Privacy

Keenling is built and run by Early Bright Global LLC. Keenling is offered to people in the United States. It is not offered in the European Union or the United Kingdom — see where Keenling is offered below, including an honest note about what that does and does not mean today.

From you, when you sign in

• Your email address. That is the account.
• If you continue with Google: we ask Google for your basic profile and email. The only thing we save is your email address. We do not store your Google name, your profile picture, your Google ID, or a token that would let us do anything else in your Google account.
• If you use an emailed sign-in link instead: we store the one-time link token alongside your email address until you use it or it expires. A nightly job then deletes the record entirely.

About your child, when you set up a profile

• Their first name.
• Their birth month — the month and year only, for example 2022-04. We never ask for the day, and there is nowhere to type it.
• One to five interests, typed by you.
• How much time you realistically have: 30 seconds, 5 minutes, or 15 minutes.
• Two focus areas, chosen from a fixed list.

That is the entire child profile. There is no field for a last name, a full birthday, a photo, a school, a diagnosis, a height, a weight, or a milestone. This is deliberate and we intend to keep it that way: the smaller the profile, the less there is to lose, and the less any future breach or mistake could matter.

As you use Keenling

• The missions generated for your child, including the concept, the words to say, and the illustration.
• Your answer to each mission: clicked, meh, or not today.
• Which length you chose — easy, medium, or hard.
• Why you rerouted a mission, chosen from a fixed list: in the car, during a meal, bath time, bedtime, outside, low energy, no materials, thirty seconds. Never free text.
• Why you swapped away from a skill, also chosen from a fixed list.
• Parent notes: free text, up to 500 characters, saved exactly as you type it.
• If you turn on notifications: the push address your browser issues, plus the two keys needed to encrypt messages to it.

Automatically

• Two cookies. One signed session cookie that keeps you logged in for 90 days, and one short-lived cookie that protects the Google sign-in flow for ten minutes. Both are read only by the server. Neither tracks you anywhere else.
• Ordinary web-server request logs kept by our hosting provider, which include IP addresses. We use them to keep the service running and to debug failures.
• A short-lived, in-memory count of requests per IP address, used to rate-limit anonymous page-view events. It is never written to the database.

The parent note is the one place in Keenling where you can type anything you like, and we save it exactly as written. It is also part of the context sent to the model that writes tomorrow’s mission, and it is visible to us on an internal dashboard when we are debugging or improving missions.

So: first names only, please. Keenling works perfectly well without a surname, a school, a clinician, an address, or a medical detail, and none of those belong in a beta product’s free-text box.

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising. This is a hard commitment, not a current practice we might revisit quietly.
• We do not show ads and we do not run advertising or analytics scripts from other companies.
• We do not build a profile of you for anyone else, and we do not enrich your data with information bought elsewhere.
• We do not collect anything from your child. Your child has no login, no screen, and no way to type, speak, or photograph anything into Keenling.
• We do not record audio, video, or photographs of anyone.

Keenling is a small product built on other companies’ services. Below is the complete list of companies that handle any part of your data, and precisely what reaches each one. There is nobody else — no advertising network, no data broker, no customer-data platform, no analytics vendor.

We would also hand over data if the law genuinely required it, and if Keenling were ever sold or merged, your data would move with it. We would tell you before that happened.

Keenling counts a small number of product events in its own database. Nothing is sent to a third-party analytics service, because there isn’t one.

The complete list of events we count:

• Landing page viewed; a sign-in method chosen; a sign-in attempt failed; a sign-in link requested; sign-in completed; the app opened.
• Onboarding completed; a mission viewed; an outcome recorded; a difficulty changed; a mission rerouted; a weekly report viewed; a caregiver invited.

Each event may carry an account id and at most six named values, and nothing else survives the filter: the sign-in method, the difficulty level, the outcome, an internal reason code, whether the mission came from the model or the built-in set, and a rough bucket for how many children are on the account. Every value is truncated to 80 characters.

