Privacy & Compliance Hub
International Privacy Policy
Effective date: October 17, 2026 • Version 2.0
Meet Anvi (formerly Kids Adventure) is an early-learning product designed for children aged 3 to 6 and the parents and guardians who guide them. Because Meet Anvi is designed for young children and available internationally, we treat privacy and children's data protection as core engineering requirements rather than legal footnotes.
This policy explains transparently what data we process, why we process it, where it is stored, how it is protected, and how parents can exercise full control or request complete erasure under global privacy frameworks including EU/EEA GDPR, UK GDPR & the Children's Code, US COPPA & state privacy laws, India's DPDP Act, and Apple's App Store Kids Category requirements.
1. Data Controller & Contact Information
Meet Anvi is developed and operated by Pawan Rai, based in Bangalore, Karnataka, India. For all privacy inquiries, data subject access requests, deletion requests, or regulatory communications:
- Data Protection & Privacy Officer: Pawan Rai
- Contact Email: info@meetanvi.com
2. Complete Data Processing Inventory
We practice radical data minimization. We only collect the minimal personal data required to authenticate parent accounts, sync learning progress across family devices, and verify optional subscriptions.
| Data Category | Subject | Collected? | Purpose | Storage & Retention | Shared With |
|---|---|---|---|---|---|
| Parent Email | Parent | Yes | Account authentication, password reset, progress sync | Supabase (encrypted at rest); retained until account deletion | Authentication provider only |
| Parent Display Name | Parent | Optional | Family greeting in parent dashboard | Supabase (encrypted at rest); retained until deleted | None |
| Phone Number | Parent | Optional | Optional support reference; never used for marketing | Supabase; retained until deleted | None |
| Child Name | Child | No | Not collected; child profiles use pseudonymous avatar names | Not stored on servers | None |
| Child Profile & Level | Child | Yes | Grade level (Preschool / LKG / UKG) and avatar selection | Synced to account to preserve learning curriculum | None |
| Learning Progress | Child | Yes | Stars, badges, quest completions, streaks | Synced to account so child can switch devices | None |
| Audio / Voice Recordings | Child | Never | Thinking speech is processed 100% on-device via Apple Speech | Zero audio recorded or stored on any server | None (never leaves device) |
| Thinking Drawings & Text | Child | Local Only | Local child art and on-device transcription | Stored locally on device only; never synced to cloud | None (deleted on app uninstall) |
| Math Wizard AI Hints | Child | Local Only | On-device hints via Apple Foundation Models framework | Executed locally on device silicon; zero cloud LLMs | None (never sent to servers) |
| Device Identifiers / IDFA | Both | Never | No advertising identifiers (zero IDFA, zero GAID) | Not collected | None |
| Precise Geolocation | Both | Never | No GPS or Wi-Fi triangulation collected | Not collected | None |
| Payment / Card Details | Parent | Apple Only | In-app purchases and subscriptions | Processed by Apple StoreKit; we never see billing info | Apple Inc. |
| Crash Reports (App) | System | Local Only | Apple MetricKit local crash summaries | Written to local device log; not transmitted to servers | None |
| Website Analytics | Visitor | Anonymous | Vercel Web Analytics (page views, referrer, browser) | Cookie-less, no IP storage, 24-hour rotating hash | Vercel Inc. |
3. Separation of Parent and Child Data
Children never create independent accounts in Meet Anvi. The system is designed with a strict parent-child boundary:
- Parent Account: The parent or legal guardian is the primary data subject. They hold credentials, manage subscription purchases, and configure settings.
- Parent PIN Gate: A secure PIN gate blocks curious child hands from accessing account settings, parent reports, external web links, and purchases.
- Pseudonymous Child Profiles: Children interact through calm animal avatars and grade selections. We do not require a child's legal name, birth date, school, or contact details.
4. European Union & EEA Compliance (GDPR)
For users residing in the European Economic Area, Meet Anvi complies with Regulation (EU) 2016/679 (General Data Protection Regulation):
- Legal Bases for Processing (Art. 6):
- Performance of Contract (Art. 6(1)(b)): Processing parent credentials and learning progress to deliver the cross-device learning service.
- Consent (Art. 6(1)(a)): Optional microphone permission for the Thinking activity. Consent is managed directly by the parent behind the PIN gate and can be revoked at any time in device settings.
- Legitimate Interests (Art. 6(1)(f)): Maintaining anonymous server uptime, security, and bug mitigation.
- Children's Consent (Art. 8): Because our service is directed to children aged 3 to 6, account creation and consent are strictly required from the holder of parental responsibility.
- International Data Transfers: Personal data (parent account email and synced learning markers) is hosted on secure AWS cloud infrastructure in the United States via Supabase using encrypted transmission (HTTPS) and encrypted database storage. Transferred data is protected under our cloud service providers' security standards and commercial terms.
- Data Subject Rights (Articles 15–22): Parents have the right to access, rectify, port, restrict processing, object, and erase all personal data. Requests can be submitted via our data deletion guide or by emailing info@meetanvi.com.
