Privacy Policy
Effective date: November 11, 2026
Operator: HavenLabs LLC, 922 E 670 N, Ogden, UT 84404, USA
Contact: support@firesideai.app
Fireside is a family AI assistant. A parent or guardian creates the account, sets the household's values and boundaries, and adds their children. Children then chat with the assistant, and every message and every picture passes through those boundaries before it reaches them.
This policy says what we collect, why, who sees it, how long we keep it, and what you can do about it. We have tried to write it so a parent can read it in five minutes.
The short version
- The parent owns the account. Children never create accounts, never give us an email address, and never agree to anything.
- We collect what the product needs and nothing for its own sake. No advertising, no analytics trackers, no selling or sharing of data for marketing. Ever.
- A child's chat is sent to our AI provider (OpenAI) to be screened and answered. We have applied to have OpenAI hold it for zero days; until that is granted, they hold it under their standard policy (see "Our providers").
- Parents can see what happened, delete a child's history, or delete everything. Deletion from our database is immediate and complete; what our providers keep is listed under "How long we keep it".
What we collect
From the parent, when you sign up
- Your name and email address.
- Your password, stored only as a hash. We cannot read it.
- If you sign in with Google or Apple: your name, email address and, from Google, your profile picture's web address, plus the sign-in tokens Google or Apple issue so the sign-in keeps working. We do not use those tokens to read anything else from your Google or Apple account.
- For each sign-in session: the IP address and the browser or app that signed in. This is standard session security so we can spot a stolen session; it is not used for anything else.
About your household, when you set it up
- The values you choose for each topic (bodies, dating, violence, faith, language, substances, money), any beliefs you describe, and the house rules you write. These are instructions to the assistant and they are stored as you wrote them.
- For each child: a first name (or nickname), an age, and a colour. We do not ask for a child's surname, birthday, photo, school, or anything else.
From a child, while they chat
- The messages the child types, and the assistant's replies.
- Pictures the child asks for, and the pictures that are generated.
- Photos and files the child adds to a message, if the parent has turned "Photos and files" on for that child (it is off by default). A photo is re-drawn before it is kept, which removes everything but the picture itself, including any location the camera wrote into it. From a file (PDF, Word or plain text) we keep its name and its text, up to about 20,000 characters. Both are kept with the message and deleted with it.
- If the parent has turned "Web search" on for that child (off by default): the titles and web addresses of up to five sources the assistant used for an answer, kept with the message. The search itself is run by OpenAI.
- When each message was sent.
A child may type something personal into a chat: a friend's name, what happened at school. We do not ask for it and we do not extract it, but it is part of the transcript, and the transcript is stored and handled as described below.
Automatically, as the product works
- Safety records. For every turn, a record of what the safety layer decided (allowed, guided, redirected, blocked, or crisis), which rule or household setting applied, and whether a parent was notified. These records contain no message text. They are what the Notices page is built from.
- Device records. When you set up a child's phone, a token is created for that phone. We store a hash of it, the label you gave the phone, and when it was last used, so you can see and revoke it.
- Chat recaps. If memory is on for a child, the assistant keeps a short summary of each of their conversations (a few sentences: the plans, goals and questions in it), so it can carry a plan from one chat into another. A recap is never made from a message the safety layer stopped, and it is deleted as soon as any of its conversation's messages are.
- Plan records. If you buy a paid plan: which plan, where it was bought (the website, the App Store or Google Play), and when it renews or ends. Payment details stay with Stripe, Apple or Google.
- Usage counts. For each child, a count of messages and pictures per day; for the household, a running total of what the day's AI use has cost us. Together they keep usage within the plan's daily allowance. Numbers only.
- Server logs. Errors and request paths for keeping the service running. Our logging is written so that message content never appears in a log.
What we deliberately do not collect
- No location. No contacts. No microphone access.
- The app uses the camera for two things only, and only when the person holding the phone chooses to: taking a photo of homework to add to a message (where the parent allows it), and scanning the sign-in code that opens a child's chat on a computer. A scanned code is used once and not kept. The app also opens the phone's own photo and file pickers when a child chooses to add one; it never reads the photo library by itself.
