AI Sidekick Privacy Policy

Effective date: 3 September 2026 · Policy version 2026-09-03

1. Who we are

AI Sidekick ("the app", "Sidekick") is a voice-first AI companion for children aged 6 to 10. It is operated by Lunera AI Solutions FZC (WadZar AI Solutions), Sharjah, United Arab Emirates ("we", "us"). Privacy questions and requests: privacy@lunera.solutions.

The app is directed to children under 13. Because of that, we collect the smallest amount of information we can, we never show advertising, we never sell personal information, and a parent or guardian must create the account and give consent before a child profile can be used.

2. Sidekick is an AI, not a person

Sidekick's replies are generated by an artificial-intelligence language model. Sidekick is not a human, cannot form real relationships, and can make mistakes. The app says this to children in its own words during setup and on the chat screens, and it reminds them to take a break after continuous use.

3. Two ways to use the app

• Guest mode (no account): a grown-up confirms they are an adult, then anyone can chat. Guest conversations are held in the server's memory for at most one hour and are never written to our database. Messages are still sent to our AI provider to generate replies (see section 6).
• Family account: a parent registers with an email address and password, creates one or more child profiles, and gives the consents described in section 8. With a child profile active, conversations are stored so parents can review them and safety alerts can work.

4. Information we collect

About the parent

• Name, email address, and a hashed password (we never store the password itself).
• A consent record: the date and time you accepted this policy and the Terms, the policy version, and the IP address the acceptance came from.

About the child (family accounts only)

• Profile: first name or nickname, age or birthday, avatar and character choice, voice choice, difficulty level, daily time limit, and an optional 4-6 digit PIN (stored hashed).
• Conversations: the text of every message the child sends and every reply Sidekick gives, including transcripts of what the child said in voice mode, with timestamps and the mode used (chat, game, story).
• AI-derived profile notes: after conversations, an AI model reads the transcript and records short notes so Sidekick can remember the child between sessions: interests, favourite animals, foods, shows, colours and toys, things the child is afraid of, personality notes, and "fun facts" the child mentions such as a birthday, siblings, school, or recent events. Parents can see and delete these notes.
• Session summaries written by an AI model for the parent dashboard.
• Safety alerts: when a message matches patterns for distress, bullying, abuse or self-harm, we store an alert for the parent containing the alert type and up to the first 200 characters of the child's message.
• Stories generated in story or bedtime mode, and the child's favourites.
• Reports the child or parent submits about a reply (the reply text and a reason).
• Usage events: which feature was used, mode, message length, response time, error status. These events are filtered on the device and on the server so that they never contain message text, transcripts, names, email addresses or audio.

Voice

• Talking to Sidekick: when the child uses the microphone, the recording is sent to our speech-to-text provider (OpenAI Whisper), turned into text, and the audio is deleted from our server immediately. We keep the text as a message (family accounts) or in memory only (guest mode).
• Voice cloning (optional): a parent may record a short voice sample so Sidekick can speak in that voice. The sample is sent to ElevenLabs, which creates a voice model. We do not keep the sample on our servers. The voice model stays at ElevenLabs until the parent deletes the voice or the account. Only the family that created a cloned voice can see or use it.

Technical data

• Crash and error reports (Sentry): app version, device model and operating-system version, the part of the app that failed, and a random installation identifier. Request bodies are removed on our server before anything is sent, so crash reports never contain chat text.
• IP addresses are used in memory to limit abuse (rate limiting). They are not stored in our database; a shortened form may appear in server logs kept for a rolling buffer of at most 50 MB per service, which is normally two to four weeks of traffic, after which the oldest entries are overwritten.

What we do not collect

No advertising identifier, no location, no contacts, no photos, no payment details. The app does not contain advertising or in-app purchases, and the Android build blocks the advertising-ID permission.