5. United Kingdom Compliance (UK GDPR & Children's Code)
Meet Anvi complies with the UK Data Protection Act 2018, UK GDPR, and the 15 standards of the Information Commissioner's Office (ICO) Age Appropriate Design Code (Children's Code):
- Best Interests of the Child: The app's design prioritizes child well-being, cognitive calm, and healthy development over engagement maximization.
- High Privacy by Default: All non-essential features are off by default. Geolocation is never collected.
- Gentle Habits Without Addictive Dark Patterns: While Meet Anvi encourages regular learning with gentle daily streak counters and stars, we do not employ manipulative loss-aversion nudges, countdown timers, FOMO push alerts, or guilt messaging designed to hook young children.
- Parental Controls: Built-in PIN-protected session timers allow parents to enforce screen-time boundaries that conclude with gentle animations.
6. United States Compliance (COPPA & State Laws)
Meet Anvi strictly complies with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, and FTC regulations:
- No Personal Identifying Information Collected From Children: We do not knowingly collect, use, or disclose personal identifying information (including legal names, personal email addresses, phone numbers, home addresses, photos, voice recordings, or persistent advertising identifiers) from children under 13.
- Pseudonymous Learning Progress Stored on Parent Account: Children interact through animal avatars without real names or birth dates. Curriculum level (Preschool, LKG, UKG), completed stops, stars earned, and streaks are attached strictly to the parent's account to enable cross-device progress sync.
- On-Device Local Artifacts: Child creative drawings and Thinking speech transcripts stay strictly on the physical device container and are never uploaded to our servers.
- Parental Gate & Notice: Parents are provided full notice of our data practices. Account creation and subscription management require adult initiation behind our parent gate.
- Parental Review and Deletion: Parents may review or request deletion of their account and synced progress at any time by contacting info@meetanvi.com or using in-app controls.
- California Consumer Privacy Act (CCPA / CPRA): We do NOT sell personal information and do NOT share personal information for cross-context behavioral advertising. We do not sell or share the personal information of minors under 16 years of age.
7. India Compliance (Digital Personal Data Protection Act 2023)
Because Meet Anvi is established in India and serves Indian families, we comply with India's Digital Personal Data Protection Act, 2023 (DPDP Act):
- Section 9 (Processing of Personal Data of Children): We mandate verifiable parental consent prior to processing any personal data associated with a child.
- No Tracking or Behavioral Monitoring: Meet Anvi does not engage in tracking, behavioral monitoring, or targeted advertising directed at children.
- No Detrimental Processing: We do not undertake any processing of children's data that causes or is likely to cause any detrimental effect on the well-being of a child.
- Grievance Redressal: Pawan Rai serves as the Grievance Contact. Inquiries submitted to info@meetanvi.com are resolved within statutory deadlines (30 days).
8. Apple App Store Kids Category Compliance
Meet Anvi is engineered to satisfy Apple's strictest App Store Review Guidelines (Guideline 1.3 for Kids Category and Guideline 5.1 for Privacy):
- Zero Third-Party SDKs: The iOS app contains NO third-party advertising, analytics, attribution, or social media SDKs.
- App Privacy Details Reconciliation: Our App Store Connect Privacy Nutrition Label declarations match our actual app binary:
- Data Used to Track You: None (zero third-party tracking across apps or websites).
- Data Linked to You: Contact Info (Email Address, and optional Display Name / Phone) collected under App Functionality strictly for parent account authentication and subscription entitlement.
- Data Not Linked to You: None.
- No location, no financial info, no contacts, no user content, no browsing history, no persistent identifiers, and no diagnostics are collected or transmitted by the app.
- Parental Gate: In compliance with Guideline 1.3, all commerce, account management, external links, and parent settings require solving a multi-step adult gate or entering a 4-digit parent PIN.
