Privacy Policy for Sprout: Safe AI for Kids
Effective date: 17 July 2026
This Privacy Policy applies to the Sprout: Safe AI for Kids mobile application and its related services, collectively referred to as the “Application”. The Application is operated by Yusuf Yacoobali, referred to in this policy as the “Service Provider”, “Sprout”, “we”, “us” or “our”.
Yusuf Yacoobali is responsible for the personal information processed through Sprout. Privacy questions and requests can be sent to yyacoobali@gmail.com.
Child-friendly summary
Sprout remembers only the information needed to provide its learning features. A parent or legal guardian creates and manages the family account. Parents can control settings, review information and delete saved content or the entire account.
Sprout does not sell children’s personal information, use children’s conversations for behavioural advertising or collect precise location information.
Parent-managed use
Sprout is designed for children to use through an account created and managed by a parent or legal guardian.
Parents provide consent for their child's use of AI-powered features during onboarding or before those features are first used.
The parent or guardian is responsible for:
Creating and managing the account.
Providing accurate child profile information.
Choosing safety settings, learning preferences and time limits.
Supervising the child’s use of Sprout.
Keeping account details and the grown-up PIN secure.
Providing any parental permission or consent required by applicable law.
Where applicable law requires parental consent before information is collected from a child, Sprout will rely on the parent or legal guardian to provide that consent through the relevant account or feature.
Information Sprout collects
The information collected depends on the features selected by the family.
Parent account information
Sprout may collect:
The parent’s email address.
Authentication information and account identifiers.
Google or Apple sign-in identifiers where those sign-in methods are used.
Account preferences and settings.
Communications sent to customer support.
Sprout does not receive or store full payment card details.
Child profile information
A parent may provide information about a child, including:
A nickname or profile name.
Age or age range.
Learning preferences.
Response-style preferences.
Time limits.
Blocked-topic and safety settings.
Other information entered by the parent to personalise the child’s experience.
Parents should avoid entering the child’s full legal name, home address, telephone number, school details, passwords or other unnecessary identifying information.
Content and learning activity
Sprout may process or store:
Questions and chat messages.
Recent conversation history.
Stories, riddles and learning explanations.
Saved notes and scrapbook items.
Generated or uploaded pictures.
Game activity, answers and progress.
Feature usage and learning activity.
Parent reports and summaries.
Saved family content is private and is not made publicly searchable through Sprout.
Voice information
When live voice features are used, microphone audio is transmitted for real-time processing.
Sprout does not intentionally save a reusable voice recording as part of the child’s profile or scrapbook. However, text, conversation history or activity associated with a voice session may be retained where the feature normally saves history or learning progress.
Subscription and purchase information
Sprout may receive:
Subscription status.
Product identifiers.
Purchase and renewal status.
Entitlement information.
App-store account transaction identifiers.
Limited information required to manage purchases and restore subscriptions.
Payments are processed by Apple or Google. RevenueCat helps Sprout manage subscription status and entitlements.
Technical and security information
Sprout may process limited technical information required to operate and secure the Application, including:
Internet Protocol address.
Device type and operating system.
App version.
Request dates and times.
Error and diagnostic information.
Authentication and security logs.
Usage-limit and quota information.
Features or screens used, where analytics is enabled.
Time spent using the Application, where analytics is enabled.
This information is used for security, reliability, fraud prevention, troubleshooting and service improvement.
Device permissions
Sprout may request the following device permissions:
Microphone: Used when voice features are activated.
Notifications: Used for optional reminders and service notifications.
Photo library or media storage: Used when a grown-up chooses to save, upload or export an image.
Permissions can normally be changed through the device’s settings. Disabling a permission may prevent the related feature from working.
Sprout does not require precise location access for its learning features.
How information is used
Sprout uses information to:
Create and authenticate parent accounts.
Provide age-aware AI answers, stories, images, games and voice features.
Personalise learning content using parent-selected preferences.