5. How we use information

• To generate Sidekick's replies, stories and games, and to let Sidekick remember the child between sessions.
• To give parents a dashboard of activity, summaries, alerts and reports.
• To keep children safe: input filtering, automated content moderation, alert detection, and daily time limits.
• To keep the service working: crash reports, rate limiting, and aggregate usage metrics.
• We do not use children's information for advertising, profiling for marketing, or selling to anyone.

6. Service providers that process information for us

These providers act on our instructions and may not use the information for their own purposes. We do not share personal information with anyone else, except if required by law or to protect a child's safety.

7. Retention and deletion

• Family-account data is kept while the account exists.
• Deleting a child profile (Settings) immediately deletes that child's messages, sessions, stories, favourites, alerts, usage events, profile notes and any cloned voice created for that child, including the voice model at ElevenLabs.
• Deleting the parent account (Settings → Delete account, or by email, see /delete-account) immediately deletes everything above for every child plus the parent record and consent record. Database backups are held on encrypted storage and deleted within seven days.
• Guest-mode conversations are never stored and expire from memory within one hour.
• Server logs (no message text) are kept for a rolling buffer of at most 50 MB per service, which is normally two to four weeks of traffic, after which the oldest entries are overwritten.

8. Children's privacy and parental consent

We comply with the U.S. Children's Online Privacy Protection Act (COPPA) and, where they apply, the EU and UK GDPR rules for children and Canada's PIPEDA. In particular:

• Only an adult who confirms they are the child's parent or legal guardian can create a family account.
• At registration the parent gives separate, explicit consent to (a) the collection described in this policy and (b) sending the child's messages and voice to the providers in section 6. Consent is recorded with a timestamp and policy version. If this policy changes materially, the app asks for consent again before the child can continue.
• Parents can review their child's information in the parent dashboard, delete individual profile notes, delete a child profile, delete the whole account, or refuse further collection by stopping use of family accounts.
• To exercise these rights by email, write to privacy@lunera.solutions from the registered address. We may ask for additional verification before acting on a request. We respond within 30 days.
• The app never asks a child for their full name, address, phone number, email or photo, and input filtering blocks common personal-information patterns before a message is sent to the AI.

{{LAWYER_REVIEW: EU/UK age-of-consent thresholds (13-16), UK Age Appropriate Design Code, Quebec Law 25, and any additional state laws should be confirmed by counsel before production launch.}}

9. Safety features and what parents are told

• Every message is checked by an automated moderation service before Sidekick answers. Messages that are flagged get a neutral redirect instead of an AI reply.
• If a child says something suggesting they may hurt themselves or that someone is hurting them, Sidekick gives a fixed, reviewed message encouraging them to talk to a trusted grown-up, and the parent receives an alert in the dashboard. We do not contact emergency services ourselves.
• Children and parents can flag any reply from inside the app. Reports go to us and appear in the parent dashboard.
• Sidekick reminds children to take a break after continuous use, and parents can set a daily time limit.

10. Security

All traffic uses HTTPS. Passwords and PINs are stored hashed. Access to the database is limited to the operators of the service. No system is perfectly secure; if we learn of a breach affecting children's data we will notify affected parents and, where required, regulators.

11. Where information is stored and sent

We operate from the United Arab Emirates. Our servers and database run in the United States (Oracle Cloud Infrastructure, us-ashburn-1), and our service providers process information in the United States and the European Union. If you use the app in the European Economic Area or the United Kingdom, your information is therefore transferred outside that area. We rely on the European Commission's Standard Contractual Clauses, and the UK Addendum where it applies, in our contracts with those providers, and we send them only what the app needs to work. You can ask us for details at privacy@lunera.solutions.

12. Your rights (all users)

Depending on where you live you may have the right to access, correct, delete or export personal information, to object to or restrict processing, and to complain to a data-protection authority. Contact us at privacy@lunera.solutions.

13. Changes to this policy

We will post changes on this page with a new effective date and policy version. For material changes affecting children's data, parents must re-consent in the app before a child profile can be used again.

14. Contact

Lunera AI Solutions FZC (WadZar AI Solutions)
Sharjah, United Arab Emirates
privacy@lunera.solutions