9. Third-Party Processor Review & Vendor Register
Meet Anvi maintains a formal register of third-party service providers that assist in operating the service. Each provider processes data strictly on our behalf under contractual confidentiality and data protection obligations:
| Vendor / Company | Service Provided | Data Processed | Purpose | Location | Security Safeguards | Retention |
|---|---|---|---|---|---|---|
| Supabase Inc. | Relational Database & Authentication | Parent email, encrypted password hash, optional display name & phone, pseudonymous child grade level, stars earned | Parent credentials and cross-device learning progress sync | US-East (AWS N. Virginia, USA) | Encrypted connections (HTTPS/TLS) and encrypted database storage; access restricted to operations | Retained while parent account is active; deleted within 30 days of deletion request |
| Apple Inc. | In-App Purchases, StoreKit & App Distribution | StoreKit anonymous transaction IDs, subscription entitlement status | Subscription entitlement validation (Anvi Plus) and optional Apple Sign-In | Cupertino, CA, USA (Global Apple CDN) | Apple Developer Program License Agreement & App Store terms; PCI-DSS Level 1 payment processing | Retained per Apple statutory financial & tax retention mandates |
| Google LLC | Parent Authentication (Optional) | Parent email address, display name (as provided via OAuth) | Optional Google Sign-In for parent accounts on web and app | USA / Global | Google API Services User Data Policy & OAuth 2.0 security standards | Retained while parent account is active; deleted on account removal |
| Vercel Inc. | Edge Web Hosting & Web Analytics | Anonymized daily rotating IP hash, browser user-agent, visited page URLs (stripped of query tokens) | Website delivery, DDoS mitigation, and anonymous page load performance telemetry (gated by consent) | Global Edge Network (US/EU) | HTTPS encryption; cookie-less metrics; zero cross-site tracking | 30 days rolling window for aggregated metrics |
10. Data Retention & Automated Purging Schedule
| Data Category | Retention Period | Purge Mechanism |
|---|---|---|
| Parent Account & Profile | Duration of active account + 30 days grace | Automated database cascade on deletion request |
| Synced Child Progress | Duration of parent account existence | Instantly wiped when parent account or child profile is reset |
| Thinking Voice & Drawings | Local only (never transmitted to cloud) | Parent can delete in-app or uninstalls the app |
| Math Wizard Puzzle Logs | Local only (never transmitted to cloud) | Parent can reset in-app or uninstalls the app |
| Support Emails & Deletion Tickets | 90 days post-resolution | Scheduled purge |
| Website Access Logs | Rolling 30 days | Automated rolling log deletion |
11. International Compliance Matrix
To provide complete transparency to parents, educators, App Store review teams, and global regulatory authorities, the following matrix tracks our implementation across major privacy frameworks:
| Compliance Requirement | EU / EEA (GDPR) | United Kingdom (UK GDPR & Children's Code) | United States (COPPA & State Laws) | India (DPDP Act 2023) | Apple App Store (Kids Category) | Operational Status |
|---|---|---|---|---|---|---|
| Privacy Policy | Art. 12–14 transparent notices | Standards 3 & 4 (Awareness & Clarity) | 15 U.S.C. § 6502 prominent notice | Section 5 statutory notice | Guideline 5.1 & 1.3 transparency | Published & Live |
| Children's Data | Art. 8 data minimization | Standard 1 (Best interests of child) | Zero child personal data collected without VPC | Section 9(1) guardian consent mandate | Guideline 1.3 strict child minimization | Pseudonymous Only |
| Parental Consent & Gate | Holder of parental responsibility consent | High privacy defaults & adult controls | Verifiable Parental Consent (VPC) | Section 9(1) verifiable guardian consent | Guideline 1.3 multi-step adult gate | PIN Gate & StoreKit |
| Data Deletion | Art. 17 Right to Erasure (30-day SLA) | UK GDPR Art. 17 right to erasure | COPPA parental deletion right | Section 12(3) statutory right to erasure | Guideline 5.1.1(v) in-app deletion mandate | In-App & Email |
| Analytics & Telemetry | Art. 22 zero child profiling | Standard 12 (Zero profiling) | No persistent IDs used for profiling | Section 9(2) ban on behavioral monitoring | Guideline 1.3 zero 3rd-party analytics SDKs | Zero Child Analytics |
| Advertising | Prohibited for children | Prohibited for children | Zero behavioral advertising | Section 9(2) strict ban on targeted ads | Guideline 1.3 strict ban on 3rd-party ads | 100% Ad-Free |
| Data Retention | Art. 5(1)(e) storage limitation | Standard 8 (Data minimization) | § 6502(b)(2)(D) retention limits | Section 8(7) retention limitation | Guideline 5.1.1 clear retention | Strict Schedule |
| International Transfers | Encrypted US cloud hosting (AWS) | Encrypted US cloud hosting (AWS) | US cloud infrastructure controls | Section 16 cross-border transfer rules | Apple global CDN infrastructure | Encrypted |
| Vendor Agreements | Provider terms & security policies | Provider terms & security policies | Provider terms & confidentiality rules | Provider terms & data safeguards | Apple Developer License Agreement | Operational |
| Technical Security | Art. 32 technical safeguards | Standard 7 (Data protection standards) | Reasonable security procedures | Section 8(5) reasonable security safeguards | Sandboxing & Keychain isolation | HTTPS & AES-256 |
| User & Parent Rights | Articles 15–22 data subject rights | Full UK GDPR individual rights | Parental review and correction | Section 11–14 rights of Data Principal | In-app account controls & export | Grievance SLA: 30d |
12. How to Exercise Your Rights & Delete Data
Parents have complete autonomy over their family's data. You can delete your account and all associated child progress at any time:
- In-App Controls: Inside the Meet Anvi iOS app, open Settings behind the parent PIN to reset child progress or request account deletion. Thinking entries and Math Wizard records are stored locally on that device and are erased immediately when reset or when the app is uninstalled.
- Email Requests: Parents can email info@meetanvi.com from their registered parent email address. Deletion requests are actioned within 30 days. See our Data Deletion Request Guide for step-by-step instructions.
13. Policy Updates
If we make material changes to how we collect or process personal data, we will notify registered parent account holders via email at least 30 days before changes take effect, update the effective date at the top of this document, and request renewed parental authorization where required by applicable law.
Meet Anvi Trust Center • Children's Notice • Data Deletion • Security Overview • Terms