Privacy, in plain words

The short version

• The account belongs to a parent. Children have profiles inside the parent's account, not their own accounts.
• No ads, no feed, no chat with strangers, and no third-party trackers or analytics.
• Your family's data is stored in our own database on our server in Frankfurt, Germany. We don't sell it or share it for marketing.
• To write quests, some profile details are sent to Anthropic, the company behind the Claude AI model. Details below.
• Photos are optional and only visible to your family.
• Every email that isn't about your account (tips, reminders, recaps) has a one-click unsubscribe link.

Who is responsible for your data

The controller is Vebotek OÜ (vebotek.com), Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia. Because we are based in the EU, the EU General Data Protection Regulation (GDPR) applies to everything Tandomo does, wherever your family lives. For any privacy question or request, email hello@tandomo.com.

Accounts: parent first

A parent creates and holds the family account, signed in with the parent's email address and password. Each child gets a profile under that account with a display name, an avatar and a 4-digit PIN (stored hashed, never in plain text). Children don't sign up, don't give us an email address and can't be contacted by anyone outside the family. We suggest using a first name or a nickname for each child.

We use the parent's email address for: signing in; password resets and invites for another parent; short emails while you get started and later (welcome, setup help, a together quest to try, reminders when things go quiet, small celebrations); and weekly or monthly recap emails if they are switched on in settings. The getting-started and recap emails each have a one-click unsubscribe link, and recaps also have their own switch in settings. Account emails (password resets, invites) always arrive. We never send your address to anyone for their marketing.

What we store

• Parent: email address, a hashed password, the name your kids call you (optional), your language, country and time zone, your email settings, and when you agreed to the Terms and this policy.
• Child profile: display name, age, school grade, language, interests, likes and dislikes, strengths, things to work on and the goals you set.
• Settings: subjects to emphasize or skip, how many quests a day, the online/offline balance and the device they mostly use.
• Activity: the quests they were given, their answers, points, days played, feedback (thumbs up or down, comments), challenges and notes between family members.
• Photos and voice notes (optional): if a family adds one when finishing a quest, it is stored on our server and served only to signed-in members of that family.
• App events: simple first-party records of what happened in the app (a quest finished, a page opened), which we use to see what works. No third-party analytics.
• Where a sign-up came from: the campaign tags in the link you clicked (utm tags), whether an ad click id was present (not the id itself), the referring website and the first page you saw, tied to a random visitor id kept in your browser.
• Notifications (optional): if you turn on reminders, your browser's push address. Your browser's push service (for example Google, Apple or Mozilla) delivers the notification; its content is encrypted.

Cookies and browser storage

• Login cookie (kq_session): one signed, http-only cookie that keeps you logged in.
• Device cookie (kq_device): remembers which family a kid's device joined, so the kid only types the family code once.
• Language cookie (tandomo_lang): set when you use our BHS pages, so the next pages stay in your language.
• Browser storage: the random visitor id and campaign tags described above, and which quiz steps you saw in this session.

No advertising or tracking cookies, and nothing from third parties.

Why we use your data (lawful bases)

• To run the account you asked for (contract, GDPR Art. 6(1)(b)): the family account, children's profiles, quests, photos, the AI writing of quests, account emails and recap emails you switched on.
• With your consent (Art. 6(1)(a)): the “Email me this plan” email from the quiz and its up to 3 reminders; any newsletter or marketing email, if we ever send one. You can withdraw consent any time with the link in every email, and that doesn't affect what happened before.
• Our legitimate interests (Art. 6(1)(f)): keeping the service secure and preventing abuse (rate limits, login protection, server logs); short getting-started and reminder emails to account holders, which you can stop with one click; and measuring which pages and campaigns lead to sign-ups, using only our own first-party records. You can object to any of these by emailing us.
• Children's data is given to us by their parent, who confirms at sign-up that they are the parent or legal guardian and agrees to these terms. See the table of ages below.
• Legal obligations (Art. 6(1)(c)): for example accounting records once paid plans start.

What is sent to Anthropic, and why

Tandomo uses Claude, an AI model made by Anthropic, to write each child's daily quests. To do that, our server sends Anthropic the profile details the quests are built from: the child's display name, age, grade, interests, likes and dislikes, strengths and things to work on, your goals and subject settings, current school topics if you added them, a short summary of past feedback and the titles of recent quests (so they don't repeat). We also use Claude to translate quest text when a child uses the app in a language other than English, and to summarize feedback into a short note for future quests.

