Introduction
Howcomet is a question-and-answer app for children aged 5 to 14. A child asks a question, gets an answer written for their age, and collects a "star" for the things they learn.
- We collect the least we can: a first name or nickname, an avatar, a school year, a four-digit PIN, and the questions the child asks.
- We do not sell data, we do not advertise, and there is no analytics or advertising code anywhere in the child's app.
- A grown-up must consent by email before a child can use the app at all.
- A grown-up can delete everything we hold about their child at any time, from their own page, and we keep no copy.
This policy explains the detail. It is written to be read, not to be survived.
Who this policy is for
Howcomet is used by children but bought and controlled by adults. This policy is addressed to the parent or legal guardian. We refer to that person as "you" and to the child as "your child".
Parental consent before anything
A child can enter their details and choose a name on the tablet, but they cannot use the app until a grown-up has consented. Every part of the service that would collect or show a child's own data is blocked until then.
Consent works like this:
- The child enters an adult's email address at sign-up.
- We email that address a one-time link, valid for a limited period.
- The adult opens the link on their own device and sets a password.
The adult's password is never set on the child's tablet, and the tablet is never given a way to reach the grown-ups' page. That is deliberate: a passcode chosen on the device a child is holding, while they watch, protects nothing.
Until step 3 is completed, a question the child types is not answered and is not stored as a topic.
What we collect
From your child
| What | Why | Notes |
|---|---|---|
| A first name or nickname they type | So the app can greet them and so you can tell siblings apart | Free text. We ask for a first name only, and never verify it |
| An avatar | Their picture in the app | Chosen from a fixed list |
| School year or grade | So answers are written at the right level | A number, not a birth date |
| A four-digit PIN | To sign in on another device | Stored only as a cryptographic hash. We cannot read it back |
A sign-in handle we generate, such as moon-fox-42 |
So a child can sign in without an email address | Generated by us; it contains nothing about them |
| The questions they ask | To answer them, and to show you what they have been curious about | See "Who else sees this data" below |
| What they did in the app | Stars, stardust, completed checks, goals, and when | This is the product |
We do not ask for and do not collect: date of birth, surname, home address, phone number, photographs, contacts, precise location, or any social profile.
From you
Your email address, and a password which we store only as a cryptographic hash. If you subscribe, payment is handled entirely by the Apple app store and we never receive or store your card details.
Automatically
- IP address and basic request information (time, which screen, browser or device type), recorded by our servers. We use these to keep the service running and to stop abuse — for example, to limit how many times a password can be guessed.
- Counts of how much of our AI capacity each account has used. These are numbers only; they contain no question text.
Voice
A child can hold a button and speak a question instead of typing, and can have an answer read aloud.
Both use the speech features built into the device's own operating system. We do not receive, record, transmit or store any audio. Only the text that the device produces reaches us, exactly as if the child had typed it.
Please note that the device's own speech features may be processed by the device manufacturer, on the device or on their servers, under their privacy policy and not ours. We have no control over and no access to that processing.
Cookies and similar technologies
We use no cookies for advertising, analytics or tracking, and we do not track anyone across other websites or apps.
The app stores a small amount of data in your browser or on the device so that a child does not have to sign in every time: their session token and their remembered handle, and, on the grown-ups' page, your session token. These are necessary for the app to work and are not shared with anyone.
Fonts and images are served from our own servers rather than a content delivery network, so that loading a page does not tell a third party that a child is using the app.
How we use what we collect
- To answer your child's questions and build the short quiz that follows.
- To keep their sky of stars, their stardust, and their goals.
- To show you what they have been curious about, and what they are forgetting.
- To email you when a question is refused on safety grounds, and to send you the occasional summary of things waiting for your attention.
- To keep the service working, and to stop misuse — rate limits, daily ceilings, and detecting an account behaving like a script rather than a child.
- To manage a subscription.
We do not use your child's questions to train AI models. We do not build an advertising profile of your child, and we do not sell, rent or trade anyone's personal information.
Who else sees this data
We share personal information only with the service providers we need to run Howcomet, and only for that purpose. They are contractually required to protect it and are not permitted to use it for their own purposes.
| Provider | What they receive | Why |
|---|---|---|
| Anthropic PBC (AI models) | The text of the question, the recent conversation, and a reading level derived from your child's school year | To screen it for safety, and to write the answer at the right level |
| Resend | Your email address, and the message text — which may include your child's first name | To deliver email to you |
| Google Cloud | App and Web, as the host of the service | To run the service |
| Neon.tech | Everything stored, as the host of the database | To run the service |
Two things worth being precise about:
- The AI provider is sent the question, and nothing that identifies who asked it. No name, no handle, no email address, no account identifier, no device identifier. It receives the question, the conversation it belongs to, and one instruction about reading level — "about age 9" — worked out from the school year you chose. A school year is not a birth date and the instruction is not attached to a person; it is how an answer comes back written for a seven-year-old rather than a teenager.
- Emails we send you never contain your child's own words. If a question is refused, we tell you that it happened and ask you to sign in; the text itself stays behind your password. The email does use your child's first name, so that a grown-up with more than one child knows which of them to go and talk to.
We may also disclose information if we are legally required to, or where it is necessary to protect a child from harm.
Your rights as a parent
From the grown-ups' page, signed in with your password, you can at any time:
- See what your child has asked, what they have learned, and any question we refused.
- Delete one child — their questions, stars, stardust, goals and settings.
- Delete your entire account, including every child on it and your own login.
- Withdraw consent, which you do by deleting. If you withdraw consent, your child can no longer use the app.
Deletion is immediate, it cannot be undone, and we keep no copy. We email you a confirmation afterwards, because once it is done there is nothing left to look at.
We never require you to give us more information in order to exercise a right, and we do not make you ask us by email — the controls are in the product. If you would rather write to a person, contact at info@howcomet.com.
How long we keep it
We keep your child's information for as long as the account exists, because the product is a record of what they have learned — a two-year-old star is the point of it.
When you delete a child or your account, the records are removed from our database immediately.
Server logs containing IP addresses are kept for 3 months.
How we protect it
- Passwords and PINs are stored only as cryptographic hashes (scrypt with a per-record salt). We cannot recover them, and neither can anyone who obtains the database.
- Sessions use signed tokens, and a session can be revoked immediately.
- All traffic is encrypted in transit using TLS.
- The text of a child's questions is deliberately kept out of our server logs. The database is the single place it lives, so that deleting it actually removes it.
- Access to production systems is limited to system admin only.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your child's information we will tell you within same week of data breach.
Children's privacy
Howcomet is designed for children under 15 and we treat all of it as covered by the Children's Online Privacy Protection Act. In particular:
- We collect only what the service needs, and never make a child's use of the app conditional on giving us more than that.
- There is no way for a child to send a message to another child, to publish anything publicly, or to be contacted by a stranger. There are no social features of any kind.
- There is no advertising in the app.
- A child cannot make a purchase in the app. Subscriptions are bought by an adult, behind a parental gate.
The full text of the COPPA rule is at https://www.ecfr.gov/current/title-16/chapter-I/subchapter-C/part-312.
Changes to this policy
If we change how we handle your child's information in a way that matters, we will email you and — where the law requires it — ask for your consent again rather than assuming it. The date at the top always reflects the current version.
Contact us
You can contact us at info@howcomet.com.