Arbo Privacy Policy
Better Planet LLC
Version: 1.0
Effective date: October 14, 2026
Public URL: https://arbofamily.com/privacidad-en
Language: English · Also available in: Español · Français · Deutsch
0. What you need to know in 30 seconds
- Arbo stores a child's life history: photos, measurements, milestones, emotions, health records, medications, disability supports, education history, career guidance for teenagers, and the position of a tracker chip if you use one.
- That includes children's data and health data. Those are the two most sensitive categories there are, and they are treated as such.
- We do not sell data. There is no advertising. There are no ad trackers and no third-party analytics tools inside the app. (Verified in the code: the app does not include any analytics, advertising or attribution SDK. It does include an error-reporting one, Sentry, which is off unless we switch it on: section 5.7.)
- We do not train artificial intelligence models on your data, and we require the same of our providers.
- We do send part of the child's history to Anthropic when you use the parenting adviser or the career guidance feature. Section 5 says exactly what is sent.
- You can access, correct, export and delete the data. Section 10 says how.
1. Who is responsible for your data
Data controller (responsable del tratamiento):
Better Planet LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA. A New Mexico limited liability company.
Privacy contact: privacy@arbofamily.com General contact: hola@arbofamily.com Website: https://arbofamily.com
For any matter related to the protection of your data, our contact is privacy@arbofamily.com.
2. Who this policy applies to
- Anyone who creates an account and uses the app (mother, father, guardian or other adult caregiver).
- The children and teenagers whose data that caregiver records.
- Anyone who is invited to a family's account.
It applies to the mobile app (iOS and Android), to the Arbo server and to any website we operate.
3. Exactly what data we collect
This section lists what the system actually stores, field by field. It is not a summary: it is the inventory.
3.1. Caregiver (adult) account data
| Data | Source | Required |
|---|---|---|
| Email address | You type it, or it comes from Google/Apple sign-in | Yes |
| Password | You type it. Stored only as a BCrypt hash, never in the clear | Yes (except with federated sign-in) |
| Display name | You, or the sign-in provider | No |
| Role (main account or invited caregiver) | Assigned by the system | Yes |
| Phone number | You | No |
| Description / "bio" (up to 500 characters) | You | No |
| Relationship (mom, dad, grandmother, grandfather, guardian, other) | You | No |
| Profile photo and cover photo | You | No |
Identity verification status (NONE / VERIFIED / FAILED), similarity percentage and date of the check | System, if you use photo verification | No |
| Account creation date | System | Yes |
3.2. The child's or teenager's data
| Data | Detail |
|---|---|
| Identification | Name, nickname, date of birth, gender, favorite color |
| Likes | Free text up to 2,000 characters |
| Supports and conditions | Free text up to 2,000 characters, "in the family's own words". This is where conditions, disabilities and support needs are recorded. This is health data. |
| What helps them | Strategies, routines and cues that calm the child. Up to 2,000 characters. Health data in practice. |
| Growth | For each entry: date, height (cm), weight (kg), milestone ("first steps"), a note of up to 2,000 characters and an optional photo |
| Emotions | For each entry: date, emotion, intensity (numeric scale) and a note of up to 2,000 characters. Health data when it reflects a mood state. |
| Health | For each record: type (illness, allergy, vaccine, check-up), title, start date, end date, whether it is chronic, and notes of up to 2,000 characters. Health data. |
| Medications | Name, how many hours between doses, for how many days, time of the first dose and a note of up to 500 characters. Health data. |
| Education | Type of institution (nursery, school, secondary school, university, other), name of the institution, year or degree course, start and end dates, notes |
| Learning and play | Completed activity, category, score and time; weekly quests completed |
| A word a day | Only if an adult sets it up for the child. The settings: which language the child is learning (Spanish, English or French), which language the translations are in, and when that was last changed. Then, for each day it is opened: the word assigned (from our own catalog; nobody in the family writes it), the two languages, the date it was assigned, whether the child got it right and, if so, the date and time, and how many wrong answers they gave |
| Career guidance | RIASEC scores (6 dimensions, 0–100) and the three-letter code of the dominant ones |
| Guided conversation | The teenager's 11 open answers (10 about interests and aptitudes, 1 about how they feel) and the analysis the AI returns (summary, aptitudes, suggested careers, a vignette about their future, a reading of their feelings) |
| Photos | The files you upload to the album and to the life timeline |
One more thing is stored for the family as a whole, not for any one child:
| Data | Detail |
|---|---|
| Saying of the week | The family's "culture": the language and, if there is one, the country the sayings come from (for example es-CL, Spanish from Chile), and when it was last changed. And, for each week: which saying was shown, the culture it was chosen from, and the date. The card appears on its own on the Home screen once at least one child is registered |
How the culture is chosen: when the app asks for the week's saying, it sends your phone's language-and-region setting (for example es-CL). The server only uses it while the family has no culture yet, to choose the first one, which it saves; after that, it ignores it. The setting itself is not saved in our database. Any adult in the family can change the culture from the app.
Neither of these two features sends data to a third party: nothing goes to Anthropic or to Amazon Web Services. The words and the sayings come from our own catalog. When the app reads a word or a saying aloud, it uses the speech engine built into your phone, and what it reads is always text from the app itself (the word, its example sentence, the saying), never anything your family wrote. It only speaks; it does not listen. The child's JSON export (section 10) includes the words they have learned, with both languages and the date. The saying of the week belongs to the family, not to a child, so it is not in the child's export. We can switch either feature off for everyone from our operator panel; switching it off deletes nothing.
