DRAFT for engineering review. This notice must be completed (controller identity, DPO contact, legal bases, transfer mechanisms) and approved by qualified counsel for each launch market before use.

Privacy notice

Mochi is a virtual-pet app for children that is set up and controlled by a parent or legal guardian. We collect as little as possible, keep it for as short a time as possible, and give parents full control.

What we collect, and when

• Parent account and child profile: Your email, a nickname and age band for each child, pet customisation and game progress. Retention: Until you delete the profile or account.
• Talking with Mochi (AI): When your child types or speaks to Mochi, the words (with obvious personal details removed) go to our AI provider to create Mochi's reply. Recent turns are kept encrypted for up to 2 hours so Mochi can follow the conversation, then deleted. Retention: Short-lived context: 2 hours. Providers are configured not to train on this data (verify your contract).
• Voice: Only while your child holds the microphone button, their voice is recorded and sent to our speech provider to be turned into text. The audio is not stored by Mochi. Mochi's spoken replies are generated by a text-to-speech provider. Retention: Audio is processed in memory and discarded. Provider retention per your provider agreement.
• Mochi remembers favourite things: Mochi may save small, playful facts like a favourite colour or a toy's name. Sensitive or identifying details are filtered out. You can review, correct or delete every memory. Retention: Each memory expires after its category's period (e.g. 1 year since last used) or when you delete it.
• Conversation history (optional): If you turn this on, the text of conversations is kept encrypted for the number of days you choose (max 30) so you can review it. Off by default. Retention: 1–30 days, chosen by you.
• Pet activity: feeding, games, stories and level-ups, as short enum codes (no free text). Kept 365 days.
• Devices: a random installation identifier (hashed), a coarse label like “Safari · iPadOS” and last-used time. No hardware identifiers or fingerprinting.
• Security & usage logs: sign-in events with a keyed hash of the IP address, and AI usage counts and costs without any conversation content. Kept up to 400 days.
• Safety events: the category and severity of a safety concern (never the words). Kept 180 days.

What we never do

• No advertising, behavioural profiling, cross-site tracking or selling of data.
• No public profiles and no social sharing.
• No location access, no camera, and no background listening. The microphone is only on while the child taps to talk.
• We do not store voice recordings. Audio is sent to the speech provider for one turn and discarded by Mochi.
• Children's content is not used to train AI models (this must be contractually confirmed with each provider; see “Processors”).

How the AI conversation works

Before a child's words leave our servers, identifying details (emails, phone numbers, addresses, school names, full names) are replaced with “[private]”. A safety layer checks each message; serious concerns get a calm, pre-written response pointing to trusted adults, and never reach the AI model. Each reply is checked again before the child sees it.

Parents' rights and controls

• Turn each feature on or off and withdraw consent at any time (takes effect immediately).
• See, correct and delete every saved memory; require approval for new memories.
• Download all data (machine-readable export).
• Delete a child profile instantly, or the whole account (processed within 24 hours).

Deletion and backups

Deleting removes data from the live database immediately (or within 24 hours for account deletion). Encrypted backups maintained by our database provider are overwritten on their rolling schedule (configure and state the exact window, e.g. 7 days). Operational logs keep no conversation content; on account deletion, identifiers in those logs are removed.

Processors

Supabase (database, authentication), Anthropic (language model), OpenAI (speech-to-text, text-to-speech, optional moderation and embeddings), and the configured verifiable-parental-consent provider. Data processing agreements, regions, retention and “no training” terms must be in place before launch.

← Back