Privacy Policy

Controller: Thrive Digital Wellbeing Pty Ltd

Address: 805/220 Collins St Melbourne, VIC 3000 Australia

Support: support@thrive.kids Privacy: privacy@thrive.kids

EU/UK privacy contact (not an EU/EEA Article 27 representative): Matthew Wood (mat@thrive.kids), Victoria, Australia

If we are required to appoint an EU/EEA and/or UK representative under GDPR/UK GDPR, we will appoint one and update this Policy accordingly.

• Data minimisation: we collect and store only what is necessary to provide, secure, support, and improve the Service.
• No child data for marketing: we do not use child personal data for marketing or targeted advertising.
• On-device first where possible: especially in Thrive - Just a Phone, we aim to keep configuration and enforcement data on-device unless remote processing is needed for support, diagnostics, purchases, syncing, or another feature you choose to use.
• Anonymised and aggregated analytics: we use anonymised, de-identified, and/or aggregated data for analytics and marketing measurement where possible.
• No sale of personal information: we do not sell personal information.

We collect information depending on which Thrive product you use and how you use it.

A) Parent or guardian account information

• Email address and account identifiers, where account creation is required
• Account settings and preferences
• Subscription and purchase status, including confirmation from Apple (we do not receive full payment card details)

B) Child profile and device setup information

• Child profile label or nickname, if you create one
• Device linking, configuration, and eligibility data necessary to provide core features
• For Thrive - Just a Phone, local device configuration such as allowed app selections, website restriction settings, parent PIN settings, and related enforcement preferences may be stored on-device and may only be transmitted to us if needed for support, diagnostics, syncing, or another feature you choose to use

C) Activity and reward information This category mainly applies to Thrive - Smarter Screen Time:

• Activities you create (for example, homework, reading, chores, or other tasks)
• Activity completions, approvals, rewards, and timestamps
• Reward rules and parameters you set

Thrive - Just a Phone generally does not require activity or reward tracking for core functionality.

D) Device and technical information

• Device type, operating system version, app version, language, and related technical metadata
• Diagnostics, crash reports, and performance data
• Approximate region, derived from device settings or IP address for web access

We do not intentionally collect precise location unless a feature clearly requires it and we tell you so.

E) Customer support information

• Information you provide when you contact us, including messages and any attachments you choose to send

F) Website data (if you use thrive.kids or related Thrive web properties)

• Usage data such as pages viewed, clicks, referrers, and device/browser information
• Cookies and similar technologies, as described in "Cookies and Website Analytics"

We use information to:

• Provide the Service and its product-specific features
• Connect devices, manage family settings, and apply restrictions or rewards
• Maintain security, prevent fraud or abuse, and troubleshoot issues
• Provide customer support
• Improve the Service using anonymised, de-identified, and/or aggregated analytics
• Measure marketing effectiveness using anonymised, de-identified, and/or aggregated data where possible
• Provide optional AI help or suggestions where enabled by the user, including sending permitted AI request data to OpenAI as described in Section 9

For example:

• In Thrive - Smarter Screen Time, we may use activity, approval, and reward data to provide the product's core "earned screen time" functionality.
• In Thrive - Just a Phone, we may use device configuration and enforcement data to help apply the simple-phone setup and related controls.

We do not use child personal data for marketing or targeted advertising.

If you are in the EEA/UK, we process personal data under these legal bases:

• Contract: to provide the Service you request
• Legitimate interests: to secure, maintain, and improve the Service, balanced against your rights
• Consent: where required, for example for non-essential cookies on our website or optional AI features
• Legal obligation: to comply with law and lawful requests

We share information only as needed to run, support, and protect the Service:

• OpenAI (third-party AI processor): If you choose to use AI features and give explicit in-app permission by tapping "Accept & Continue" or similar language, we send information needed to generate AI answers. This may include your submitted prompts or questions, AI responses, and relevant support or diagnostic context needed to provide the feature. If you withdraw permission, no new AI requests are sent to OpenAI.
• Service providers (processors): hosting, security, analytics, crash reporting, communications, and customer support providers, in de-identified or aggregated form where possible and otherwise only as needed to provide the Service.
• Platform providers (for example Apple): purchases, subscription or entitlement status, device linking, Family Controls, and related platform functionality.
• Legal and safety: if required by law, court order, or to protect users, rights, or safety.
• Business transfers: if we are involved in a merger, acquisition, financing, or asset sale, subject to applicable notice requirements.

Some features in Thrive - Just a Phone are performed locally on-device and may therefore involve less server-side collection or sharing than features in Thrive - Smarter Screen Time.

