Who we share information with
Everyone outside Branchlings who receives personal information from the app, what they get, why, where, and how long they keep it (the COPPA Rule, 16 CFR 312.8(c)). A new vendor, or a vendor getting something new, is added here before any data goes to it.
We don’t sell personal information, don’t share it for advertising, and have no advertising or analytics code in the app. Every vendor below works for us (a service provider or processor) and may use what we send only to provide its service to us. See our privacy policy and data retention policy.
Who gets what
| Vendor | What it does for us | Children’s information it receives | Where | Kept by the vendor |
|---|---|---|---|---|
| OpenAI | Writes the stories and story ideas, paints the pictures, reads stories aloud (narration and its word timings), and runs the safety check | First names (and the names a family gives other cast members), age (never the birthday month), pronouns, how each character looks and what they love (as the family describes them), typed story ideas and settings, the story so far. Photos, only to paint a character from a photo (never with the person’s name) and to check the photo first. A hashed family id (SHA-256) for abuse monitoring. Never surnames, birthdays, contact details or location | United States | Zero Data Retention: not yet granted; until then up to 30 days for abuse monitoring, then deleted (longer only where the law requires it or to look into misuse; the safety check and word timings keep nothing). Never used for training (API terms). Responses are sent with store: false |
| Convex | Hosts our backend: the database, stored files (photos while they’re kept, paintings, narration audio) and the server code | Everything the family keeps with us (see the retention policy) | United States | Until we delete it (our retention policy), plus Convex’s backups |
| RevenueCat | Tracks purchases and subscriptions | A random family id (our database id) and the family’s purchase records (product, dates, store). No child information. SDK sends device details such as app version, OS and device model | United States | Until we delete the customer: done when the family deletes its account |
| PostHog | Product analytics, sent only from our servers | A random family id and events such as “a story was started” with details like the reading level (an age band) and story settings. No names, typed words, photos or device details; location lookup is switched off | United States (us.i.posthog.com) | PostHog keeps events (no child details) under our project’s retention setting; they aren’t yet deleted when a family deletes its account. |
| Apple | Sign in with Apple; the App Store (the app, purchases, ratings) | Sign in: only the stable account id Apple gives us (no name or email is asked for). Purchases happen between the parent and Apple | Apple | Apple’s own policies |
| Sign in with Google, when the app offers it; Google Play later | Sign in: only the stable account id (the only scope asked for is openid) |
Google’s own policies | ||
| Expo (EAS) | Builds the app; later, delivers app updates | No family data. Update checks, once turned on, send device and app details | United States | Expo’s policies |
| Slack (team alert channel) | Alerts to the team: daily spend, a picture reported | No family or child data: amounts, a reason and a picture’s internal id only | Slack | Our workspace’s retention |
| NCMEC — when required by law | Reports of apparent child sexual abuse material (18 U.S.C. 2258A) | What the law requires | United States | By law |