Privacy Policy

WonderMinds is operated by Zylo Agency PTE. LTD., a company registered in Singapore (SSIC 62011 / 70205). We are the party responsible for personal data processed through the App ("controller" under GDPR; "organisation" under PDPA), except where a Parent's own Apple ID or Google Account governs a particular data flow, such as billing.

WonderMinds is a "child-directed" service for COPPA purposes and falls within the scope of GDPR-K and PDPA rules on children's data. Accounts, subscriptions, and payment are handled exclusively by the Parent. Children do not create independent accounts, cannot self-register, and cannot interact with the App without a Parent first setting it up and consenting on their behalf.

3.1 Information We Collect From the Parent / Account Holder

• Contact information: name and email address, used for account setup, communications, and customer support.
• Payment information: subscription and billing details are handled by the Apple App Store, Google Play, and our subscription management provider, RevenueCat. We do not directly receive or store full payment card numbers.
• Device and technical information: device type, operating system, app version, and general usage/analytics data (e.g., crash reports, feature usage) to keep the App reliable.
• Communications: any messages sent to our support team.

3.2 Information We Collect From or About the Child

Because WonderMinds is used directly by children, we collect a limited set of information necessary to personalize and operate the App's features, and no more than is reasonably necessary for the child to participate in those features:

• First name or nickname (as entered by the Parent), used only to personalize in-app content (e.g., a personalized storybook title such as "Noham's Storybook").
• Age or age range, used to select age-appropriate stories, challenges, and difficulty level (Discovery / Journey / Adventure).
• Progress and activity data: completed stories, challenge results, difficulty level, and streaks, used to tailor the child's learning path and to power the Parent Dashboard described in Section 5.
• Voice or audio input, only where a specific feature requires it (e.g., an interactive read-aloud or speech-based challenge). Audio is processed solely to deliver that feature (such as narration feedback) and is not used to create a voiceprint or for any biometric identification purpose.
• Creative content ('Create' pillar): drawings, recordings, or other creative work your child produces in the App. This content is stored in Supabase (our cloud database) so it can sync privately across the family's own devices. It is visible only within the child's own profile and to the Parent — it is never made public, never shared with other users, never sold, and never used to train any AI model, whether ours or a third party's.

We do not require or request a child's full legal name, home address, precise geolocation, phone number, government ID, or any independent contact method. There is no chat, messaging, or public posting feature of any kind — your child cannot communicate with other children or with strangers inside the App.

3.3 Information From Automated Tools

We use limited technical logging (not third-party advertising cookies or cross-app tracking) to keep the App secure and functioning correctly. WonderMinds displays no third-party advertising and uses no behavioral advertising trackers of any kind.

• To create and manage the Parent's account, subscription, and any child profiles linked to it.
• To operate core App features: generating and personalizing stories, challenges, and creative activities.
• To sync a child's progress and creative content privately across the family's own devices.
• To power the Parent Dashboard (Section 5), so you can see your child's activity.
• To process payments and manage subscription renewals, upgrades, and cancellations.
• To provide customer support and respond to inquiries.
• To maintain the security, stability, and integrity of the App.
• To comply with legal obligations.

We do not sell children's personal data. We do not use any child's data — including creative content, voice input, or progress data — to train AI models, to build advertising profiles, or for any purpose beyond operating the App and supporting your family's use of it.

We provide a Parent Dashboard, accessible only to the Parent account holder, that shows your child's activity and progress across Wonder, Think, and Create — including stories read, challenges completed, and creative content produced — so you always have visibility into what your child has done in the App. Access to the Dashboard is restricted to the Parent's authenticated account and is never visible to other users.

WonderMinds relies on trusted third-party service providers ("processors") to operate. These providers process data on our behalf, under confidentiality and data-protection obligations, and do not use the data for their own independent purposes:

• Supabase — backend database and infrastructure hosting for account, profile, progress, and creative-content data.
• RevenueCat — subscription and in-app purchase management.
• OpenAI (GPT-4) — used to help generate or personalize story and challenge content. Prompts and outputs used to generate App content are processed to produce the requested content and are not used by us or, per our agreements, by the provider to train models on children's personal data.
• ElevenLabs — used to generate audio narration (text-to-speech) for stories and in-app content.
• Apple App Store / Google Play — handle app distribution and billing under their own respective privacy terms.

Where any provider processes personal data outside Singapore, the EU/UK, or the child's home country, we require safeguards appropriate to that transfer (such as standard contractual clauses or equivalent mechanisms).