We do not sell personal information. We require our processors, including OpenAI, to protect personal data to the same or equivalent standard described in this Policy and applicable law.

We use analytics to understand how the Service is used and to measure marketing performance.

• We aim to use anonymised, de-identified, and/or aggregated data for analytics and marketing measurement.
• We do not use child personal data for marketing or behavioural advertising.
• We do not allow analytics providers to use child personal data for their own marketing purposes.
• Because Thrive - Just a Phone is more on-device in nature, some product data processing may be less extensive than in Thrive - Smarter Screen Time.

If we ever introduce practices that constitute "sale" or "sharing" under California law, including sharing for cross-context behavioural advertising, we will:

• update this Policy; and
• provide required opt-out controls, including recognising valid opt-out signals where applicable.

Thrive products are intended for use by parents and guardians.

• We collect the minimum child-related data necessary to provide the relevant Thrive product.
• We do not use child personal data for marketing.
• Parents and guardians can request access to, correction of, or deletion of child-related data, subject to verification and applicable law.

In practice:

• Thrive - Smarter Screen Time may involve activity, reward, and approval data that parents choose to create.
• Thrive - Just a Phone generally relies more heavily on local device configuration and less on broader child profile data.

If you believe we have collected a child's personal data inappropriately, contact privacy@thrive.kids.

Some parts of the Service may offer optional AI-powered help and suggestions.

• Who receives data: OpenAI, acting as a third-party processor.
• What may be sent: your submitted prompts or questions, AI responses, and relevant support or diagnostic context needed to provide the feature.
• Permission first: we request explicit in-app permission before sending personal data to OpenAI for AI features.
• Withdrawal control: you can withdraw permission at any time in the relevant app settings. After withdrawal, no new AI requests are sent to OpenAI.
• AI limitations: AI output may be inaccurate, incomplete, or inappropriate and is not professional advice.
• No solely automated legal or similarly significant decisions: we do not use AI to make solely automated decisions that produce legal or similarly significant effects on users.

AI features are product- and feature-specific. Thrive - Just a Phone does not require AI for its core functionality and may involve fewer or no AI-enabled features compared with Thrive - Smarter Screen Time.

If you use our website, we may use cookies or similar technologies for:

• essential site functionality
• security
• anonymised, de-identified, and/or aggregated analytics

Where required by law, we request consent for non-essential cookies and provide controls.

We are based in Australia and may store or process information in Australia and other countries where our service providers operate.

If you are in the EEA/UK and your personal data is transferred internationally, we use appropriate safeguards where required, such as Standard Contractual Clauses.

We keep personal data only as long as necessary to:

• provide and secure the Service
• comply with legal obligations
• resolve disputes and enforce agreements

When data is no longer needed, we delete it or anonymise it.

Some data in Thrive - Just a Phone may remain only on your device unless you delete the app, reset the app, request support, or use a feature that requires transmission to us or our processors.

We use reasonable administrative, technical, and physical safeguards designed to protect personal data, including encryption in transit and access controls where appropriate. No method is 100% secure, but we work to protect your information.

A) EEA/UK (GDPR/UK GDPR) RIGHTS Depending on your location and circumstances, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Delete data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent where we rely on consent
• Lodge a complaint with your local data protection authority

We respond without undue delay and, in most cases, within one month. In complex cases, we may extend by up to two additional months, with notice as required.

B) CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA) If you are a California resident, you may have the right to:

• Know what personal information we collect, use, and disclose
• Access a copy of your personal information
• Delete personal information, subject to exceptions
• Correct inaccurate personal information
• Opt out of the sale or sharing of personal information, if applicable
• Limit the use or disclosure of sensitive personal information, if applicable
• Not be discriminated against for exercising your rights

We do not sell personal information and we do not share it for cross-context behavioural advertising.

C) HOW TO EXERCISE YOUR RIGHTS Email: privacy@thrive.kids Suggested subject line: "Privacy Request"

To protect you, we may need to verify your identity before fulfilling certain requests. Parents and guardians may submit requests regarding their child's data. California authorised agents may submit requests on a consumer's behalf, subject to verification.

If you are a California resident, we collect the categories of personal information described in Section 3 above for the purposes described in Section 4.

We do not sell personal information and do not share personal information for cross-context behavioural advertising. We do not use or disclose sensitive personal information beyond what is necessary to provide the Service, secure it, and comply with law.

We may update this Policy from time to time. If changes are material, we will provide notice within the Service or by other reasonable means. The "Effective date" will be updated.

Privacy questions or requests: privacy@thrive.kids Support: support@thrive.kids

Mail: Thrive Digital Wellbeing Pty Ltd 805/220 Collins St Melbourne, VIC 3000 Australia