Privacy Policy

Privacy at a glance

Kidex helps parents, guardians and authorized caregivers organize and share family records. Those records may be highly sensitive because they can concern children’s identity, health, education, care, schedules and relationships.

• You decide what to enter. Most child-profile fields are optional. Do not add information you do not need.
• Family sharing is controlled by users. Authorized family members may see or edit records according to the permissions assigned to them. Anyone who receives a share link may be able to view the information exposed by that link until it expires or is revoked.
• No data sales or targeted advertising. Kidex does not sell personal information and does not use child or family records for cross-context behavioural advertising.
• Cloud and device storage. Account and family data may be stored with Kidex’s cloud provider, Supabase, and cached on the device to keep the app working. Designated credential and government-identifier fields are encrypted on the device before storage. Other profile information may remain readable to the Service so Kidex can provide its features.
• Deletion is available in the app. The in-app Delete account control is the primary deletion path and removes the user’s account and associated family data. For assistance or a request that cannot be completed in the app, email info@famfirstinnovations.com. Verified fallback requests are completed within 30 days. Limited records may be retained where required for security, fraud prevention, legal compliance or backup rotation.

1. Scope and who is responsible

This Privacy Policy explains how Kidex ("Kidex," "we," "us" or "our") collects, uses, discloses, stores and deletes personal information through the Kidex mobile application, related web pages, authentication messages, support channels and any public sharing pages that Kidex makes available (collectively, the "Service").

The person or legal entity identified in the Contact us section is responsible for Kidex’s processing of personal information. Supabase and other service providers process information for us to operate the Service.

This policy does not govern websites, apps or services run by other parties that you choose to open from Kidex, such as a map, telephone, email, calendar, authenticator or Google Play service. Their own privacy terms apply.

2. Who may use Kidex

Kidex is designed for parents, legal guardians and other authorized caregivers. It is not directed to children and is not intended to let children create accounts or submit information on their own.

By creating an account or adding information, you confirm that you are legally able to use the Service and that you have the authority, consent or other lawful basis needed to collect, use and share information about each child and every other person whose information you enter. If another parent, guardian, caregiver, teacher, health professional, friend or contact is identified in a record, you are responsible for giving any notice and obtaining any consent required by law.

If we learn that a child created an account or submitted information without legally valid authorization, we may suspend the account and delete the information after appropriate verification.

3. Information we collect

3.1 Account and authentication information

We may collect your name or display name, email address, account role, family membership, permissions, password-derived authentication data, session tokens, email-confirmation status, password-reset information, invitation tokens, multi-factor authentication status and related security records. Authentication may be provided by Supabase Auth. The password-derived key used to unlock designated sensitive fields exists only in active session memory and is not stored in local storage or Supabase.

If you enable biometric sign-in, Kidex asks the operating system to verify your fingerprint, face or device credential. Kidex does not receive or store your biometric template. Session information may be cached locally to maintain sign-in, subject to the device and operating system’s security controls.

3.2 Family and household information

We may collect family identifiers; names, email addresses and roles of family members or caregivers; invitation and membership information; per-child viewing or editing permissions; and user-created access settings.

3.3 Child profile and identity information

Information you choose to add may include a child’s name, date of birth, gender, photograph, contact details, social accounts, physical measurements and clothing sizes. Optional fields may also accept government or identity information such as a health-card number, passport information or Social Insurance Number.

Kidex does not require government identifiers to create an account. Enter them only when you have a clear need and lawful authority. Designated government-identifier fields are encrypted on the device before storage, but encryption does not eliminate the risks of collection, access from an unlocked session, sharing, screenshots or a compromised device. Use the minimum information necessary.

3.4 Health and care information

You may enter allergies, medications, prescriptions, dietary needs, medical notes, vision-prescription details, health-provider names and contact information, and details about doctors, dentists, optometrists, orthodontists, specialists, before- or after-school care, babysitters and emergency contacts.

Kidex is an organizational tool, not a health-care provider, emergency service or official medical record. Information in Kidex may be incomplete, outdated or unavailable. Do not rely on it as the only source for emergency or clinical decisions.

3.5 Education, activities and relationship information

You may enter school and parent-portal details, teachers, classes, sports, camps, friends, friends’ parents, social information, important dates, schedules and related notes.

3.6 Financial and expense information

You may record expenses, amounts, dates, categories, payment status and proportional shares among family members. Unless a payment feature expressly says otherwise, Kidex is not a bank or payment processor and does not need full payment-card or bank-account numbers for ordinary expense tracking.

If you purchase a Kidex digital product through Google Play, Google processes the payment under its own terms. Kidex may receive limited purchase information, such as the product purchased, entitlement status, purchase token or order reference, price, currency and transaction status. We do not receive your full payment-card details from Google Play.

3.7 Photos, notes and other content

We collect photographs, free-text notes and other content you choose to upload or create. Photos selected in Kidex may be resized or compressed before storage. Because free-text fields can contain unexpected sensitive information, avoid entering information that is not needed for the family purpose you selected.

3.8 Credentials you choose to save

Some versions of Kidex include fields for school portals, social accounts, devices or other account credentials. In the current release, designated credential fields are encrypted on the device before they are cached locally or synchronized to Supabase or the optional REST service. They are decrypted in memory after the authenticated user unlocks the vault.

Kidex should not be treated as a dedicated password manager. Do not store banking credentials, primary email credentials, government-service credentials, authentication backup codes or any password reused elsewhere. Information is visible in plaintext while displayed in an unlocked session and may be exposed if the device, account or sharing controls are compromised.

3.9 Device, network and diagnostic information

When the Service communicates with our providers, we or those providers may process internet protocol address, request date and time, app or browser type, operating system, language, network and connection information, authentication events, errors, security events and similar service logs. The reviewed Android build requests internet access and biometric or fingerprint permission. It does not request precise device location, contacts, call logs, SMS access or an advertising identifier.

3.10 Support communications

If you contact us, we collect the information you provide, such as your email address, message, screenshots and troubleshooting details. Do not include child records, passwords, verification codes or government identifiers unless we specifically request a minimum necessary item through a secure method.

4. How we collect information

We collect information:

• Directly from you when you create an account, fill in a profile, upload a photo, add a family member, contact support, create a sharing link or purchase a product.
• From authorized family members when they add, edit or share records within the permissions assigned to them.
• Automatically from the app and device when the Service stores a session, caches data, records an error or communicates with our systems.
• From service providers when they confirm authentication, email delivery, purchase status, fraud or security events, or service availability.

We do not seek to collect personal information from data brokers, advertising networks or public social-media scraping.

5. How we use information

We use personal information to:

1. create, authenticate and secure accounts;
2. organize, display, synchronize and back up family and child records;
3. apply family roles and per-child access permissions;
4. send account confirmation, invitation, sign-in, security and password-reset messages;
5. create user-requested calendar files, links and other exports;
6. provide and manage trial or paid entitlements;
7. respond to support, privacy and account-deletion requests;
8. detect, investigate and prevent misuse, unauthorized access, fraud, data loss and service failures;
9. maintain, troubleshoot and improve reliability and accessibility; and
10. comply with law and enforce our agreements.

We do not use child profiles, health information, government identifiers, saved credentials or family records to build advertising profiles, serve targeted advertisements or train general-purpose artificial-intelligence models.

6. Legal bases for processing

Where a law requires us to identify a legal basis, we rely on one or more of the following:

• Contract: Processing needed to provide the Service you request, authenticate you, synchronize your records and administer purchases.
• Consent: Processing you choose by entering optional information, uploading photographs, enabling biometrics or sharing records. Sensitive information may require express consent.
• Legitimate interests: Reasonable processing needed to secure, support and improve the Service, prevent abuse and keep accurate operational records, balanced against the rights of affected people.
• Legal obligations and claims: Processing needed to comply with law, respond to valid legal requests or establish, exercise or defend legal claims.
• Vital interests: Limited disclosure when reasonably necessary to protect someone’s life, health or safety and permitted by law.

You may withdraw consent where consent is the legal basis. Withdrawal does not affect processing already lawfully completed and may prevent the Service from providing a feature that requires the information.

7. When we disclose information

We disclose personal information only as described below.

7.1 People you authorize

Family owners can invite members and assign roles or permissions. Authorized members may view, add, change, export or delete information according to their access. Owners should review membership regularly and remove access that is no longer needed.

If shareable summary or Care Card links are enabled, the person creating a link chooses what it shows and, where available, its audience and expiry. Anyone who receives or forwards a valid link may be able to view that information without a Kidex account. Treat a share link like a confidential document: limit its contents, use the shortest practical expiry and revoke it when no longer needed. Revocation cannot retrieve copies already downloaded, photographed or forwarded.

7.2 Service providers

We use providers to deliver infrastructure and functions on our behalf. These providers may process information only as needed to perform their services, under their contracts and applicable law.

• Supabase: Account authentication, database hosting, synchronization, security and related infrastructure.
• Email-delivery providers: Account confirmation, invitations, password recovery and security messages, where configured.
• Google Play: App distribution, purchase processing, entitlement verification, fraud prevention and store support, if Play Billing is enabled.
• Hosting, support and security providers: Website hosting, error diagnosis, security monitoring and customer support, if configured in the production release.

The final production provider list may change. We will update this policy before a new provider begins processing personal information for a materially different purpose.

7.3 Legal, safety and business reasons

We may disclose information when we reasonably believe it is necessary to comply with law or valid legal process; protect a person’s life, health, rights or safety; investigate fraud, abuse or security incidents; enforce agreements; or protect the Service.

If Kidex is involved in a merger, financing, reorganization, sale of assets or similar transaction, personal information may be reviewed or transferred subject to appropriate confidentiality and privacy protections. We will provide notice when required by law.

7.4 No sale or targeted advertising

Kidex does not sell personal information and does not share it for cross-context behavioural advertising. Kidex does not use third-party advertising software development kits in the reviewed release.

8. Children’s information and sensitive records

Information about children is treated as sensitive. Kidex collects it from adults or other authorized account holders, not directly from children. The account holder decides what to enter and who may access it.

Before entering or sharing a child’s information, consider the child’s age, maturity, best interests and reasonable expectations of privacy. Where law requires consent from a parent, guardian or the child, the account holder must obtain that consent. Older children and teenagers should be told in age-appropriate language what is being recorded and shared when appropriate.

Use the minimum information necessary. Avoid storing government identifiers, credentials, precise routines, detailed health information or photographs when a less sensitive description will do. Do not publish a child’s share link on social media or another public forum.

A parent, guardian or other authorized person may ask us to review or delete information believed to have been submitted without valid authority. We may ask for enough information to verify the request and protect the child and account from unauthorized access.

9. On-device storage, encryption, biometrics and third-party actions

Kidex uses local device storage to keep you signed in, remember trial or entitlement status, cache child records and family settings, and support offline or faster operation. Designated credential and government-identifier fields in the cache are protected with client-side encryption; other child and family information may be cached without that field-level encryption. Deleting information from the cloud may not immediately erase every device copy held by another authorized family member.

For designated sensitive fields, Kidex derives a 256-bit Advanced Encryption Standard Galois/Counter Mode (AES-GCM) key from the user’s password using Password-Based Key Derivation Function 2 with HMAC-SHA-256 and 600,000 iterations. Each encrypted value uses a fresh random initialization vector. The active key is held in session memory only. Kidex refuses to store a designated sensitive value if the encryption key is unavailable or encryption fails.

Existing unencrypted values in designated fields are detected after the user unlocks the vault, encrypted on the device and rewritten to active storage. This migration does not erase plaintext that may remain temporarily in older provider backups. Client-side encryption protects designated fields at rest; it does not protect information while displayed in an unlocked app, deliberately exported or shared, captured in a screenshot, or exposed through a compromised device or user account.

Protect your device with a strong screen lock, install operating-system security updates, do not share an unlocked device, and sign out before transferring or disposing of it. Clearing Kidex’s app data or uninstalling the app generally removes its local application storage, subject to operating-system backups and device-management settings.

When biometrics are enabled, the device’s operating system performs the fingerprint or face comparison. Kidex receives only the result and does not receive the biometric template. Biometric availability and secure credential storage depend on the device and operating system.

Buttons that open a telephone call, email, map, calendar, website or authenticator send the information needed for that action to the app or service you choose. Once transferred, the recipient’s privacy practices apply.

10. International processing

Kidex and its providers may process or store personal information in a country, state or province different from where you live. The current production Supabase project is hosted in the us-west-2 region (West US — Oregon, United States). Privacy laws and lawful-access rules in those locations may differ. When required, we use contractual or other recognized safeguards for international transfers. Contact us to ask about the safeguards applicable to your information.

11. Retention

We keep personal information only as long as reasonably necessary for the purposes described in this policy, including to provide the account, preserve user-requested records, resolve disputes, secure the Service and meet legal obligations.

• Active account and family records: Normally kept while the account or family space remains active, until an authorized user deletes the record or the family owner deletes the account.
• Local cache: Kept on each device until the user signs out and clears data, deletes the relevant record, clears app storage or uninstalls the app, subject to operating-system backups.
• Authentication and security records: Kept for as long as needed to maintain the account and for a limited period afterward to prevent abuse, investigate incidents or comply with law.
• Support communications: Kept while the matter is open and for a reasonable period afterward to document the response and improve support.
• Purchase and legal records: Limited transaction or compliance records may be retained for the period required by tax, accounting, fraud-prevention or other applicable law.
• Backups: Deleted information may remain in restricted backups for up to 7 days before those backups are overwritten or expire under the provider’s backup schedule. Backups created before the client-side-encryption migration may contain earlier plaintext versions of designated sensitive fields until those backups age out. Backup data is not restored to active use except for disaster recovery or legal necessity.

We may delete inactive accounts or obsolete data after reasonable notice when practical. We will not retain child or family content indefinitely merely because storage is available.

12. Your choices and privacy rights

Depending on your location and relationship to the information, you may have the right to:

• access personal information we hold about you;
• correct inaccurate or incomplete information;
• receive a portable copy of information you provided;
• delete information or the account;
• withdraw consent;
• object to or restrict certain processing;
• manage family members, roles and per-child permissions;
• revoke share links or let them expire;
• disable biometric sign-in;
• complain to a privacy or data-protection regulator; and
• appeal a refusal where applicable law provides that right.

Many records can be viewed, corrected or deleted directly in Kidex. Some calendar records can be exported as an .ics file. To exercise another right, contact us using the details below. We may verify your identity, authority over the account and relationship to the child before acting. We will not discriminate against you for exercising a legal privacy right.

Rights are not absolute. We may deny or limit a request where law permits, such as to protect another person’s privacy, preserve security records, comply with a legal duty or establish a legal claim. If we cannot fulfill a request, we will explain why when the law requires it.

13. Account and data deletion

The in-app Delete account control is the primary deletion path. Using it removes the user’s account and associated family data, including applicable family memberships, child profiles and related active records. A non-owner family member may leave the family or request deletion of their own membership and account data, but cannot delete records controlled by the family owner unless authorized.

For assistance, or if a deletion request cannot be completed in the app, email info@famfirstinnovations.com. A fallback request may require verification to prevent someone else from deleting your family’s records. We will honor verified fallback deletion requests within 30 days.

Deleting the app from a device does not by itself delete cloud data. Deleting a child profile does not necessarily delete the entire account. Deleting an owner account may affect all family members who rely on that family space; export any records you are legally entitled to keep before confirming deletion.

After a verified deletion request, we delete or de-identify active personal information unless retention is reasonably necessary for security, fraud prevention, legal compliance, dispute resolution or another lawful purpose. Restricted backup copies are removed through the ordinary backup-rotation cycle. Information already copied or exported by another authorized user or share-link recipient is outside our control.

14. Security

We use administrative, technical and organizational measures intended to protect personal information. In the current release, these measures include authenticated accounts, transport encryption, database access controls, Supabase Row Level Security, family roles, per-child permissions, session management, multi-factor authentication, device biometrics and controlled deletion procedures.