This is enforced in code, not by policy: anything not on that list of six is discarded before the event is written. Your child’s name, your notes, their interests, and the text of any mission cannot reach analytics, because there is no field they could travel in.

Being straight with you: most of what Keenling holds has no automatic expiry date yet.

Missions, feedback, notes and product events are kept for as long as your account exists. We are not going to write a retention period here that the code does not enforce.

One thing does now expire on a schedule. A job runs every night and deletes every sign-in link that has been used or has passed its 30 minutes — the row itself, not just its ability to log you in. This matters most for people who never became users at all: if you once asked for a link and never opened it, you had no account, and therefore no way to ask us to delete anything. Now nothing is left to delete.

What we do commit to, and can keep with what exists today:

• Deleting a child profile is immediate and permanent, and takes every mission, note and piece of feedback recorded against that child with it — along with the illustrations drawn for those missions, which are removed from storage first.
• Deleting your account is a button in the app. It removes your email address, every child, every mission, note and rating, your notification subscriptions and every sign-in link issued to you — immediately, and with a confirmation step you have to type your own address into.
• Sign-in links stop working 30 minutes after they are issued, and again the moment they are used — and the record of the request is deleted by a nightly sweep, so the email address you typed into the sign-in box does not outlive the link.
• Dead notification subscriptions are removed automatically the first time your browser tells us they are gone.

A written retention limit that expires old missions and old notes on a schedule is something we intend to add. Until it exists, this page will keep saying that it does not.

The full picture of what deletion removes, and what it does not, is on the deleting your data page.

A very small team. We have an internal dashboard, protected by a password, that shows account email addresses, children’s first names, the feedback families give, and parent notes. We use it to see whether missions are landing and to fix things that break. We do not browse it for entertainment, and we do not export it anywhere.

• The site is served over HTTPS.
• Your session cookie is signed, is not readable by JavaScript in your browser, and is marked secure in production.
• Sign-in links are single-use, expire in 30 minutes, and are claimed atomically so the same link cannot be used twice.
• Mission illustrations are only served after we check the mission belongs to your family.
• Notification subscriptions are never transferred between accounts, so nobody can capture your device’s notifications.
• The internal dashboard denies all access if its password is not configured, rather than opening itself.

None of that makes a system perfectly secure, and it would be dishonest to say otherwise. Keenling is an early product built by a small team. The strongest protection we have is that there is very little here to steal — which is exactly why the profile is as small as it is.

Keenling is a service for adults. Your child does not have an account, does not sign in, and never interacts with the product. Every piece of information Keenling holds about a child was typed by their parent or caregiver, not collected from the child.

We do not knowingly collect personal information from children, and we do not operate a service directed to children. If you believe a child has somehow provided information to us, email [email protected] and we will delete it.

This is also why we ask for a first name and a birth month rather than a full name and a date of birth. It is not a design accident, and we are not going to quietly expand it in a future version of the signup flow.

Keenling is offered to people in the United States. It is not offered in the European Union or the United Kingdom. We do not price in other currencies, do not translate the product, do not market it outside the United States, and your data is stored and processed in the United States.

Honest caveat: today this is a term of the service, not a technical block.

We do not currently refuse sign-ups by IP address. If you are in the EU or the UK, please do not use Keenling. If you already have, email us and we will delete your account.

• Stop the emails: every email has a one-click unsubscribe link, and it works immediately.
• Turn off notifications: from your browser’s site settings, or by removing permission for keenling.com.
• Delete a child: inside the app, at the bottom of today’s mission. It is immediate and permanent.
• Delete your whole account: in the app, under Account. It asks you to type your email address first, then removes everything at once.
• Get a copy of your data: email [email protected] from the address you signed up with, before you delete — deletion is permanent and we cannot get it back afterwards.
• Correct something: you can edit a child’s profile in the app at any time.

Wherever you live in the United States, we will honour these requests. We are not going to make you prove that your state has a law about it first.

If we change this page we will change the date at the top, and if the change is material — a new company handling your data, a new category of information, anything narrowing what we promise here — we will email the families using Keenling before it takes effect.

This version is dated 7 August 2026.