Privacy and child safety
This is the full policy. It covers what Umeed records about a child, what the AI is given, who can see it, how long it is kept and how to have it deleted. It is written in plain language on purpose, so a parent or a head teacher can read it without a lawyer, and there is no shorter or longer version elsewhere.
Version 1.0. In effect from 30 September 2026. Applies to umeedai.com, the Umeed games, and the signed-in companion.
Six things, if you read nothing else
Children have no account
No email, no password, no surname required, no photograph, no address. A child types a six character play code and plays. The code is made by their own parent, teacher or clinician.
The AI never talks to a child
Everything a child reads in a game is written and reviewed in advance. There is no open conversation between a child and a model anywhere in Umeed.
A child's writing is theirs
A journal entry can be marked as not shared. When it is, no adult sees it and it is never given to the model.
We never sell or advertise
No data is sold, no data goes to advertisers, and there are no third party advertising or analytics trackers in the child-facing product.
Nothing trains a model
What a child does is used to write that child's report and shape that child's next game. It is not added to any training set, ours or a supplier's.
Governments get counts, not children
A department or ministry receives totals at class, school and district level. A named child's emotional record does not go into a monitoring database.
The complete list, for a child
This is everything. If something is not on this list, we do not have it.
Who they are
A first name or nickname chosen by the adult who set them up. Age or year group. Class name. A play code. Optionally a language. A surname is not required and we ask adults not to enter one.
What they did in a game
Which island, when they played, how far they got, which options they chose, which emotions they named, and whether they applied the technique correctly.
How they felt
The mood they picked before the game and the mood they picked after. These are the child's own choices from a five point face scale, not an assessment of the child.
What they wrote
The journal entry and the reframed thought, if they wrote one and chose to share it.
Paper worksheets
Where a school uses the paper track, the teacher enters the same four measurements afterwards. It becomes the same kind of record.
Nothing else
No location, no GPS, no device fingerprint, no browsing history, no contacts, no photographs, no voice recordings, no biometrics, no health records, no family information.
For the adult who holds the account, we hold an email address, a display name, the account type, and payment records held by our payment processor. We never see or store full card numbers.
What the model is given, and what it is never given
This is the part people ask about most, so it is written out in full rather than summarised. Umeed uses large language models from a commercial supplier. Here is exactly where they sit.
It never speaks to a child
Every word a child reads in a game was written by a person and reviewed before the game shipped. The model is not in the child's loop at all. A child cannot type to it and it cannot answer them.
It answers to adults only
The companion answers a parent, a teacher, a clinician or a school administrator. That is the only conversational surface in the product, and it is behind a sign-in.
It is given facts, not memory
When an adult asks for a report, the model is sent that child's session record for that request and nothing more. It does not hold a standing memory of a child between requests.
It chooses, it does not invent
Every technique, feeling word, thought and exercise comes from a fixed library. The model selects from that library by identifier and writes the sentences that join the pieces together. It is never asked to invent a therapeutic instruction and cannot introduce one.
Nothing is kept after the answer
The text sent for a report is not retained by us beyond producing that answer, and our supplier is engaged on terms that exclude using it to train their models.
A disclosure never reaches it
Writing that suggests harm, danger or abuse is detected before any generation happens. It is answered with fixed text that points an adult at their safeguarding route. That moment gets a person, not a paraphrase.
The companion on the public landing page is different again. It is not signed in, it cannot see any child, it does not know who you are, and the conversation is not stored after you close the tab. It answers about patterns of behaviour in general, never about a particular child.
New games can be drafted with AI against the same approved library. Every generated game is reviewed by a person before any child can reach it. Nothing generates straight into a child's hands.
The journal, and the one thing that overrides it
A journal entry is the most personal thing in Umeed, so it has its own rules.
The child decides
At the end of a journal prompt a child chooses whether a grown-up sees it. If they say no, the words stay with the child: out of every list a teacher sees, out of every report, and out of anything given to the model.
A teacher sees a count, not the words
Where entries are withheld, the teacher's page says how many were withheld. It never shows the text. Knowing a child wrote something is different from reading it.
Safety overrides privacy
If an entry suggests a child is being harmed or is in danger, it is flagged to an adult even when it was marked as not shared. A child cannot lock away a disclosure of harm, and we will not pretend otherwise to anyone, including the child.
What happens when something serious appears
Umeed is a learning platform, not a counselling service and not a reporting authority. What it does is make sure a trained person knows, quickly, and give the teacher a written route to follow.
It is caught before generation
The check runs on the child's writing before any model is called. A flagged entry is not summarised, softened or rewritten.
It goes to the top of the adult's page
It appears above every average and every chart, on its own, so it cannot arrive as item four in a list of pleasant reframes.