Apply safety settings, topic restrictions and time limits.
Save content and learning progress.
Synchronise information across supported devices.
Generate reports for parents.
Manage subscriptions, purchases and usage limits.
Respond to support requests.
Prevent misuse, fraud and unauthorised access.
Investigate technical, reliability or safety problems.
Meet legal and regulatory obligations.
Improve the safety and performance of the Application.
Sprout does not use children’s personal information for behavioural advertising.
Artificial intelligence
Sprout uses OpenAI and Google Gemini to provide chat, stories, images and voice features.
Depending on the feature used, Sprout may securely send the child's profile name or nickname, age, messages, prompts, voice input and recent conversation history required to generate a response.
This information is used only to provide the requested AI feature. Sprout does not use it to train AI models. OpenAI and Google Gemini do not use this data to train their AI models.
Sprout asks for consent before sending personal information to third-party AI providers. If consent is not granted, AI-powered features will not be available.
Service providers
Sprout uses third-party service providers to operate the Application. These may include:
OpenAI: AI processing for chat, images and voice. Data is processed only to provide the requested feature and is not used to train OpenAI models.
Google Gemini: AI processing, safety checks and image generation. Data is processed only to provide the requested feature and is not used to train Google AI models.
Supabase: Authentication, database storage, private media storage and server functions.
RevenueCat: Subscription status and entitlement management.
Apple: App distribution, sign-in and purchase processing.
Google: App distribution, sign-in and purchase processing.
Expo: Application infrastructure, updates and notification-related services where used.
These providers may receive only the information reasonably required to perform their role. Their processing is also governed by their respective privacy policies and contractual obligations.
Cookies, SDKs and similar technologies
Sprout and its service providers may use software development kits, local storage, device identifiers, pixels or similar technologies to provide functionality, maintain security, remember settings, measure performance and manage subscriptions.
Cookies may be used where Sprout opens web-based pages or authentication services.
Where required by applicable law, consent will be requested before non-essential analytics or tracking technologies are used.
Sprout does not use third-party behavioural advertising SDKs.
Legal reasons for processing
Where UK or European data-protection law applies, Sprout processes personal information under one or more of the following legal bases:
Performance of a contract: Where information is needed to provide the service requested by the parent.
Consent: For optional permissions or processing where consent is required.
Legitimate interests: To secure, maintain and improve the Application, provided those interests do not override the rights of children or parents.
Legal obligations: Where processing is required to comply with applicable law.
Protection of vital interests: Where processing is reasonably necessary to protect someone’s safety.
Consent may be withdrawn for optional processing, although the related feature may then stop working.
Children’s privacy
Sprout is a child-directed, parent-managed service.
The Service Provider does not knowingly allow children to independently create parent accounts. Parents and legal guardians are responsible for creating accounts and authorising children to use the Application.
Sprout aims to:
Collect only information reasonably necessary to provide the requested features.
Use privacy-protective default settings.
Avoid unnecessary profiling.
Avoid behavioural advertising.
Provide parents with controls over their child’s information.
Allow parents to review, correct and delete information.
Delete information when it is no longer reasonably necessary.
If the Service Provider discovers that personal information has been collected from a child without any consent required by applicable law, the information will be deleted or appropriate parental authorisation will be requested.
Parents may contact yyacoobali@gmail.com regarding their child’s information.
Sharing and disclosure
Sprout may share information:
With service providers that operate features on Sprout’s behalf.
When required by law, court order, subpoena or another valid legal process.
Where reasonably necessary to investigate fraud, security incidents or misuse.
Where reasonably necessary to protect the rights, safety or property of users, children, the Service Provider or others.
With professional advisers where necessary for legal, accounting, security or compliance purposes.
As part of a business transfer, restructuring or sale, subject to appropriate privacy protections.
Sprout does not sell personal information.
Sprout does not share personal information for cross-context behavioural advertising.