- No advertising identifiers, no analytics SDKs, no third-party trackers, in the app or on the website.
- No data from anyone under 18 except what is described above, through a parent's account.
Why we use it
| Data | Used for |
|---|---|
| Parent name and email | Signing in, verifying your address, password resets, and the safety notices described below. |
| Household values and rules | Shaping every one of the assistant's answers to your children. |
| Children's names and ages | Addressing the child, and setting age-appropriate limits. |
| Transcripts | Answering the child (the assistant needs the recent conversation for context), showing the child their own recent chat, and letting you review it. |
| What the assistant remembers about a child | A short list of plain facts the child has told it about themselves (a grade, a pet, a hobby), so answers fit them. Never a rule or an instruction. The child sees the list and can delete any line; so can you, and you can turn memory off for each child. |
| Chat recaps | Letting the assistant pick up a plan or goal from the child's other recent chats. Not shown in parent views, and not made when memory is off. |
| Safety records | The Notices page; the emails that tell you something needed your attention. |
| Device records | Letting you see which phones are set up and revoke one. |
| Plan records | Giving the household the allowance it paid for, and showing you your plan. |
| Usage counts | Keeping each child's use within the plan's allowance. |
We do not use any of this to train AI models, to build profiles, to advertise, or to measure "engagement". We do not sell it and we do not share it for marketing.
Safety notices to parents
When the safety layer intervenes in a way you should know about (a child tries to talk the assistant out of its rules, a locked protection blocks something, a sensitive topic comes up, or a child says something that suggests they may be in danger) we record it and, for the serious cases, email you. The email says what kind of thing happened and which child; it never contains the child's words. If a child's message suggests they may be at risk of harming themselves, the assistant answers with the 988 Suicide & Crisis Lifeline and encourages them to talk to you, and you are notified.
One kind of message is never shown to parents. If a child tells the assistant that someone is hurting them, it points them to the Childhelp National Child Abuse Hotline and to a trusted adult, and that message, the reply, and the safety record of it are kept from every parent view: no notice, no email, and no line in the conversation history. We do this because the person hurting a child can be someone at home. We keep these records like any other (messages for as long as you have chosen to keep chats, safety records 12 months). Our crisis protocol is published at firesideai.app/crisis-protocol.
A child can also report any answer themselves, from the answer itself. A report is recorded the same way, as a safety record without the words, and reaches you as a notice and an email.
Our providers
We run on a small number of services. Each receives only what its job needs.
| Provider | What it does | What it receives |
|---|---|---|
| OpenAI | Screens each message, writes the assistant's reply, reviews and generates pictures. | The child's first name and age, the child's message and the recent conversation, the household's settings, beliefs and house rules as instructions, the facts the assistant has noted about the child and recaps of their other recent chats (if memory is on), and pictures, and the photos and file text a child adds. When web search is on for a child, the search runs through OpenAI's own search tool. Also a one-way hash of the household id (never a name or email) so OpenAI can flag abuse without knowing who you are. |
| Neon | Hosts our database. | Everything in "What we collect", encrypted in transit and at rest. |
| Vercel | Hosts the website and the service. | Requests and server logs (no message content). |
| Upstash | Holds the usage counters. | A household id, a child id and a number. |
| RevenueCat | Keeps track of paid plans, wherever they were bought. | The household's id (never a name), and the plan, store, and renewal and expiry dates of a purchase. For a purchase on the website, also the parent's email address. |
| Stripe | Takes payment for plans bought on the website. | The parent's email address and payment details, entered on Stripe's own checkout. We never see a card number. |
| Resend | Sends our emails. | Your email address and the text of the email (never a child's words). |
| Apple App Store, Google Play, Expo | Distribute and update the app; Apple and Google also take payment for plans bought in the app. | Standard app-store data governed by their own policies; nothing from inside your household. |
About OpenAI specifically. OpenAI's published policy for its API is not to train on what is sent to it, and to keep abuse-monitoring logs for up to 30 days (checked September 26, 2026). We have applied for zero data retention, under which OpenAI keeps nothing after answering. Until it is granted, the product is offered to families with children 13 and older.
