Information Security Program
Purpose & scope
The U.S. Children's Online Privacy Protection Act (COPPA) requires us to maintain a written program of safeguards for children's personal information that is appropriate to the sensitivity of that information and to our size, complexity, and activities. This is that program. It covers every place a child's information is collected, stored, or transmitted by Tidiest: the parent and child devices, Sign in with Apple, our Cloudflare Worker, D1 databases, Durable Objects, Queues, private R2-compatible evidence storage, backend evidence metadata storage, and the service providers we rely on.
Who is responsible
Tidiest LLC designates Zachary Amith as the person responsible for this security program. That coordinator maintains this document, oversees the safeguards below, reviews them on the schedule stated here, and is the point of contact for any security concern at [email protected].
Minimizing what could be exposed
The strongest safeguard is collecting little. We do not collect a child's real name, age, email, phone number, precise location, profile picture, public profile, AI profile, biometric identifier, or any advertising/tracking identifier. A child is represented by a UUID, parent-chosen nickname, and optional private non-photo display symbol only after a parent has reviewed the child-data notice and given verifiable consent. The child may change that private symbol, but not their nickname or any parent-owned setting. Child submissions are allowed only after that consent, child profile creation, and parent-controlled pairing. Non-photo household data lives in Cloudflare D1 and sanitized chore evidence lives only in private short-retention object storage, with metadata limited to operational evidence status and deletion fields.
Safeguards we apply
• Consent-gated capture: a parent must review the notice and give consent before creating a child profile or enabling a child's chore-photo submission. The child device must also be paired by the parent.
• Per-child isolation: each child session is scoped to exactly one child; one child's device cannot read another's data. Sanitized evidence uses opaque object keys and backend authorization rather than public URLs.
• Tamper-proof points: every point entry and balance is cryptographically signed (Ed25519) by our Worker, the only party that can issue points. Both devices trust only signed balances, so neither a child's device nor a forged record can mint or alter points.
• Authorized callers only: a points-affecting action can be triggered only by a valid parent or child Cloudflare session for the household and child. Raw session and pairing secrets are stored only hashed or peppered server-side and in the device Keychain client-side.
• On-device photo hardening: location metadata (EXIF/GPS) is stripped from a photo on the device before it is uploaded, raw originals are not uploaded, and sanitized JPEG validity remains a hard gate. Local Vision status, confidence, regions, and bounded errors are diagnostic evidence only; face-like candidates do not reject uploads.
• Private evidence storage: child chore evidence is uploaded only through short-lived signed URLs to a private R2-compatible bucket. Object keys are opaque, public bucket access is disabled, signed review URLs are short-lived, and parent review/download URL minting requires a parent-only session. One locked Auto-before object may link to at most three chores without duplicating bytes; every Auto-after object is exclusive to one chore and submission.
• Parent-only room planning: Manual and AI captures use the same on-device diagnostic Vision report, metadata stripping, 1024-pixel JPEG redraw, and preview-decode pipeline; raw originals are released immediately. A Vision candidate or error alone does not require a retake, while invalid input or failed sanitization does. AI captures may be processed by the selected approved AI provider. After room-photo notice 2026-08-30-before-after-verification-v3, the exact sanitized derivative is stored once in a dedicated private bucket and linked to saved chores. When AI verification is enabled, the Worker may compare it with a linked chore's completion photo. Child submission photos remain in the separate evidence path.
• Room-reference isolation: object keys and public URLs are never returned. Parents are household-scoped; a child can read only a reference linked to that child's active chore. Reads stream through the Worker with Cache-Control: private, no-store. Objects are deleted after their final link, child/household deletion, or orphan cleanup, with Queue/DLQ retries. Paid expiry or revocation downgrades the household to Free without deleting retained room references.
• Consent-gated AI verification: child submissions are sent to the Worker and then to Amazon Nova Pro through AWS Bedrock or GPT-5.6 Luna through OpenAI's global API only through /verify-chore, only after parental consent, and only for bounded Auto suggestions or chore-completion verification. The Worker verifies the session, checks the AI-verification entitlement, and resolves rules from the canonical chore rather than trusting child input.