3.3. Tracker chip (only if you use one)
| Data | Detail |
|---|---|
| Device | The name you give it, its type (wristband, pendant, other), and a unique 64-bit code generated by the server, which is the chip's credential |
| Signals received | Latitude, longitude, battery percentage and time of receipt, every time the chip reports |
Important warning: the endpoint that receives the chip's signals (/api/tracker/ping) does not require a user session: it authenticates using the device code alone. That code is the only barrier between an outsider and the ability to write false positions into a family's account. Treat it like a password.
A note on where this actually stands: the hardware does not exist yet. Today the module generates codes and is ready to receive signals, but there are no chips reporting. If they exist tomorrow, a child's position becomes geolocation data about a minor, one of the most sensitive categories there is.
3.4. Communication between caregivers
| Data | Detail |
|---|---|
| Circle chat | Author's id and name, content (up to 500 characters) and time sent |
| Direct messages | Sender's id and name, recipient's id, content (up to 500 characters) and time |
| Neighborhood (only if the main account creates one or joins one) | Which neighborhood the family belongs to and since when. About the neighborhood: a generic name set by the app, its creation date and an 8-character entry code generated by the server, which only the main account sees and which it shares outside the app. Each chat message written while the family is in a neighborhood also records which one it was written in. The code changes every time a family leaves (by leaving or by closing its last account) and whenever the main account asks for it. The membership is deleted when the family leaves the neighborhood or closes its last account; if it leaves, what it wrote in the shared chat stays there, and if it closes its last account, that is deleted. The neighborhood itself — its generic name, its code and its creation date — is not deleted; it contains no personal data |
| Blocks | Who blocked whom and when. The person who blocks stops seeing the blocked person's chat messages, and neither of the two can send the other direct messages. Deleted when the block is lifted, or when either of the two closes their account |
| Reports of messages | When an adult reports a chat message or a direct message: who reported it, whose message it was, whether it was in the circle chat or a direct message and which one, a copy of its text (up to 500 characters) and of the author's name as they were at that moment (the copy remains even if the original message is deleted), the status of the review and the date. A person on our team reads that copy from our operator panel — also when it is a direct message — and decides whether to dismiss the report or delete the original message. While it waits for review it is kept; once resolved, it is deleted when 30 days have passed since the report. In any case, it is deleted when the person who reported or the person reported closes their account |
In a neighborhood, the adults of neighboring families share the circle chat — each family sees the shared conversation from the day it joined, and what it wrote before joining stays within its own household — and can send each other direct messages. Of the adults in another household, others see their display name (or, if they have none, the part of their email before the @), whether they are the main account or an invited caregiver, their relationship, their profile photo, whether they verified their identity, since when they have had an account, their family's name (a generic name set by the app) and how many children it has; and of those children, only their household name (the nickname or first name), their age in words (in years or months), their favorite color and their gender. Never their record, their health, their measurements, their photos or their location. An adult's cover photo does not appear in the circle: the app only gives others the address of their profile photo. Our server would hand the current cover photo to someone who shares a circle with that adult if they requested it by its exact address, but that address is a random name the app does not show to anyone else.
Messages are stored on the server without end-to-end encryption. Better Planet can technically access them, although it does not do so routinely (see section 8.4), and on their way between the app and the server they pass through Cloudflare (section 5.6).
3.5. Photos
- They are stored as files in private Cloudflare R2 storage (section 5.6), not in the database, under a name we generate (a UUID). The name of the file you upload is never stored. That storage has no public access and no shareable links, and the app never connects to it.
- Accepted formats: JPEG, PNG and WebP. Maximum size per file: 5 MB.
- They are only served to a signed-in session and only through our server, which first checks who is asking: a child's photo, only to the adults of their household; an adult's current profile or cover photo, also to those who share a circle with them (section 3.4). Names are validated so that nobody can request a file from another folder.
- Before it is saved, every photo goes through an automatic content check by Amazon Rekognition: those in a child's album and life timeline, and an adult's profile and cover photos. The selfie and the ID document used for identity verification (section 5.2) do not go through this check and are not saved. What is sent, what happens if the filter flags a photo and what happens if the check fails is in section 5.3.
- Each upload leaves an entry in a photo check log on the server: the family, the child or adult the photo belongs to, the date, the size, the file type and the result (passed, flagged or not checked); if the filter flagged it, also the categories it assigned and, later, what our team decided. For photos that pass, the file name is not kept. For photos the filter flags, a copy is also kept in quarantine, in a separate folder the app does not show. When each of these is deleted: section 5.3.
- The app recompresses images on your phone before uploading them (quality 0.7). In addition, when it receives a photo, the server strips its metadata (EXIF, XMP and similar), including the GPS coordinates of where it was taken, the phone model and the time it was taken. Only the orientation is kept, so that the photo is not shown rotated.