7.1 Verifiable Parental Consent

Before collecting any personal data from a child, we obtain verifiable parental consent. We do this through a two-part mechanism recognized under COPPA: (1) the Parent creates the account using their own email address, and (2) the Parent completes payment through the Apple App Store or Google Play, which requires an authenticated adult payment method. Together, these confirm that an adult with authority has reviewed and agreed to this Policy on the child's behalf. The same mechanism satisfies the consent requirements under GDPR-K and PDPA for personal data provided by a person with parental responsibility.

7.2 No Conditioning Beyond What Is Necessary

In accordance with COPPA, we do not condition a child's participation in an activity on the child disclosing more personal data than is reasonably necessary for that activity.

7.3 Parental Rights

As a Parent, you may at any time:

• Review the personal data we have collected from your child, including creative content and progress data.
• Request correction of inaccurate data.
• Request deletion of your child's personal data, creative content, and/or profile.
• Refuse further collection or use of your child's data, understanding this may end the child's ability to use certain features.

To exercise any of these rights, contact us at contact@wondermindsapp.com. We will verify you are the account's Parent before acting, and will complete deletion requests within 30 days of verification (see Section 11).

7.4 GDPR-K (EU/UK)

Where GDPR applies, our legal basis for processing a child's data is parental consent and the performance of our contract with the Parent for the App's services. Parents in the EU/UK may exercise the rights in Section 10 on the child's behalf, and may lodge a complaint with their local supervisory authority (in the UK, the Information Commissioner's Office) if concerned about our handling of their child's data.

7.5 Singapore PDPA

Where PDPA applies, we collect, use, and disclose personal data — including a child's data collected via Parent consent — only for purposes a reasonable person would consider appropriate in the circumstances. Our Data Protection Officer can be reached at contact@wondermindsapp.com for any PDPA-related request, and Parents may also contact Singapore's Personal Data Protection Commission (PDPC) with concerns.

7.6 No Third-Party Marketing to Children

We do not disclose children's personal data to third parties for marketing purposes, and the App contains no third-party advertising of any kind.

A single subscription may support multiple child profiles (for example, for siblings), managed entirely by the Parent account holder. Each profile's data — name/nickname, age range, progress, and creative content — is protected under this Policy in the same way, is visible only to the Parent through the account and Parent Dashboard, and can be individually reviewed, corrected, or deleted by the Parent at any time.

We share personal data only in the following circumstances:

• With the service providers listed in Section 6, solely to operate the App.
• With Apple and Google, as required for app distribution and billing.
• If required by law, regulation, legal process, or a valid governmental request.
• In connection with a merger, acquisition, financing, or sale of assets, in which case Parents will be notified and the data will remain subject to this Policy or a policy offering equivalent protections for children's data.

We do not sell or rent personal data, including children's data, to any third party, under any circumstances.

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port your (and your child's) personal data, object to certain processing, and withdraw consent at any time. To exercise these rights, contact us at contact@wondermindsapp.com. We will respond within the timeframe required by applicable law (generally within 30 days).

We retain personal data only as long as necessary to provide the App's services, comply with legal obligations, resolve disputes, and enforce our agreements, specifically:

• Verified deletion requests are completed within 30 days.
• If a subscription lapses, we retain the account and child profile data (including creative content) for up to 12 months in case the Parent wishes to resume, after which it is permanently deleted, unless the Parent requests earlier deletion.
• Technical and support logs are retained for a limited period as needed for security and troubleshooting, then deleted or anonymized.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure. If we become aware of a data breach affecting your or your child's personal data, we will notify affected Parents and relevant authorities without undue delay, as required by applicable law.

Zylo Agency PTE. LTD. is based in Singapore, and our service providers may process data in other countries, including the United States. Where data is transferred internationally, we require appropriate safeguards consistent with applicable law.

WonderMinds is an ad-free app and does not use third-party advertising cookies or cross-app tracking technologies. Our marketing website may use minimal analytics cookies to understand site traffic; where required, we present a cookie notice there.

We may update this Privacy Policy from time to time. If we make material changes, particularly to how we handle children's data, we will notify Parents via email and/or in-app notice before the changes take effect, and where required by law, we will seek renewed parental consent.

Email: contact@wondermindsapp.com
Data Protection Officer (PDPA): reachable at contact@wondermindsapp.com
Company: Zylo Agency PTE. LTD. (Singapore)

If you believe we have collected information from a child without appropriate parental consent, contact us immediately at contact@wondermindsapp.com so we can investigate and delete the data.