Privacy and child safety
How GooKids handles personal data, protects family privacy and keeps adults in control.
Updated October 24, 2026.
Who is responsible for the data
GooKids is a product developed by Nexo Base (Brazilian company ID CNPJ 41.635.480/0001-44), which determines the purposes of processing described on this page. For purposes of Brazil's LGPD, the company acts as the data controller. Contact nexobasetech@gmail.com with privacy questions and requests.
Data processed today
Adult accounts use email and Supabase authentication. After guardian authorization, a child’s nickname, age, permissions and progress are stored in Supabase and linked to the family account. Drawings remain on the device unless downloaded by the family. Stripe handles new purchases; Mercado Pago maintains earlier charges; GooKids does not store card details. Google Analytics runs only on public pages after consent, without child profiles or progress. Hosting providers may process technical logs needed for operation and security.
Purposes and legal bases
Account data enables authentication, account recovery and subscription management. Nicknames, ages, permissions and completed activities organize profiles and let families follow progress across devices. Creating a profile requires the guardian’s explicit acceptance of the privacy policy and terms. Each purpose must observe its applicable legal basis and the child’s best interests; a single basis is not assumed to cover all processing.
Children and family involvement
Accounts are intended for adult guardians, who create profiles, choose age bands and supervise use. Prefer nicknames and do not provide sensitive information. Bible content requires specific permission for the selected profile. Completion records indicate participation, not an educational assessment or diagnosis.
Where data is stored and shared
Supabase authenticates adults and stores profiles, permissions, progress, subscriptions and editorial media. Vercel hosts the app. Stripe handles new adult purchases; Mercado Pago maintains earlier charges. Google Analytics receives public-page navigation only after consent. OpenAI receives topics and instructions submitted by authorized editors to prepare story, quiz and illustration drafts; the app does not automatically send child profiles or progress to AI. Generated content requires editorial review before publication. We do not sell personal data.
Local storage, cookies and PWA
Session cookies maintain authentication. A cookie identifies the active family profile; measurement choices are stored in this browser and can be changed in Cookie preferences. Declining measurement does not prevent use. The PWA caches static files and an offline page; it does not cache account, game or administration pages. Clearing browser data may end the session but does not delete account records from Supabase.
Retention and deletion
Profiles, permissions and progress remain linked to the account while needed to deliver the service and meet applicable obligations. Deactivating a profile removes it from selection but is not permanent deletion. To request access, correction, deletion or account closure, email nexobasetech@gmail.com from the registered address. Do not send passwords or sensitive information. Records subject to legal retention duties may need to be kept for the applicable period.
Data subject rights
Within the limits and conditions of the LGPD, data subjects may request confirmation of processing, access, correction, anonymization, blocking, deletion, portability where applicable, information about sharing and review of automated decisions. Consent may also be withdrawn when it is the legal basis, without affecting prior lawful processing. Requests regarding a child must be made by their legal guardian. The Brazilian Data Protection Authority (ANPD) explains rights and petition procedures on its official portal.
Security and changes
We use technical controls available in the application and with providers to reduce risks of unauthorized access, loss or alteration. No internet-connected service can promise absolute security. If there is a material change to data, purposes, providers, synchronization or AI features, this policy will be updated before the new practice takes effect.
Contact about your data
Adults may send privacy and LGPD requests to nexobasetech@gmail.com. Use the email linked to your account when applicable. Never send your password.