International data transfers
Some service providers operate internationally. Personal information may therefore be processed in countries outside the United Kingdom, European Economic Area or the family’s country of residence.
Where required, Sprout will use recognised safeguards such as:
Adequacy regulations or adequacy decisions.
Approved Standard Contractual Clauses.
The United Kingdom International Data Transfer Agreement or Addendum.
Other legally recognised transfer safeguards.
Privacy and data-protection laws may differ between countries.
Data retention
Sprout retains personal information only for as long as reasonably necessary to provide the Application, maintain security, comply with legal obligations and resolve disputes.
Generally:
Parent account and child profile information is retained while the account remains active.
Saved conversations, pictures, stories and progress are retained until they are deleted or the account is deleted.
Subscription records may be retained while needed to verify purchases or meet accounting and legal requirements.
Security and diagnostic logs may be retained temporarily for fraud prevention, troubleshooting and service protection.
Deleted information may remain temporarily in encrypted or rotating backups before being permanently overwritten.
Aggregated or properly anonymised information may be retained because it no longer identifies a person.
Sprout does not intentionally retain live voice recordings as reusable child-profile content.
Account and data deletion
Parents can remove individual saved items where the Application provides that option.
Parents can also use Delete all data and account within the Grown-ups settings or contact yyacoobali@gmail.com to request deletion.
Account deletion removes active Sprout account information, child profiles, saved content and private cloud media, except where limited information must be retained for:
Legal compliance.
Fraud prevention.
Security.
Accounting requirements.
Establishing or defending legal claims.
Temporary backup processes.
Deleting a Sprout account does not automatically cancel a subscription purchased through Apple or Google. Subscriptions must be cancelled separately through the relevant app-store subscription settings.
Uninstalling the Application stops future collection from that device but does not automatically delete information already stored in Sprout’s systems.
Privacy rights
Depending on where a family lives, parents and children may have the right to:
Request access to personal information.
Request correction of inaccurate information.
Request deletion.
Request a copy or export of information.
Restrict certain processing.
Object to certain processing.
Withdraw consent.
Complain to a data-protection authority.
Parents may exercise these rights on behalf of their child where permitted or required by law.
Requests can be sent to yyacoobali@gmail.com. The Service Provider may request reasonable information to verify the identity and authority of the person making the request.
UK residents may also complain to the Information Commissioner’s Office.
California privacy information
To the extent the California Consumer Privacy Act, as amended, applies to Sprout, California residents may have rights to:
Know what categories of personal information are collected, used and disclosed.
Request access to specific personal information.
Request correction or deletion.
Receive information in a portable format.
Opt out of the sale or sharing of personal information.
Limit certain uses of sensitive personal information.
Exercise their rights without unlawful discrimination.
Sprout does not sell personal information or share it for cross-context behavioural advertising.
Requests may be sent to yyacoobali@gmail.com.
Security
Sprout uses reasonable technical and organisational safeguards designed to protect personal information, including:
Authenticated requests.
Access controls.
Private cloud storage.
Server-side processing.
Secure transmission.
Usage and quota controls.
Restricted access to production systems.
Security and safety checks.
No internet or storage system can be guaranteed to be completely secure.
Parents should keep their account credentials and grown-up PIN private and should contact the Service Provider if they believe an account has been accessed without permission.
Data-breach notification
If a personal-data breach occurs, the Service Provider will investigate it and take appropriate steps to reduce harm.
Affected users and relevant regulators will be notified where required by applicable law.
Changes to this policy
This Privacy Policy may be updated when Sprout’s features, providers or legal obligations change.
Material changes will be communicated to parents through the Application, store listing or another appropriate method. Where required, consent will be obtained before materially different processing begins.
The effective date at the top of this policy will be updated when changes are made.
Previous versions may be requested by contacting yyacoobali@gmail.com.
Contact
Questions, requests or concerns regarding this Privacy Policy or Sprout’s handling of personal information can be sent to:
Yusuf Yacoobali
Email: yyacoobali@gmail.com