How long we keep it
| Data | Kept for |
|---|---|
| Transcripts (messages and pictures) | 1 year, or a shorter time you choose (30 days, 90 days or 6 months, under Account settings), then deleted automatically (a job runs once a day). If you shorten it, older chats are deleted at the next daily run. |
| Chat recaps | Until any message in their conversation is deleted, then deleted with it. |
| What the assistant remembers about a child | As long as the child's profile exists; any line can be deleted at any time by the child or by you. |
| Safety records (no content) | 12 months, so the Notices page has a history. |
| Account, household settings, children's profiles, device records | As long as the account exists. |
| Sign-in sessions | 30 days from last use, then deleted by the daily job. |
| Plan records | As long as the account exists. Stripe, Apple and Google keep their own payment records under the law that applies to them. RevenueCat keeps the household's id and its purchase history after the account is deleted, under its own retention; it holds no name and, for app-store purchases, no email. |
| Emails we sent | Resend keeps its own log of emails sent (address and text) for a limited time under its own policy. |
| Usage counts | About a day. |
| Server logs | One day, on our host's current plan. |
Delete a child: removing a child's profile deletes their transcripts, what the assistant remembers about them, their safety records and device tokens immediately.
Delete the account: deleting your account (Dashboard, Your account, with your password) deletes the household, every child, every transcript, every safety record and every device, at once. There is no soft delete and no recovery window. Backups held by our database provider expire within seven days. Deleting the account does not cancel a paid plan; cancel it where you bought it first. What our providers keep after that is in the table above. Delete your data has the steps, including how to ask us by email.
What parents can do
- See what happened: the Notices page lists every intervention, without the child's words (except the one kind of message described under "Safety notices to parents", which is never shown to parents).
- Review a child's chat: from the dashboard, open a child. What you see starts from their age: under 13, the whole conversation; 13 to 15, each exchange as a line (when, what it was about, how it was answered) without the words; 16 and over, only the alerts. You can change this for each child, either way, from their page. Alerts reach you whatever you choose. The child is told what you can see under their own message box.
- Choose how long chats are kept: 30 days, 90 days, 6 months or 1 year (the default), for the whole household, under Account settings.
- Change the rules: values and house rules can be changed at any time and apply to the next message.
- Revoke a phone: a device you set up for a child can be revoked from the dashboard; the phone stops working immediately.
- Delete a child, or delete everything: described above.
- Ask us anything: support@firesideai.app. We answer within 5 business days.
Children
Children do not create accounts and cannot sign up. A child can use the product only on a device a parent has set up, inside a household a parent created. Creating the account and setting up a child is the parent's consent for us to collect, from that child, what is described in "From a child, while they chat", and nothing more.
We collect from a child only what is needed to answer them. We do not ask children for personal information, we do not let the assistant ask for it (sharing contact details or arranging to meet is one of the locked protections), and we never contact a child directly.
A parent can review the information collected from their child (except a message in which the child says someone is hurting them, as described under "Safety notices to parents"), have it deleted, or withdraw consent by deleting the child's profile or the account, at any time, as described above. We will not condition a child's use of the product on providing more information than is needed.
To start, the product is offered to families with children aged 13 and older.
Security
Passwords and device tokens are stored as hashes. All traffic is encrypted in transit. Secrets live on the server, never in the app. The safety layer runs on the server, so a modified app cannot turn it off. If we ever discover a breach affecting your data, we will tell you within 72 hours of confirming it.
Changes
If this policy changes in a way that matters, we will email the parent on the account before the change takes effect. The current version is always at firesideai.app/privacy.
Contact
HavenLabs LLC
922 E 670 N, Ogden, UT 84404, USA
support@firesideai.app
See also the Terms of Service.