
• Weekly plans and saved activities

2.5 Guide Application Information (Guide Applicants Only)

If you apply to become a KONI guide, we collect: credentials and training certifications, professional experience, availability, and Stripe payment information for payouts.

2.6 Payment Information

Payment is processed entirely by Stripe, Inc. KONI does not store your card number, CVV, or bank account details. We receive from Stripe: last four digits of your card, card brand, expiration month/year, and your Stripe customer ID. We also retain transaction records (amount, date, subscription status).

2.7 Automatically Collected Information

• Usage data: Pages visited, features used, clicks and interactions — collected via PostHog analytics
• Device/browser information: Browser type, operating system, screen resolution, language preference
• IP address: Collected for security and general geolocation (country/region level)
• Cookies: Session cookies for authentication (required) and analytics cookies (see Section 11)

3. How We Use Your Information

4. Children's Privacy (COPPA)

KONI is designed for use by adults. Our Services are not directed at children under 13, and children under 13 may not create accounts. All child profiles are created and managed by adult account holders.

Under COPPA (Children's Online Privacy Protection Act):

• We do not knowingly collect personal information directly from children under 13.
• Adult users who add a child's profile to KONI provide their consent as the parent or legal guardian of that child.
• When child profile data is used in AI coaching conversations, we display a clear disclosure and obtain your acknowledgment before that data is sent to OpenAI. You may use the AI coach without attaching a child profile.
• Parents may review, correct, or delete their child's data at any time from Privacy & Data, or by contacting hello@koniapp.com.

If you believe we have inadvertently collected personal information from a child under 13 without proper consent, contact us at hello@koniapp.com and we will delete it promptly.

5. AI Coaching — How Your Data Is Used with OpenAI

The KONI AI Coach is powered by OpenAI's API (GPT-4 model family). Here is exactly what happens when you use it:

• Without a child profile attached: Only your message is sent to OpenAI. No personal information about you or your child is included in the prompt.
• With a child profile attached: The child's first name, age range, learning differences you've shared, and the conversation history in that thread are transmitted to OpenAI to generate a contextually relevant response. We record this transmission in our audit log with the flag sent_to_third_party = true.

What OpenAI does with this data: OpenAI processes prompts to generate responses. As of the effective date of this Policy, OpenAI does not use API-submitted data to train its models by default (per their API usage policy). We encourage you to review OpenAI's privacy policy at openai.com/policies/privacy-policy for the most current terms.

KONI does not use your child's data or AI conversations to train our own models or sell to third parties. Your AI conversation history is stored in your account and can be exported or deleted (see Section 9).

6. Third-Party Service Providers

We share data with the following service providers who process data on our behalf, under data processing agreements that restrict their use of your data:

We do not sell your personal information to any third party. We do not share your data with advertisers.

7. Data Retention

8. Data Sharing — What We Never Do

• We never sell your personal information or your child's information.
• We never share your data with advertisers.
• We do not share educational records or child data with schools, government agencies, or other third parties without your explicit consent or a lawful order.
• We do not use your data or AI conversations to train AI models.

9. Your Rights and Choices

Access and Export

You may export all data associated with your account and your child's profiles from Privacy & Data → Export Your Data. The export includes: your account information, child profiles, observations, portfolio items, AI chat history, activity records, consent log, and third-party disclosure records.

Correction

You may update your account information and child profiles at any time within the app. Contact hello@koniapp.com if you need assistance correcting data that is not editable in-app.

Deletion

You may request deletion of individual child profiles, specific records, or your full account from Privacy & Data → Delete Data. Deletion requests have a 30-day grace period during which you may cancel the request. After 30 days, deletion is permanent. Payment records required by law cannot be deleted immediately.

Consent Withdrawal

Where processing is based on your consent (e.g., AI coaching with child data, marketing emails), you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Manage consents from Privacy & Data → Manage Consents.

Unsubscribe

Every marketing email from KONI includes an unsubscribe link. Transactional emails (receipts, session confirmations, security alerts) cannot be opted out of while your account is active, as they are necessary to provide the Service.

10. California Residents — CCPA Rights

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request information about the categories and specific pieces of personal information we collect, the sources, our business purposes, and the categories of third parties we share with.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: KONI does not sell personal information. No opt-out is required, but this right is available to you.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise CCPA rights, contact hello@koniapp.com with "California Privacy Request" in the subject line. We will respond within 45 days.

11. Cookies and Analytics

KONI uses two types of cookies:

• Essential cookies: Required for authentication and session management. These cannot be disabled without breaking the app.
• Analytics cookies: Used by PostHog to understand how people use the app once they are signed in. Analytics do not load at all until you allow them. We ask once, on your first visit; if you decline, nothing about your use of the app is collected and anything held locally is discarded. When you allow them, your account id (never your email) ties your use of the app together across devices. You can change your mind at any time using the control below.
• Visit counts without cookies: On our public pages (the homepage, pricing, the blog, the signup page) we count visits and clicks without setting a cookie or storing anything on your device. Nothing identifies you, the count resets daily, and it never follows you into the app.

We do not use advertising cookies, and no ad network's tracker runs on KONI. If you reached KONI through an ad, we keep the click identifier that platform added to our link (for 90 days on your device, then with your account) and, from our server, tell that one platform when a signup, a trial start or a payment followed its ad, with a hashed form of your email so it can match the click. That is all it learns. The control below switches it off for your account, and we honour your browser's Global Privacy Control signal automatically.

Signed-in members can also stop KONI telling an ad platform about their signup, trial or payment: sign in and come back to this section.

12. Data Security

We implement reasonable technical and organizational security measures to protect your data, including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Password hashing (bcrypt via Supabase Auth)
• Row-level security policies (Supabase RLS) restricting data access to authorized users
• Hourly encrypted database backups stored in Cloudflare R2 (age-encrypted)
• Access audit logging for sensitive operations
• Admin access controls requiring authentication

No security system is impenetrable. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

13. International Users

KONI is operated in the United States. If you access KONI from outside the United States, your data will be transferred to, stored, and processed in the US. By using KONI, you consent to this transfer. We apply US privacy standards described in this Policy globally.

14. Changes to This Privacy Policy

We will update this Privacy Policy as our practices change. For material changes (changes that affect your rights or how we use sensitive data), we will email you at least 14 days before the change takes effect. The current Policy is always available at koniapp.com/privacy-policy with the effective date clearly displayed.

15. Contact Us

For privacy questions, requests to exercise your rights, or data concerns: