Privacy & Security

Privacy & Security

Your family’s privacy matters. Here’s how Thriva handles data responsibly.

Our Privacy Philosophy

Thriva is NOT surveillance software. We help families create structure together, not monitor children secretly.

What We Believe

• Children deserve privacy within appropriate boundaries
• Parents need insight, not surveillance
• Data should serve families, not advertisers
• Less data is better than more data

What Data We Collect

Account Information

• Email address
• Family name
• Child names
• Time zone

Device Information

• Device name and type
• Operating system version
• Connection status
• Registration date

Usage Data

• Which apps are used
• Time spent in apps
• Websites visited (URLs, not content)
• Mode status and changes

Task Data

• Task names and descriptions
• Completion status
• Rewards earned

What We DON’T Collect

Never Collected

• Screen captures or recordings
• Keystroke logging
• Message content
• Camera or microphone access
• Location tracking
• Personal files or documents
• Browser history content
• Password information

Why This Matters

Thriva helps with digital wellness, not surveillance. You can understand usage patterns without seeing private content.

How Data Is Used

For the Service

• Displaying status in Parent Portal
• Generating usage reports
• AI assistant personalization
• Schedule enforcement

For Improvement

• Aggregate, anonymized patterns
• Feature usage statistics
• Performance optimization
• Bug identification

Never For

• Selling to third parties
• Advertising or marketing
• Authorized training of AI models on your family’s data
• Research without consent

Data Security

Technical Measures

• All data encrypted in transit (TLS 1.3)
• Database encryption at rest
• Regular security audits
• Secure authentication practices

Access Controls

• Data only accessible to your family
• Support access requires your permission
• Employees have minimal access
• Regular access reviews

Infrastructure

• Secure cloud hosting
• Regular backups
• Disaster recovery plans
• 24/7 monitoring

Children’s Privacy (COPPA)

COPPA Compliance

Thriva is designed with children’s privacy in mind:

• Parental consent required
• Minimal data collection from children
• No advertising to children
• Parental access to child data
• Ability to delete child data

What Children See

Children only access:

• Their own tasks and schedule
• Family calendar (shared events)
• AI assistant (age-appropriate)
• Messaging with parents

When children use the AI assistant — whether they chat with it, or ask the research companion to build a wiki page — their messages or research topics are processed by Anthropic. See AI Assistant and Your Data for details.

Children cannot see:

• Usage reports
• Other family settings
• Billing information
• Other children’s data

AI Assistant and Your Data

Thriva’s AI assistant uses Anthropic’s Claude API to generate its responses. We want to be honest with you about exactly what’s sent.

What’s sent to Anthropic

When you or your child chats with the AI assistant, we build a context “system prompt” and send it along with the message. That context includes:

About your family:

• Family name, time zone, and your stated family values
• Your parenting philosophy and any “AI notes” you’ve written (preferred communication style, strategies that work, additional context)
• Each child’s display name, age, and current mode

About the specific child (when they’re the one chatting):

• Their display name, age, and gender
• Their personal goals and self-identified challenges
• Your written observations about them and any “AI notes” about their personality, communication preferences, or patterns you’ve noticed
• Today’s screen time total, current mode, and top 3 apps used today (summarized — not raw event logs)
• The most recent 20 messages of the current conversation

About the current message: The message itself.

We do this so the AI can give contextual, personalized responses. The richer the context, the more useful the AI — but you should know that your written notes about your child are part of what’s sent. If you’re not comfortable with that, leave the AI Notes fields blank or disable the AI assistant.

What’s NOT sent

• Account passwords, payment information, or billing details
• Other families’ data
• Raw activity logs (we only send summaries)
• App content (what your child typed in another app, websites they read, etc.)
• Anything outside the active AI conversation

How Anthropic handles this data

Anthropic processes the data to generate responses, then handles it according to their own policies. Under our current commercial agreement, Anthropic does not use Thriva conversations to train AI models.

We are working toward a change where Anthropic would delete the data right after responding, rather than keeping it. We’ll update this page when that’s in place.

Anthropic’s full privacy policy: anthropic.com/legal/privacy

The research companion

If you enable the kid research companion for a child, it also uses Anthropic’s Claude API — but it works differently from the AI chat assistant, and it sends less.

What’s sent to Anthropic: only the one sentence your child types as their research topic — for example, “I want to learn about Edinburgh Castle.” That is the whole of it.

What’s NOT sent: unlike the AI chat assistant, the research companion does not send your child’s name, age, profile, goals, the notes you’ve written about them, or any of their activity. It sends the research topic, and nothing else about your child.

Anthropic uses that topic to help build a page in your child’s private research space. Under the same commercial agreement described above, Anthropic does not use this data to train AI models — and the same change we’re working toward (where Anthropic deletes the data right after responding, rather than keeping it) will cover the research companion too once it’s in place.

The companion does not browse the live web today. If we ever turn that on, we’ll update this page before any such processing begins.

Your control

• The AI assistant is opt-in. Each child’s AI access is controlled separately from the AI Chats section of that child’s profile in your Parent Portal — toggle it on or off, pick an age-appropriate conversation style, set a daily message limit, and choose how much of the transcript is kept for you to review.
• You can pause AI assistant access for any child at any time; pausing stops all data flow to Anthropic for that child going forward.
• You can review past AI conversations and clear a child’s AI history at any time from the AI Chats section of that child’s profile. Clearing is permanent and per-child; it does not pause the assistant.
• For account-wide questions or to disable the AI features entirely, contact privacy@thriva.app.

If something goes wrong at Anthropic’s end

If Anthropic discloses a security incident affecting their API, we will:

1. Immediately disable Thriva’s AI assistant for all families
2. Notify affected families directly by email
3. Publish what we know and what we’re doing about it

Data Retention

Active Accounts

Data is retained while your account is active.

After Cancellation

• 90 days to reactivate and restore
• After 90 days, data is permanently deleted
• You can request immediate deletion

Usage History

Usage data older than 2 years is automatically purged.

Your child’s research pages

The pages your child makes in their research space are their own work. Pausing the research companion does not delete them: if you turn it off to take a break, the pages wait safely until you turn it back on.

The pages are permanently deleted — immediately, with no copy kept — only when one of these happens: you use the “Delete all of [child]‘s research pages” action (which asks you to confirm first), you withdraw your consent to AI data processing for that child entirely, your child deletes a page themselves, or the child’s account is removed. Outside those actions there is no time limit and no hidden archive — the pages stay as your child’s own work.

Your Rights

Access Your Data

Download all data associated with your account:

1. Go to Settings → Privacy
2. Click Download My Data
3. Receive a file with all your information

Delete Your Data

Request complete data deletion:

1. Go to Settings → Privacy
2. Click Delete My Account
3. Confirm deletion (cannot be undone)

Correct Your Data

Update any incorrect information in Settings, or contact support.

Third Parties

Service Providers

We use trusted providers for:

• Cloud hosting
• Payment processing
• Email delivery
• Analytics (anonymized)

Integrations

When you connect third-party services:

• Habitica: Task sync only
• Google Calendar: Calendar events only
• Google Classroom: Assignments only

These integrations only share what’s necessary for functionality.

Law Enforcement

We may disclose information if legally required. We will notify you unless prohibited by law.

Contact

Privacy Questions

Email: privacy@thriva.app

Security Concerns

Report security issues: security@thriva.app

Data Requests

For data access or deletion: Contact through Parent Portal

Updates

This information may be updated. We’ll notify you of significant changes via email.

Last updated: June 2026