3.6. Technical data
| Data | What for | Where |
|---|---|---|
| IP address | Applying rate limits (protection against abuse and brute force) and server logs | In memory and in the server logs. Cloudflare also sees it, since all traffic passes through it (section 5.6) |
| Session token (JWT) | Keeping you signed in | On your phone, in the operating system's secure store (Keychain on iOS, Keystore on Android) |
| Server technical logs | Diagnosing errors and security issues | Server / hosting provider. Errors also go to Sentry, if it is switched on (section 5.7) |
| Error and crash reports from the app | Detecting and fixing failures | At Sentry, only if it is switched on (section 5.7) |
| Daily usage counter for paid services | How many AI queries (section 5.1) and how many photo checks (section 5.3) each family made each day — only the number, no content — to put a daily cap on spending on those services | In our database; deleted after 45 days |
What we do NOT collect:
- There is no advertising, no advertising identifiers (IDFA / GAID), no analytics SDK, no attribution tools and no tracking pixels. Verified by reading the app's dependencies. The app does include Sentry's error-reporting library, off unless we switch it on; what it sends when it is on is in section 5.7.
- We do not access your phone's location. The app does not ask for location permission and does not include the library that would do so. The only possible geolocation is what a physical chip would report (section 3.3). The closest thing the app reads is your phone's language-and-region setting (for example
es-CL), which "Saying of the week" uses to choose the family's first culture (section 3.2): it is a setting, not a position. - We do not read your address book, your calendar, your microphone or your messages.
- We do not use server push notifications. All reminders are local notifications, scheduled on your own phone, including the optional daily reminder of "A word a day" (section 3.7). There is no push token on our server and we cannot send you notifications at will.
3.7. What is stored on your phone
| Data | Where | Deleted |
|---|---|---|
| Session token and basic account data | Operating system's secure store | When you sign out |
| Cache of server responses (so the app works with a poor signal) | The app's local storage | When you sign out and when you switch accounts |
| Queue of changes waiting to be sent | The app's local storage | When they are sent. It is not cleared when you sign out, because it is content the family wrote that has not been saved yet; it waits for that same account to sign in again |
| Preferences (theme, language, menu order, whether you have seen the intro) | The app's local storage | When you uninstall |
| "A word a day" reminder: whether it is on, at what time, whether it has ever been turned on or off on this phone, and which of your children use the feature on this phone (by the app's internal number, not by name) | The app's local storage | When you sign out, and the scheduled reminder is cancelled |
The "A word a day" reminder is a local notification that your phone schedules for itself, once a day. It is off unless someone turns it on, with one exception: on the phone where an adult sets up the feature for a child, it turns itself on, at 19:00, unless it had already been turned on or off on that phone. Each phone decides for itself: on each one it can be turned on or off, and the time can be changed. Its text does not name the child ("Today's word is waiting for you."), because it can be read on the lock screen without unlocking the phone.
Uninstalling the app deletes everything that is on the phone, but it deletes nothing from the server.
4. What we use the data for, and on what legal basis
| Purpose | Data | Legal basis (GDPR) | Legal basis (Chile, Law 21,719) |
|---|---|---|---|
| Creating and maintaining your account | Caregiver account | Performance of the contract (art. 6.1.b) | Performance of a contract |
| Storing and showing you the child's history | All of the child's data | Explicit consent of the holder of parental authority (art. 6.1.a + 9.2.a, because it is health data) | Consent of the person who has personal care (custody) of the child (art. 16 quáter) |
| Drawing growth curves | Measurements | Same | Same |
| Scheduling reminders | Medications, dates | Same | Same |
| Answering questions put to the AI adviser | The child's context (see 5.1) | Specific, separate consent | Specific, separate consent |
| Analyzing the career guidance conversation | The teenager's answers | Specific, separate consent, plus the teenager's assent | Same |
| Verifying identity with a photo (optional) | The adult's selfie + ID document | Explicit consent for biometric data (art. 9.2.a) | Consent for sensitive data |
| Security, abuse prevention, usage limits | IP, logs | Legitimate interest (art. 6.1.f) | Legitimate interest / security obligation |
| Detecting and fixing failures in the server and the app | Error reports (see 5.7) | Legitimate interest (art. 6.1.f) | Legitimate interest |
| Complying with the law and responding to authorities | Whatever applies | Legal obligation (art. 6.1.c) | Legal obligation |
We do not use the data for: advertising, commercial profiling, automated decisions with legal effects, sale or transfer to third parties for commercial purposes, or training artificial intelligence models.
5. Who the data is shared with
Better Planet does not sell personal data and does not share it with anyone except the providers that make the service work, listed here.
5.1. Anthropic PBC — parenting adviser and career guidance
When: only when a caregiver opens the adviser and asks a question, or when a guided career guidance conversation is sent for analysis. If you do not use those features, nothing is sent to Anthropic.
Exactly what is sent (read from the code; the context is trimmed to 4,000 characters):
- The child's age in years and gender. Not their name or nickname: in their place, a placeholder is sent (see below).
- Their likes, exactly as you wrote them.
- The supports or conditions on record, in the family's own words, and what helps them.
- Up to 5 current medications: name and how many hours between doses.
- The last 5 measurements: date, height, weight and milestone.
- The emotions from the last 30 days: the count per emotion, and up to 5 text notes from those entries.
- Up to 5 active or chronic health conditions: only the title of the record (not the notes).
- The current educational institution and the year or degree course.
- The "talents" accumulated in play mode.
- Your question (up to 1,000 characters) and up to 6 previous turns of the conversation.
In career guidance, the teenager's 11 open answers are also sent, including the one that asks how they feel.