• Separately authorized paid-tier Auto Mode: during an active trial, paid subscription, or Billing Grace Period, and before a child may send a before photo for suggestions, a parent must accept the blocking 2026-07-30-auto-mode-v1 notice, keep that child's photo/AI capability enabled, and select Off, Auto, or Auto-trusted. Free households cannot enable Auto Mode. The bounded suggestion route returns only validated candidates from a closed safe-category list. It rejects unsafe, sensitive, unclear, unsupported, inferred-destination, hidden-work, and banned-action scenes. Suggestions and locked evidence are immutable, commits are household-serialized, and the fixed household-local limit is 30 committed Auto chores per day.
• Parent control: ambiguous, sensitive, or unsafe verification results require parent review. Auto rewards are disabled per child by default. Parents can correct decisions subject to the full-award reversal rule, disable AI verification, revoke Auto authorization, or delete a child's data. Revocation turns every child's Auto policy off and blocks new Auto processing.
• No unrelated AI use: Tidiest does not use child data or parent room photos to train models, improve models, build child profiles, identify faces, identify people, or run unrelated AI.
• Private symbol boundary: the optional display symbol is not sent to public surfaces, AI prompts, photos, signed point ledgers, balances, analytics, or purchase surfaces.
• No social or tracking surface: we do not provide public child profiles, profile pictures, open chat, child messaging, public leaderboards, third-party analytics, advertising, or tracking SDKs that would move a child's identifiers off the device.
• Transport security: all network traffic is encrypted in transit.
• Adult Composer isolation: solo sessions are parent-scoped and the Worker derives the adult subject from the authenticated workspace. Composer batches, chores, verification results, overrides, Activity, and media metadata use separate adult-owned APP_DB tables rather than child tables. D1 constraints allow only one active batch, cap a committed batch at three chores, and prevent children from being inserted into a solo workspace. A separate private R2 binding stores locked-before, exclusive-after, and reduced-thumbnail roles. Household Durable Objects serialize creation, verification finalization, dismissal, override, Activity deletion, and conversion. Subscription lapse leaves reads available but every mutation checks verified compatible paid access again.
Identifying and assessing risk
The coordinator periodically reviews the risks to children's information across collection, storage, and transmission - including new features, new data fields, and changes to our service providers - and confirms the safeguards above still address them. Any change that touches storage, the camera path, identity, or child data triggers a fresh review before it ships.
Service providers we rely on
Apple provides Sign in with Apple for parent identity and processes App Store subscriptions. Cloudflare hosts the Tidiest Worker that verifies purchases, checks household authorization, stores canonical app data in D1, serializes household mutations with Durable Objects, stores short-retention sanitized evidence and retained room references in separate private R2-compatible buckets, retries deletion through Queues/Cron, routes parent-selected planning and consented child-evidence requests to the selected approved AI provider, signs point records, stores parent-supplied reward codes encrypted in a dedicated rewards database, and sends parent-only subscription status through the existing push-notification service. It exposes no public image URLs or object keys and does not log image bodies or reward codes. Amazon Nova Pro through AWS Bedrock or GPT-5.6 Luna through OpenAI's global API receives sanitized photos only for parent planning, bounded Auto suggestions, or chore-completion verification. Tidiest does not opt provider inputs or outputs into training or model improvement and prohibits personalization, profiling, and unrelated use. OpenAI launch abuse-monitoring may retain ordinary inputs and outputs up to 30 days, longer where legally required or necessary to prevent harm; potential-CSAM images may be scanned and retained for review and reporting.
Responding to a security incident
If we learn of a suspected breach of children's personal information, the coordinator investigates and contains it, remediates the cause, and notifies affected parents and any authorities as required by applicable law and our agreements with applicable service providers.
Review
The coordinator reviews and updates this program at least annually and whenever there is a material change to our systems, data, or service providers.
Contact
Security questions or reports: Tidiest LLC, 12851 Tilden Dr., Rancho Cucamonga, CA, United States · +1 (909) 646-2488 · [email protected].