The school's own policy comes first
Umeed provides a written pathway that ends with a trained person rather than with the class teacher. It is a template. Wherever it differs from a school's own child protection procedure, the school's procedure wins.
Umeed does not contact emergency services, social services or the police on a school's behalf, and it does not notify parents automatically. Those decisions belong to the people who know the child. We tell the adult, in the clearest terms we can, that a person needs to act.
If a child is in immediate danger, contact your local emergency services. Do not wait for anything on this platform.
Who can see a child's record
Their own adult
The parent or teacher whose account the child sits under. A teacher sees her own class. No teacher can reach another school's children.
Enforced by the database
Access is decided by database security rules, not by the application choosing to be polite. A request for another school's records is refused at the data layer.
Sharing is the adult's decision
A child's record reaches a teacher or a school because the parent agreed. It is not a default and it is not retrospective.
Umeed staff
Staff access is limited to what is needed to fix a fault or answer a support request, and it is not routine. We do not browse children's journals.
Our suppliers
The companies that host the database and run the models can technically process what passes through them. They are bound by contract, they do not use it to train, and they are listed below.
Nobody else
No advertisers, no data brokers, no researchers without separate written agreement and the relevant consent, and no sale of any kind under any circumstances.
What leaves the school
Where Umeed works with an education department or ministry, what that department receives is counts, not children.
What they get
How many children played, how many completed, how many improved, how many sessions ran, at class, school and district level.
What they do not get
Named children. Individual journal entries. Individual mood records. A named child's emotional record should not sit in a government monitoring database, and we do not propose that it should.
Research
Where a study is agreed, data is aggregated or de-identified before it leaves, under a written agreement, with the approvals that study requires. Nothing is handed over on a handshake.
The companies involved, and what each one touches
Google Firebase
Hosts the database and the adult sign-in. This is where a child's session records are stored.
Google Gemini
The model that writes reports and companion answers for adults, on terms that exclude training on what is sent.
Stripe
Processes payments from adults who subscribe. Stripe holds the card details. We never receive them.
Each is engaged as a processor acting on our instructions. We add suppliers rarely, and this list is updated when we do.
How long any of this lasts
While the account is open
A child's records are kept while their adult's account is active, because the value of the record is the picture it builds over time.
When an account closes
Children's records are deleted within 90 days of the account closing. Aggregate counts that contain no child's identity may remain.
On request, sooner
Ask and we delete. You do not need a reason and you do not need a lawyer. We confirm when it is done.
A child leaving a class
When a child is removed from a class list, their record goes with them rather than staying with the teacher.
The public companion
Nothing typed into the landing page companion is stored against a person, and the conversation is not kept after the tab closes.
Backups
Deleted data can persist in encrypted backups for a short period before those backups rotate out. It is not restored to the product.
What you can ask for, and how
These apply to the adult who holds the account, and to a parent or guardian asking on behalf of a child.
See it
A copy of everything we hold about a child, in a readable form.
Correct it
Fix anything wrong, including a name, an age or a class.
Delete it
Have a child's record removed entirely.
Take it elsewhere
Receive it in a portable file you can hand to someone else.
Withdraw sharing
Stop a child's record reaching a teacher or a school from that point on.
Complain
Raise it with us, and with your national data protection authority where one exists.
Write to privacy@umeedai.com or use the contact form. We answer within 30 days and usually much sooner.
What we hold ourselves to
Umeed is built to the children's privacy standards that apply to the countries we work in, and to the same standards where they do not legally apply. That means COPPA in the United States, GDPR and the UK Age Appropriate Design Code where they reach us, and the data rules of any ministry we work with.
Pakistan has no data protection act in force. Nothing on this page is therefore required of us there by statute. It is what we hold ourselves to anyway, and a school or a department is entitled to hold us to it in writing. If a school or a ministry needs a data processing agreement, we sign one.
Umeed is a learning platform and is not therapy. It does not diagnose, it does not treat, and it does not replace a counsellor or a clinician. Where a child needs more than a learning platform can give, the point of the flag is to get them to a person who can.
How it is protected
In transit and at rest
Everything travels over HTTPS and is encrypted where it is stored.
Adults authenticate, children do not
There is no child login to steal. A play code without the teacher's account behind it opens nothing that identifies a child.
If something goes wrong
If a breach affects a child's data we tell the affected adults and the relevant authority, promptly and in plain language, including what we do not yet know.
When this page changes
We update the version and the date at the top. If a change materially affects what we collect about a child, or who can see it, we tell account holders directly rather than relying on anyone noticing this page.
Questions about anything here: contact us. If something on this page is unclear, that is a fault in the page and we would like to know.