Model used: Anthropic's Claude models. What Anthropic does with it: under its commercial terms for the API, Anthropic does not use this data to train its models and keeps it only for a limited time.
The child's name is not sent to the AI. In its place, a placeholder is sent, and our server puts the name back into the answer before showing it to you. This applies to both the adviser and the career guidance conversation.
The conversation with the adviser is not stored on our server. The analysis of the career guidance conversation is stored, because it is part of the teenager's history.
5.2. Amazon Web Services (Amazon Rekognition) — identity verification, optional
When: only if the feature has been switched on by us and you decide to verify yourself. What is sent: two images of the adult — a selfie and a photo of their ID document — for a facial comparison (CompareFaces). What we keep: only the result (verified / failed), the similarity percentage and the date. The images are not stored on our server. Processing region: Northern Virginia (us-east-1), United States.
What AWS does with them: the AWS CompareFaces operation does not persist the images or the face templates. In addition, Better Planet has the AI services opt-out policy enabled in AWS, so AWS does not use these images to improve its services.
Identity verification only ever receives those two images of the adult: no photo of a child is used for it. Children's photos do reach Amazon Rekognition, but for something else: the content check that every photo uploaded to the app goes through, described in 5.3.
5.3. Amazon Web Services (Amazon Rekognition) — photo check on upload
Every photo uploaded to the app — those in a child's album and life timeline, and an adult's profile and cover photos — is sent to Amazon Rekognition at the moment it is uploaded. We spell it out here because a policy that gets this wrong is of no use at all.
When: on every upload, before the photo is saved, while the feature is switched on. It comes switched on, and in the published service the server does not start without this service's credentials. We can switch it off for everyone from our operator panel; while it is off, nothing is sent to Amazon and photos are saved without being checked. The two identity verification images (section 5.2) do not go through this check. What is sent: the image, once, to the DetectModerationLabels operation. Only the image: not the file name, not the child's name, and no other data about the family. What for: to detect inappropriate content — for example nudity, sexual content or violence, among other categories defined by Amazon — before the photo is saved. Only the top-level categories that Amazon detects with a confidence of at least 80% count, and any one of them is enough for the photo to be rejected. The app stores' rules (at Apple, guideline 1.2) require apps with user-generated content to have a way of filtering inappropriate material, and an app that holds photos of minors should not exist without this filter. What is NOT done: nobody looks at the photos that pass the filter. There is no facial recognition, no identification of people and no comparison against any database of faces. The image travels for an automatic classification and nothing else.
What is kept, depending on the result:
- If the photo passes: it is saved like any other (section 3.5). Our log keeps only an entry with the family, the child or adult it belongs to, the date, the size, the file type and the result — no file name and no copy of the image. That entry is deleted after 30 days.
- If the filter flags it: the photo is rejected — it does not reach the album, and the app says so — and a copy is kept in quarantine, in a separate folder the app does not show, so that a person on our team can check from our operator panel whether it was a mistake. This means someone at Better Planet may see that photo, which will often be a photo of a child; it is the only case in which the operator panel shows a photo. The log entry also records the categories Amazon assigned and, later, what our team decided. Resolving the case deletes the copy, whatever the decision, and does not add the photo to the album: the decision is only recorded. If nobody resolves it, the copy is deleted automatically 30 days after the upload; the log entry is also deleted after 30 days, resolved or not. If the family already has 20 photos waiting for review, further photos the filter flags are still rejected, but no copy is kept; nor is there a copy if it could not be saved. In those cases too, the log entry is deleted after 30 days, like all the others.
- If the check cannot be done — Amazon does not respond, rejects the image, the daily limit of checks that we set for the whole service to control its cost has been reached, or it fails for any other reason —: the photo is not saved, and the app asks you to try again in a few minutes. A photo that has not been checked is never treated as one that passed. The log keeps an entry with the same data as for a photo that passes, marked as not checked, with no file and no copy, which is deleted after 30 days.
If you delete a child, the log of their photos and any copies in quarantine are deleted immediately; if you close your account, those of your profile and cover photos; and if the household's last account is closed, those of the whole family (section 9.2). Processing region: Northern Virginia (us-east-1), United States.
What AWS does with them: as with identity verification, Better Planet has the AI services opt-out policy enabled in AWS, so AWS does not use these photos to improve its services.
5.4. Google LLC and Apple Inc. — sign-in (optional)
If you choose "Continue with Google" or "Sign in with Apple", your phone obtains an identity token from that provider and we verify it cryptographically against their public keys. From it we obtain your email address and, if it is included, your name. We do not obtain your password or access to your Google or Apple account. That provider will know that you signed in to Arbo.
5.5. Render — hosting for the server and the database
The Arbo server and its PostgreSQL database are hosted on Render, in Oregon, United States. The photos are not stored on Render but on Cloudflare R2 (section 5.6), although they pass through the server when they are uploaded and when they are shown. Render acts as a data processor under its data processing agreement, and its employees do not access the data except to operate the infrastructure.