Photos are not sent to Anthropic. Requests go from our server, not from your child's device, and are used only to produce the text we asked for. Anthropic's own handling of that data is described in Anthropic's privacy policy.

Who processes data for us

These companies process personal data on our behalf, only for the job below. A signed data processing agreement with each is part of our launch checklist.

Some of them are in the United States. When data leaves the EU, the transfer relies on the EU–US Data Privacy Framework where the company is certified, or on the European Commission's standard contractual clauses. Email us for a copy of the safeguards.

The onboarding quiz

The free quiz sends your answers to our server, which asks Claude to write a profile and a 7-day sample plan and sends the result back to your browser. We don't save quiz answers in our database unless you choose to create a family account at the end (then the child profile built from your answers is saved with that account, along with your email and a hashed password) or you ask us to email you the plan (then we keep the plan and your email for those emails, see below). To stop the quiz being abused, the server briefly keeps a count of requests per IP address in memory. The quiz page, like the rest of the site, serves its fonts from our own server, so loading it sends nothing to Google or any other font service.

How long we keep it

• Your family's account and everything in it: for as long as the account exists. When you delete the family, it is removed from our live database straight away, including its app events.
• Backups: deleted data stays in our backups until they roll over, about 8 weeks at most (14 daily and 8 weekly copies).
• “Email me this plan”: the plan and your email are kept until you create an account or unsubscribe, and at most 14 days after the last reminder. Then the email address, the child's name and the plan are erased; only an anonymous count stays.
• Rate-limit counts: in memory only, from minutes to one day.
• Anonymous site and quiz events (no name, no email): kept to measure what works. We haven't set an automatic deletion period yet; it will be listed here when we do.
• Emails you send us: in our inbox for as long as we need them to help you.

What we don't do

• No advertising, and no behavioral profiling of children.
• No third-party analytics, tracking pixels or social-media trackers.
• No selling or renting of data, and no sharing for anyone else's marketing.
• No public profiles, no contact with people outside your family.
• No decisions with legal or similarly significant effects made by automated means. The AI suggests quests; you decide.

Children's privacy (COPPA)

In the US, the Children's Online Privacy Protection Act (COPPA) protects children under 13. In the EU, Article 8 of the GDPR does something similar. Here is how Tandomo works for children, in plain words:

• Parents create the account. Only a parent can sign up. A child can't create an account or join without a family code from their parent.
• Children give very little. A child has a first name (or nickname), an avatar and a 4-digit PIN. No email address, no phone number, no surname, no location.
• No ads, no third-party trackers in the kid area. The screens children use have no advertising, no ad pixels and no third-party analytics. We only count simple app events ourselves, so we can see what works.
• Photos and voice stay in the family. Photos or voice notes added to a quest are stored on our server and shown only to signed-in members of that family. They are never public and never sent to Anthropic.
• Parents are in control. A parent can review everything stored about their child, change it, export all of it as a file, or delete it, at any time, from the parent settings.
• No data without a parent. We don't knowingly collect personal information from a child without a parent's account. If you think a child has given us information without one, email hello@tandomo.com and we will delete it.

This page is a draft, not yet legal advice. Tandomo has not been audited or certified under COPPA, GDPR or any kids' privacy program. Our intent is to follow both laws in spirit and in practice. If you think we have fallen short, please tell us at hello@tandomo.com.

The age a child may consent alone, by country

Laws set an age from which a child may agree to an online service on their own. In Tandomo it doesn't matter: a parent creates the account and agrees for every child, whatever their age.

Your rights and choices

• See and change: parents can view and edit each child's profile and settings at any time, and ask us for a copy of everything we hold (access).
• Copy or delete: in the parent settings you can download all your family's data as a file (portability), or delete the family and everything in it (erasure). You can also email us and we will do it for you.
• Restrict or object: ask us to pause using your data, or object to anything we do on the basis of legitimate interests.
• Withdraw consent: any time, with the link in the email or by writing to us.
• Photos: adding a photo is always optional.

We answer within one month. If you think we handle your data wrongly, please tell us first; you also have the right to complain to a data protection authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), Tatari 39, 10134 Tallinn, Estonia (www.aki.ee, info@aki.ee). If you live elsewhere, you can also complain to the authority in your own country.

Questions

Email hello@tandomo.com. Tandomo is a small, early product built by one parent, so you will get a reply from a person. If we change how we handle data, we will update this page and the date at the top, and tell account holders by email before a change that matters. See also the terms of use, how we keep quests safe, the FAQ and about Tandomo.