Information Security Program
Purpose & scope
The U.S. Children's Online Privacy Protection Act (COPPA) requires us to maintain a written program of safeguards for children's personal information that is appropriate to the sensitivity of that information and to our size, complexity, and activities. This is that program. It covers every place a child's information is collected, stored, or transmitted by Tidiest: the parent and child devices, Sign in with Apple, our Cloudflare Worker, D1 databases, Durable Objects, Queues, private R2-compatible evidence storage, backend evidence metadata storage, and the service providers we rely on.
Who is responsible
Tidiest LLC designates Zachary Amith as the person responsible for this security program. That coordinator maintains this document, oversees the safeguards below, reviews them on the schedule stated here, and is the point of contact for any security concern at [email protected].
Minimizing what could be exposed
The strongest safeguard is collecting little. We do not collect a child's real name, age, email, phone number, precise location, profile picture, public profile, AI profile, biometric identifier, or any advertising/tracking identifier. A child is represented by a UUID, parent-chosen nickname, and optional private non-photo display symbol only after a parent has reviewed the child-data notice and given verifiable consent. The child may change that private symbol, but not their nickname or any parent-owned setting. Child submissions are allowed only after that consent, child profile creation, and parent-controlled pairing. Non-photo household data lives in Cloudflare D1 and sanitized chore evidence lives only in private short-retention object storage, with metadata limited to operational evidence status and deletion fields.
Safeguards we apply
• Consent-gated capture: a parent must review the notice and give consent before creating a child profile or enabling a child's chore-photo submission. The child device must also be paired by the parent.
• Per-child isolation: each child session is scoped to exactly one child; one child's device cannot read another's data. Sanitized evidence uses opaque object keys and backend authorization rather than public URLs.
• Tamper-proof points: every point entry and balance is cryptographically signed (Ed25519) by our Worker, the only party that can issue points. Both devices trust only signed balances, so neither a child's device nor a forged record can mint or alter points.
• Authorized callers only: a points-affecting action can be triggered only by a valid parent or child Cloudflare session for the household and child. Raw session and pairing secrets are stored only hashed or peppered server-side and in the device Keychain client-side.
• On-device photo hardening: location metadata (EXIF/GPS) is stripped from a photo on the device before it is uploaded, raw originals are not uploaded, and visible faces are rejected before AI verification.
• Private evidence storage: child chore evidence is uploaded only through short-lived signed URLs to a private R2-compatible bucket. Object keys are opaque, public bucket access is disabled, signed review URLs are short-lived, and parent review/download URL minting requires a parent-only session.
• Parent-only room planning: detected faces are rejected on-device. Selected room photos are discarded after Bedrock returns suggestions by default. After a blocking parent notice, a sanitized single-photo derivative may be stored in a dedicated private bucket and linked to saved chores as a child-visible framing reference. Child submission photos never enter this path.
• Room-reference isolation: object keys and public URLs are never returned. Parents are household-scoped; a child can read only a reference linked to that child's active chore. Reads stream through the Worker with Cache-Control: private, no-store. Objects are queued for deletion when Family access becomes inactive and are also deleted after their final link, child/household deletion, or orphan cleanup, with Queue/DLQ retries; they are not restored after resubscription.
• Consent-gated AI verification: child submissions are sent to the Worker and Amazon Bedrock only through /verify-chore, only after parental consent, and only for chore-completion verification. The Worker verifies the session, checks the AI-verification entitlement, and rejects tampered chore rules by comparing them to a parent-written hash.
• Parent control: ambiguous, sensitive, or unsafe verification results require parent review, and parents can override decisions, disable AI verification, or delete a child's data.
• No unrelated AI use: Tidiest does not use child data or parent room photos to train models, improve models, build child profiles, identify faces, identify people, or run unrelated AI.
• Private symbol boundary: the optional display symbol is not sent to public surfaces, Bedrock prompts, photos, signed point ledgers, balances, analytics, or purchase surfaces.
• No social or tracking surface: we do not provide public child profiles, profile pictures, open chat, child messaging, public leaderboards, third-party analytics, advertising, or tracking SDKs that would move a child's identifiers off the device.
• Transport security: all network traffic is encrypted in transit.
Identifying and assessing risk
The coordinator periodically reviews the risks to children's information across collection, storage, and transmission - including new features, new data fields, and changes to our service providers - and confirms the safeguards above still address them. Any change that touches storage, the camera path, identity, or child data triggers a fresh review before it ships.
Service providers we rely on
Apple provides Sign in with Apple for parent identity and processes App Store subscriptions. Cloudflare hosts the Tidiest Worker that verifies purchases, checks household authorization, stores canonical app data in D1, serializes household mutations with Durable Objects, stores short-retention sanitized evidence and opted-in room references in separate private R2-compatible buckets, retries deletion through Queues/Cron, sends parent-selected room-planning requests and consented child verification requests to Bedrock, signs point records, and stores parent-supplied reward codes encrypted in a dedicated rewards database. It exposes no public image URLs or object keys and does not log image bodies or reward codes. Amazon Bedrock receives sanitized room photos for parent planning and, when AI verification is enabled with active Tidiest Family access, sanitized child chore photos for the limited purpose of chore-completion verification through Amazon Nova Pro. We do not permit training or unrelated use.
Responding to a security incident
If we learn of a suspected breach of children's personal information, the coordinator investigates and contains it, remediates the cause, and notifies affected parents and any authorities as required by applicable law and our agreements with applicable service providers.
Review
The coordinator reviews and updates this program at least annually and whenever there is a material change to our systems, data, or service providers.
Contact
Security questions or reports: Tidiest LLC, 12851 Tilden Dr., Rancho Cucamonga, CA, United States · +1 (909) 646-2488 · [email protected].