5.6. Cloudflare, Inc. — network, photo storage and website
Cloudflare works for us in three roles, always as a data processor:
- In front of our server. All traffic between the app and our server (
api.arbofamily.com) passes through Cloudflare's network: every request and every response, the photos you upload and the ones you view, and the chat messages. The connection is encrypted from your phone to Cloudflare, which decrypts it to forward it and encrypts it again on its way to Render (section 8.2). This means that Cloudflare processes in transit everything that travels between the app and the server, including children's data, and sees your IP address, which it passes on to us for rate limiting (section 3.6). Our server marks every API response so that no intermediary stores it in a cache (section 8.1). - Storing the photos. Every photo — those in a child's album and life timeline, an adult's profile and cover photos, and the quarantine copies of photos the filter flagged (section 5.3) — is stored in Cloudflare R2, in private storage: no public access and no shareable links. The app never connects to R2: it asks our server for each photo, and the server first checks that you may see it (section 3.5) and only then reads it from R2 and hands it to you. When a photo is deleted (sections 5.3 and 9.2), it is deleted from R2. Storage location: United States (North America).
- Our website and our email. Cloudflare Pages hosts the public website: the home page, this policy, the terms and the page for requesting account deletion; like any web server, it sees the IP address of whoever visits it. Cloudflare Email Routing receives the emails you send us at hola@arbofamily.com, privacy@arbofamily.com or support@arbofamily.com and forwards them to our team's mailbox, hosted on Google Workspace (Google LLC).
In addition, our operator panel may be protected by Cloudflare Access, which asks the person on our team for a code before letting them in. Access only processes data about our team, not about families.
In all of these roles, Cloudflare acts as a data processor under its data processing agreement. The photos are stored in the United States and are encrypted at rest.
5.7. Sentry (Functional Software, Inc.) — error reporting
We use Sentry to find out when something fails so that we can fix it. It acts as a data processor. It works in two places, and in both it is off unless we switch it on with a setting of ours.
On our server. If it is on, every time the server writes an error to its log — only then: not warnings or normal activity — it sends Sentry that message, the technical trace of the error (where in the code it happened), technical data about the server and, as context, the latest informational and warning lines the log wrote before the error. It does not send the content of requests. As a rule, our log does not write names, email addresses, children's data or credentials: it records internal numbers (of a family, a child, an account) and technical descriptions. But the technical text of an unexpected error may, exceptionally, carry a fragment of the data that caused it.
In the app. If it is on, when the app hits an error or closes unexpectedly, it sends Sentry:
- the error: its type, its message and where in the app's code it happened;
- technical data about the phone and the app: model, operating system and its version, memory, settings such as language or time zone, and the app version;
- your account's internal number, never your name or your email address;
- what happened just before: which screens it went through, with the route name as a pattern (for example
child/[id]/growth); which calls it made to our server, also as a pattern: the address without its query part and with internal numbers and photo file names masked (for example/api/children/:id/growth), the method and the response code; and which elements were tapped, by the internal name the app's code gives them and not by what they say on screen. Neither the screens nor the calls carry the number of a child, an account or a photo.
What the app does not send: names, email addresses, children's data, screenshots, session recordings (Session Replay), the screen's view hierarchy, what the app writes to its console, or notices each time the app is opened or closed (usage sessions): only errors and crashes. It does not attach your IP address or ask Sentry to record it (although, as with any connection, Sentry sees it when it receives the report). Before leaving the phone, each report goes through a filter that removes sensitive fields (passwords, tokens and sessions, email addresses, first and last names, dates of birth, phone numbers, addresses and coordinates) and, inside any text, whatever looks like a token or an email address; anything it does not recognize as such, like a stray word in an error message, it cannot remove.
An honest limit: that filter runs in the JavaScript part of the app. Crashes of the phone's native code are recorded and sent — when the app is opened again — by the native part of the library, and do not go through that filter: they carry the same account number, the same technical data and the breadcrumbs the system itself records, which may include the full addresses of calls to our server, with their internal numbers, because they do not go through the masking described above either.
Region: United States. If error reporting is switched on, Sentry acts as a data processor under its data processing agreement, in the United States, and is configured not to store IP addresses.
5.8. Resend — account recovery email
When: only when someone asks to recover the password ("forgot my password") with an email address that belongs to an Arbo account. If nobody asks, nothing is sent to Resend. What it receives: the adult's email address and the message we send them, in the family's language, with a 6-digit code valid for 30 minutes. Nothing about the children. What we store: only a fingerprint (hash) of the code, never the code itself; it stops being valid after 30 minutes or after 5 failed attempts. Resend acts as a data processor under its data processing agreement and sends the email on our behalf, from hola@arbofamily.com. Region: United States (us-east-1).
5.9. Expo / mobile platforms
The app is built with Expo and distributed through Apple's App Store and Google Play. Those stores collect their own data about downloads and usage, under their own privacy policies, over which we have no control.
5.10. Other cases in which we might disclose data
- Legal obligation: by order of a court or a competent authority.
- Safety: to prevent fraud, an attack, or serious and imminent harm to a person.
- Child protection: we will report to the authorities any indication of child sexual abuse material or of serious risk to a child.
- Change of control: in a merger, acquisition or sale of assets, the data could be transferred to the acquirer, subject to this policy. We would let you know.
