Privacy Policy
How Xoolin handles information about children and parents, and the choices families have.
At a glance
Xoolin is an AI character-chat experience designed for children aged 6–10, set up and supervised by a parent or legal guardian. The characters are fictional AI characters. The child experience is not a public social network and does not offer messaging with other users. Parents should review this policy before allowing a child to use Xoolin.
1. Who operates Xoolin
Xoolin is the name of this service. The legal entity responsible for your information, its mailing address, and its privacy contact must be identified here before public launch. Contact for privacy questions: [email protected] (activate and monitor this mailbox before publication).
2. Parent approval and children
A parent or legal guardian must create or approve each child account and provide any consent required by applicable law before a child’s personal information is collected for the service. A child cannot independently approve new information-sharing purposes. We may ask the parent to verify their authority using an age-appropriate, legally compliant method. Parents may withdraw consent and request deletion, subject to lawful exceptions.
3. Information involved
Depending on the features enabled, information may include: parent contact and sign-in details; a child’s chosen name or nickname, age/grade, school-world name and character preferences; account settings and screen-time limits; prompts, chat messages, AI responses and quiz activity; parent reports and safety-related events; and technical data such as IP address, device/browser information, security logs and session cookies. We ask families not to enter real classmates’ full names, contact details, addresses, photos or other identifying details into character profiles.
4. Why information is used
Information is used to create and secure accounts, personalize fictional character interactions, generate AI responses and learning activities, enforce parental settings, display activity summaries, detect harmful or abusive usage, troubleshoot problems, respond to support/privacy requests and comply with law. We should not collect more child information than reasonably necessary for these purposes.
5. AI processing and service providers
Child messages may be transmitted to third-party AI infrastructure, including the OpenAI API where configured, so that the service can generate and review responses. Necessary technical information may also be processed by hosting, security and email providers. These providers may operate in other countries, where information may be subject to local laws. Before launch, Xoolin must document the providers actually used, their processing locations, retention settings, and whether provider-side storage or model-training settings apply; Xoolin must not assume that sending data to an API means it is never retained.
6. No advertising profiles or data sales
Xoolin is designed not to sell children’s personal information or use their conversations for behavioural advertising. Third-party advertising trackers must not be introduced into the child experience without a separate privacy and legal review. Any optional use of information beyond the core service will require an appropriate choice or consent.
7. What parents can control
The intended parent controls include reviewing conversations and activity, setting limits, pausing access and requesting exports or deletion. The actual live availability of each control should be confirmed in the app. Where an in-app control is unavailable, email [email protected] for access, correction, withdrawal of consent or deletion requests. We may reasonably verify that the requester is an authorized parent or guardian.
8. Storage, retention and deletion
Conversation and account information should be kept only as long as needed for the purposes described, or as required by law. Before launch, publish exact retention periods or explain the specific criteria used to determine them, including for inactive child accounts, security logs, AI-provider storage and backups. Deletion requests will be handled in accordance with applicable law; limited records may need to be retained for security, legal or dispute purposes. Information in backups may take additional time to expire.
9. Security and safety
We aim to use access restrictions, encryption in transit, restricted administrative permissions and appropriate monitoring. Automated safety checks are intended to reduce unsuitable content, but no technology guarantees that every AI response will be accurate, appropriate or safe. Parents should review their child’s use and avoid sharing secrets or sensitive personal details in conversations. Report a problem to [email protected] (ensure this address is monitored).
10. Cookies
Essential cookies or similar session technologies may be used for login, security and remembering settings. Do not add analytics or marketing cookies to the child experience without an appropriate consent and legal assessment. This section must be updated if optional tracking is introduced.
11. Requests and complaints
Parents can ask what personal information is held, request corrections, withdraw applicable consent and request deletion by contacting [email protected]. We will respond in accordance with applicable privacy law. Canadian users may also contact the Office of the Privacy Commissioner of Canada where appropriate.
12. Changes
If our practices materially change, we will update this page and provide notice and seek additional parental consent when legally required. Last updated: October 8, 2026.