Designated credential and government-identifier fields are encrypted on the user’s device before local or cloud storage using AES-GCM. The encryption key is derived from the user’s password using PBKDF2-HMAC-SHA-256 with 600,000 iterations and remains in active session memory. Both the Supabase save path and the optional REST synchronization path sanitize these fields before writing. Legacy plaintext values in designated fields are migrated after the user successfully unlocks them. This field-level encryption does not apply to every item in a child profile; names, schedules, photographs, health notes and other records may be stored in a form accessible to Kidex’s infrastructure where necessary to provide the Service.

No storage or transmission method is completely secure. Risks include a lost or compromised device, weak or reused passwords, an incorrectly configured cloud project, an overbroad family permission, a forwarded share link, malicious software, service-provider failure or human error. We cannot guarantee absolute security.

You can reduce risk by using a unique password, enabling multi-factor authentication and device lock, keeping recovery codes private, reviewing family access, revoking unused links, installing updates and avoiding unnecessary sensitive data. Never send us a password or one-time verification code.

If we discover a breach involving personal information, we will investigate, mitigate the risk and notify affected people and regulators when required by applicable law.

15. Automated decisions, analytics and advertising

The reviewed Kidex release does not use personal information to make decisions that produce legal or similarly significant effects. It does not use advertising identifiers, third-party behavioural advertising or third-party analytics software development kits.

If a future release introduces analytics, crash reporting, automated decision-making or artificial-intelligence features that materially change how personal information is processed, we will update this policy and provide any notice or consent required before the new processing begins.

16. Regional privacy information

16.1 Canada

If Canadian privacy law applies, Kidex is accountable for personal information under its control and uses it for purposes that a reasonable person would consider appropriate in the circumstances. We seek meaningful consent appropriate to the sensitivity of the information. Express consent may be required for health information, government identifiers, credentials, photographs, children’s information or disclosures that create a meaningful risk of harm.

You may request access to or correction of personal information and may challenge our compliance by contacting the privacy contact below. If the matter is not resolved, you may contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

16.2 European Economic Area, United Kingdom and Switzerland

Where applicable law grants these rights, you may request access, correction, erasure, restriction, portability or objection; withdraw consent; and complain to your local supervisory authority. Where processing is based on legitimate interests, you may ask for information about the balancing assessment. Where information is transferred internationally, you may ask about the transfer mechanism used.

Kidex is not intended to be offered in these regions until the operator has confirmed a lawful basis, controller contact details, data-transfer safeguards and any required representative or data-protection officer.

16.3 United States

Residents of certain US states may have rights to know, access, correct, delete or obtain a portable copy of personal information, and to opt out of sale, targeted advertising or certain profiling. Kidex does not sell personal information or process it for cross-context targeted advertising, so those opt-outs should not be necessary for the practices described in this policy.

Kidex is not directed to children under 13 and does not knowingly collect personal information directly from them. If you believe a child submitted information directly without verifiable authorization, contact us so we can investigate and delete it where appropriate.

17. Changes to this policy

We may update this policy when Kidex’s features, providers, legal obligations or data practices change. We will post the new version with a revised “Last updated” date. If a change materially affects how we use sensitive information, we will provide additional notice or request consent when required by law. Earlier versions may be available on request.

18. Contact us

Kidex’s privacy contact details are:

Operator / developer legal name: Warren Palmer

Privacy contact email: info@famfirstinnovations.com

Principal country/province: Ontario, Canada

Account-and-data deletion: Use the in-app Delete account control as the primary deletion path. For assistance or a request that cannot be completed in the app, email info@famfirstinnovations.com. Verified fallback requests will be completed within 30 days.

Include “Kidex privacy request” in the subject line. Describe the request and the email address associated with the account, but do not send passwords, verification codes, government identifiers or detailed child records by ordinary email. We may request additional information through a safer channel to verify identity and authority.

Privacy questions? Contact Warren Palmer at info@famfirstinnovations.com.