5.11. Summary of third parties
| Third party | What it receives | When | Where |
|---|---|---|---|
| Anthropic PBC | The child's context and the conversation history | Only when you use the adviser or the career guidance analysis | United States |
| Amazon Web Services | Selfie and ID document of the adult | Only if you switch verification on | Northern Virginia (us-east-1), United States |
| Amazon Web Services | Every photo that is uploaded, children's and adults' (only the image), for the automatic content check | On every upload, while the filter is switched on | Northern Virginia (us-east-1), United States |
| Google / Apple | Verification of the sign-in token | Only if you use federated sign-in | Global |
| Google (Google Workspace) | The emails you send to hola@, privacy@ or support@arbofamily.com | Only if you write to us | United States and other countries where Google operates |
| Render | The database, and everything that passes through the server, including photos when they are uploaded and shown (as a processor) | Always | Oregon, United States |
| Cloudflare | All traffic between the app and the server, in transit — including photos and messages — and your IP address (as a processor) | Always | Cloudflare's global network |
| Cloudflare (R2) | Every photo, children's and adults', and the quarantine copies, stored (as a processor) | Always | United States (North America) |
| Cloudflare (Pages and Email Routing) | Visits to the website (IP address) and the emails you send us | When you visit the site or write to us | Cloudflare's global network |
| Sentry | Error and crash reports from the server and the app: technical data and the account's internal number (see 5.7) | Only if we switch it on | United States |
| Resend | The adult's email address and the recovery code | Only when a password recovery is requested | United States (us-east-1) |
| Apple / Google (app stores) | Download and purchase data | When you install or pay | Global |
6. International transfers
Better Planet LLC is a US company. The server and the database are hosted in Oregon, United States; the photos are stored in the United States (North America); traffic passes through Cloudflare's global network, which may process it in any of its data centers, usually the one closest to you; account recovery emails are sent by Resend, in the United States (us-east-1); and error reports, if switched on, go to Sentry, in the United States. If you are in Chile, in the European Union or in another country, your data is transferred outside your country.
- For users in the EU / EEA / United Kingdom / Switzerland: transfers from the European Economic Area, the United Kingdom or Switzerland rely on the European Commission's Standard Contractual Clauses included in each provider's data processing agreement or, where the provider is certified, on the EU-U.S. Data Privacy Framework, plus the technical measures described in section 8.
- For users in Chile: under Law 21,719, international transfers require adequate safeguards. When Chile's Personal Data Protection Agency issues instructions on international transfers, we will adapt our transfer mechanism to them.
7. 🔴 CHILDREN'S AND TEENAGERS' DATA
This is the most important section of this policy.
7.1. Arbo exists to store children's data
This is not a side effect: it is the purpose of the app. Almost everything Arbo stores is information about a minor, and a significant part of it is health data, which the law treats as the most protected category.
7.2. Who may register a child
Only an adult who is the child's mother, father, legal guardian or holder of their personal care (custody), or who acts with that person's express authorization. The adult declares this when creating the record. We cannot verify it, which is why we ask for it explicitly and prominently.
7.3. The child does not have their own account
Minors do not create accounts in Arbo and do not sign in. All the information is entered and controlled by an adult caregiver. When a child uses "kids mode" or answers the word of the day, or a teenager answers the guided conversation, they do so on the adult's device and under their supervision.
7.4. Verifiable parental consent (COPPA, United States)
Because the app is aimed at families and collects personal information from children under 13, the US Children's Online Privacy Protection Act applies, along with its rule as amended by the FTC, full compliance with which is enforceable from 22 April 2026. Accordingly:
- Only a parent or guardian may provide the child's data.
- Consent is requested clearly and separately before the first record of a minor is created.
- Disclosure to third parties requires consent separate from the general collection consent — that is one of the new requirements of the 2025 amendment. That is why sending data to the AI adviser is consented to separately and can be refused without losing the rest of the app.
- The notice to parents identifies which third parties receive data and what for.
- A parent may at any time review their child's data, request its deletion and withdraw consent, without that preventing them from continuing to use the rest of the service.
- A child's participation in any activity is not conditioned on providing more data than is necessary.
How parental consent works in Arbo: the account is created by an adult, who declares that they are the child's mother, father, legal guardian or holder of their personal care (custody), and who gives their express consent when adding the child. The child does not create an account and does not enter data on their own. If you are a parent and believe that we have recorded your child's data without your consent, write to privacy@arbofamily.com and we will delete it.
7.5. Chile: best interests and progressive autonomy (Law 21,719)
Chilean law, fully in force from 1 December 2026, sets out a reinforced regime for the data of children and teenagers (art. 16 quáter):
- Processing must respect the minor's best interests and their progressive autonomy.
- To process the data of children (under 14), the consent of the parents or legal representatives, or of whoever has personal care (custody) of the child, is required.
- For teenagers (14 to 17), the rules for adults generally apply, except for the sensitive data of those under 16, which requires the consent of a parent or representative.
- Health data is sensitive data. Most of what Arbo stores about a child falls into that category.
- Those who process minors' data have a special duty to ensure its lawful use and its protection.
What this means in practice for Arbo: the health data of a 14- or 15-year-old still needs parental consent; and from the age of 16, the teenager's own agreement should also be sought before their data is processed, especially in the career guidance conversation, where the answers are theirs and speak about how they feel.
7.6. Teenagers: their voice counts
The guided career guidance conversation collects answers written by the teenager themselves, including one about their mood, and sends them to a third party for analysis. That should not happen without the teenager knowing about it and agreeing to it. The app asks for their agreement before starting, in plain words rather than a form.
7.7. No advertising and no profiling
Arbo does not show advertising, does not do behavioral advertising, does not build commercial profiles of children and does not share minors' data with advertisers, data brokers or social networks. This is also expressly required by Apple's rules (guideline 5.1.4) and Google Play's Families policy.
7.8. Data minimization
Do not ask for or enter more than is necessary. All of Arbo's sensitive fields — supports, conditions, health notes, emotion notes — are optional. A record with less data is a record with less risk.
8. How we protect the data
8.1. What is implemented today
- Passwords stored only as a BCrypt hash; never in plain text.
- Sessions using signed JWT tokens (HMAC-SHA256), verified in constant time.
- Rate limiting per IP, with a tighter bucket for sign-in, registration and OAuth, which slows down brute-force attacks.
- Federated sign-in with genuine cryptographic verification of Google and Apple tokens against their official public keys.
- Photo uploads restricted by type and size, with names generated by the server, with no possibility of directory traversal, stored in private storage with no public access and no signed links, and downloads always authenticated and always through our server.
- WebSocket chat authenticated at the handshake, with the token kept out of the URL so that it does not end up in the access logs.
- Security headers on every response, including
Cache-Control: no-storeacross the whole API, so that minors' data does not sit in intermediate caches. - No hand-built SQL: every query is parameterized.
- Generic errors towards the client; the detail stays only in the server log.
- Versioned schema with migrations and periodic database backups.
8.2. Encryption
- In transit: in production, all traffic between the app and the server is encrypted with HTTPS/TLS. Cloudflare decrypts it first (section 5.6) and encrypts it again on its way to Render, in the mode that verifies our server's certificate (Full (strict)); Render decrypts it at its edge and hands it to the server, no longer encrypted, inside its own network. The server recognizes the headers those intermediaries add — and refuses to start on Render unless it is configured to do so — so that it sends HSTS (the instruction to always use https) and applies rate limits against your real IP rather than an intermediary's. Between the server and Cloudflare R2, photos always travel encrypted (HTTPS): the server refuses to start if the R2 address is not.
- At rest: the photos are stored encrypted at rest (Cloudflare R2, section 5.6). The database is not accessible from the internet, and each family's access is kept separate from every other family's (section 8.3).
8.3. What is not there yet and has to be said
| Point | Status |
|---|---|
| Separation between families | ✅ IT EXISTS. Every query for personal data filters by the household of whoever is asking, at a single point in the server. Anything belonging to another family answers "it does not exist", never "you may not": a "you may not" would confirm the data is there. Covered by automated tests with two complete families. |
| Account deletion | ✅ IT EXISTS. Each person can close their own account from the app, and what is theirs is deleted: their profile and photos, their messages, their blocks, and the reports they made or appear in. While other adults remain in the household, the children and the family's data stay; the main account can only be closed when it is the last one. When the last person leaves, everything belonging to the family is deleted as well: each child with everything the app keeps about them, their photos in storage, the chat, and the family's data, such as the "Saying of the week". Deleting a single child still exists separately. |
| Session revocation | ✅ IT EXISTS. Changing your password — or recovering it — closes every open session on every phone immediately. The server checks on EVERY request that your session is still valid, not only when you sign in. |
| End-to-end encryption of the chat | There is none. |
| Access audit log | There is none. |
| EXIF metadata removal | ✅ IT EXISTS. The server strips the metadata from every photo it receives, including the GPS coordinates, and keeps only the orientation (see 3.5). |
8.4. Staff access
Access to production data is limited to the staff strictly necessary to operate and maintain the service. We do not read families' notes, messages or photos routinely, and we would only access them in the face of a technical problem that requires it, a legal obligation or a serious risk to a person. There are two exceptions built into the app itself: a person on our team reviews the copy of a photo that the content filter flagged (section 5.3) and the copy of a message that an adult reported (section 3.4), to decide what to do with them. Only the Better Planet staff who operate the service have access to its administration, with personal credentials, and only when it is necessary (for example, to review a photo that the filter stopped).
8.5. Breach notification
If a security breach affecting personal data occurs:
- We will notify you without undue delay and, where the risk warrants it, within 72 hours of becoming aware of it, by email and inside the app.
- We will notify the relevant authorities: Chile's Personal Data Protection Agency, the European supervisory authority if applicable, and the US state authorities that require it.
- We will tell you what happened, what data was affected, what we are doing and what you can do.
8.6. No measure is perfect
No system connected to the internet is completely secure. We do what is reasonable, and we say so without overstating it: we cannot guarantee absolute security.
9. How long we keep the data, and how it is deleted
9.1. Retention periods
| Data | Retention |
|---|---|
| Account, family and children's data | For as long as the account is active. It is a record of a life: the idea is that it lasts for years |
| Data after deleting a child | Deleted immediately and in cascade, including their photos |
| Data after deleting the account | Deleted immediately when the account is closed from the app (see 8.3 and 9.2) |
| Database backups | Backups are overwritten within 30 days at most. Deleted data may survive in a backup until that backup expires |
| Technical logs containing IP addresses | 30 days |
| Daily usage counter for paid services | 45 days. It is not deleted earlier when the account is closed: it is only a number per family and per day (see 3.6) |
| Conversations with the AI adviser | Not stored on our server. At Anthropic, according to its retention policy |
| Error reports (only if Sentry is switched on) | Not stored on our server. At Sentry, for 90 days at most. Not deleted earlier when the account is closed (see 5.7) |
| Analysis of the career guidance conversation | Stored as part of the teenager's history |
| Identity verification images | Not stored. Only the result and the percentage |
| Photo check log | 30 days from the upload. Deleted earlier if the child is deleted or the account is closed (see 5.3 and 9.2) |
| Copy of a photo in quarantine | Until our team resolves the case, and at most 30 days from the upload (see 5.3) |
| Reports of messages | While they wait for review. Once resolved, until 30 days have passed since the report. Deleted earlier if the person who reported or the person reported closes their account (see 3.4) |
| Blocks and neighborhood membership | Until the person is unblocked or the family leaves the neighborhood, or until the account is closed (see 3.4) |
| Data of inactive accounts | We notify you after 24 months without activity and delete the data after 36 months, unless you ask us to keep it |
9.2. What "delete" means
When you delete a child, the system really does remove their growth, emotion, health, medication, education, progress, quest, career guidance result and interview records, their tracker devices and signals, their "A word a day" settings and words (the chosen languages and each day's word, learned or not), and the photo check log of their photos, and it deletes their photos from storage (Cloudflare R2, section 5.6), including any copies held in quarantine. No record is left flagged as "deleted": it is erased.
When the last person in the household closes their account, the same happens to every child, and what belongs to the family as a whole, not to one child, goes too: the chat, the "Saying of the week" (the chosen culture and the record of which saying was shown each week), the family's photo check log with its copies in quarantine, and the membership of the neighborhood, whose entry code is also changed. While other adults remain, the children and what belongs to the family stay (see 8.3). And whoever closes their account, whether or not they are the last one, also takes with them the photo check log of their profile and cover photos with its copies in quarantine, their blocks and the reports they made or appear in.
On the phone, signing out or deleting the account forgets the "A word a day" reminder and cancels whatever was already scheduled.
An honest exception: the backups. Data deleted today may still exist in a backup copy until that copy expires through rotation. We do not restore backups to recover deleted data at a user's request.
10. Your rights
You have the right to:
| Right | What it means | How to exercise it today |
|---|---|---|
| Access | Knowing what data we hold about you and about your children | You can see it in the app. You can also request a complete copy from privacy@arbofamily.com |
| Rectification | Correcting anything that is wrong | By editing in the app |
| Erasure / deletion | Deleting data, or the whole account | Deleting a child and deleting the account: from the app. You can also write to privacy@arbofamily.com |
| Portability | Taking your data away in a machine-readable format | From Settings → Export my data in the app, you download a JSON file with the account and each child's history (including the words they have learned). The growth curve as a CSV file is available on request at privacy@arbofamily.com |
| Objection | Objecting to processing based on legitimate interest | By writing to privacy@arbofamily.com |
| Blocking (Chile) | Temporarily suspending processing | Same |
| Withdrawing consent | At any time, without retroactive effect | You can stop using the AI adviser or identity verification without losing the rest of the app |
| Complaining to the authority | Filing a complaint | Chile: Personal Data Protection Agency. EU: your national supervisory authority. US: the FTC |
Response time: we will reply within 30 calendar days, extendable when the request is complex, letting you know.
Verification: to protect families, before handing over or deleting data we will verify that whoever is asking really is the account holder.
No charge: exercising these rights is free, except for manifestly unfounded or excessive requests.
10.1. Specific rights of parents under COPPA
If you are the mother, father or guardian of a child under 13, you have the right to: review the personal information we have collected from your child; ask us to delete it; and refuse to allow further collection or use, without that preventing you from using the rest of the app. Write to privacy@arbofamily.com.
10.2. California and other US state residents
Better Planet does not sell or share personal information within the meaning of the CCPA/CPRA, and does not use personal data for cross-context behavioral advertising. Residents of California and of other states with equivalent laws have rights to know, delete, correct and not be discriminated against for exercising them. We grant these rights to everyone who uses Arbo, whether or not the law of their state requires us to.
11. Automated decisions
Arbo does not make automated decisions with legal effects about anyone. Percentile calculations, RIASEC profiles, "talents" and the AI's answers are informational material for a person to interpret, and on their own they produce no consequences.
12. Cookies and similar technologies
The mobile app does not use cookies. The website — the home page, this policy, the terms and the account deletion page, hosted on Cloudflare Pages (section 5.6) — is static files: it uses no analytics or advertising cookies and loads nothing from third parties, and the only thing the site itself stores in your browser, if you use the theme button on the home page, is whether you chose the light or dark theme. Cloudflare may use a strictly necessary technical cookie to protect the site against automated traffic.
13. Changes to this policy
We may update this policy. If the change is substantial — for example, a new third party receiving data, or a new purpose — we will give notice at least 30 days in advance by email and inside the app, and we will ask for consent again where the law requires it. The date of the latest version appears at the top. If you would like a previous version, write to privacy@arbofamily.com and we will send it to you.
14. Contact and complaints
Better Planet LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, USA. Privacy: privacy@arbofamily.com General: hola@arbofamily.com
If you are not satisfied with our response, you can complain to:
- Chile: the Personal Data Protection Agency (once it begins operating). For consumer matters, SERNAC.
- European Union / EEA: the supervisory authority of your country of residence.
- United States: the Federal Trade Commission (FTC), at
reportfraud.ftc.gov.
End of document.