Privacy policy

Updated on October 15, 2026

Kometas helps families organize children’s routines. This policy explains how we use personal data on the kometas.app website and in the app, under the Brazilian General Data Protection Law (LGPD).

1. Who is responsible for your data

Kometas is a BahLabs product. The data controller, which decides how data is used, is [BAHLABS LEGAL NAME], Brazilian corporate tax ID (CNPJ) [BAHLABS CNPJ], with a business address at [BAHLABS BUSINESS ADDRESS]. Contact details are in section 8.

2. App data and its purposes

• Adults: name, email, and authentication data to create and access the account, including through Sign in with Apple or Google. We also store the family’s plan. The stores process payments; we do not receive card details.
• Family: name, settings, members, and their roles to organize shared use, along with a record of who authorized the processing of children’s data and when.
• Children: nickname, age, avatar, and gender, if provided, to personalize profiles and text. We store missions, stars, rewards, achievements, goals, piggy bank amounts, and optional photos to track activities.
• Technical information: device model, time zone, and preferences for the app to work; authentication events, including date, time, and IP address, to keep accounts secure.
• Support: email, identification details, messages, and attachments you send so we can answer your questions and requests.

Adult accounts and support rely on performance of the contract or steps requested before entering into a contract. Child profiles and activities rely on consent from a parent or legal guardian. Security relies on legitimate interests, limited to what is necessary and the child’s best interests. We also process data to meet legal obligations.

Stars, progress, and piggy bank amounts are calculated according to the family’s activities and rules. The piggy bank records agreed amounts: it does not move money or connect to banks.

3. Children, consent, and permissions

Only adults create accounts. A child uses a family profile, without an email, password, or phone number. Before adding a child, the adult receives information about the data and its purposes, declares that they are a parent or legal guardian, and authorizes processing on a dedicated screen. We record the authorizing account, date, and time, linked to the family.

You can withdraw permission in Settings › Children’s privacy. This deactivates child profiles in the app. To request a copy of data or its deletion, use the contact in section 8.

Mission photos require separate permission from a parent or legal guardian. The camera is used for these photos and to scan the access QR code. Children only interact with their own family; there are no public profiles or contact with strangers. We do not use children’s data for advertising.

Biometrics are verified by the device; we do not receive biometric data. Read-aloud features and reminders also run on the phone itself. The app does not request access to location, contacts, or the microphone.

4. Website, cookies, and communications

For the waitlist, we collect your email, language, the form used, date, and permission to send communications. We only send the messages you agreed to when signing up: a launch notification, or news as well. You can withdraw consent through the link in our emails or our privacy contact.

Hosting, fonts, and bot protection receive technical data, such as your IP address and browser. Necessary cookies support security; the language preference lasts for one year.

With your permission, we use Google Analytics 4 to measure visits, scrolling, outbound clicks, and completed sign-ups. It receives browsing information, visit source, language, technical data, and cookie identifiers. We do not send waitlist email addresses or children’s data to Analytics, and we do not use advertising cookies.

You can keep using the website and waitlist if you decline analytics. You can change your choice under “Cookie preferences” in the footer. Withdrawing permission stops measurement and removes the website’s analytics cookies. Your choice is saved for 180 days. See how Google handles this data.

5. Sharing and data outside Brazil

Invited adults access children’s data according to their family roles. We use providers for hosting, databases, authentication, storage, email, fonts, and security, with the data needed for each service. Anyone acting on our behalf must follow our instructions and protect the information; BahLabs is responsible for decisions about processing.

Apple and Google are involved in your chosen sign-in method and store subscriptions, under their own policies: Apple and Google. Analytics requires the permission described above. We also share data to meet legal obligations or valid orders from authorities.

The app’s database and email service store data in the United States. Other services may process data in [DESTINATION COUNTRIES]. Transfers use encrypted connections to provide these services, for the periods in section 6, with [TRANSFER MECHANISMS AND SAFEGUARDS].

You can request the list of providers, recipients, countries, responsibilities, protective measures, and copies of applicable contractual clauses through the contact in section 8. Your rights remain available when data is processed abroad.

6. How long we keep data

• Account and family: for as long as needed for the service. Deleting the account removes the adult’s registration. If the family administrator leaves, administration passes to another parent or legal guardian; if none remains, the family’s profiles and history are deleted.
• Photos: the standard retention period is 30 days after a mission is completed, with deletion during the next daily cleanup. Photos from deleted families are also included in automatic cleanup. You can request earlier deletion through our privacy contact.
• Waitlist: until you withdraw consent or ask to leave the list.
• Website analytics: cookies for up to 180 days; in Analytics, events for 2 months and user data for 14 months, with renewal when there is new activity. Aggregated reports may be kept for longer.
• Authentication logs: up to 6 months, with daily cleanup, including after account deletion.
• Support: for as long as the messages are needed to handle your request and meet applicable legal obligations.
• Recovery copies: previous versions of the waitlist remain available for up to 7 days. In the email service, messages remain in the trash for up to 30 days, according to the service settings, and can be recovered for a further 30 days after leaving the trash.

Data required by law may be retained for the applicable period, with access restricted to that purpose. If this prevents a requested deletion, we explain the reason and the retention period.

7. How we protect data

We use encrypted connections and access controls to limit data access to each family and its members’ roles. The adult area can be protected by biometrics. If an incident could pose a significant risk to families, we will notify affected people and Brazil’s National Data Protection Authority (ANPD), as required by law.

8. Your rights and contact details

You can confirm processing, access or correct data, request a copy, portability, anonymization, restriction, or deletion, learn about sharing, and withdraw consent. You can also request information about the consequences of not consenting and a review of automated decisions that affect your interests, where applicable.

To exercise these rights, including on behalf of children under your care, contact the data protection officer at [email protected]. Requests are free, and we respond within 15 days. We may ask for information to confirm your identity and your authority to represent the child. You can also lodge a complaint with the ANPD. Account deletion is available in account settings.

When this policy changes, we update the date at the top. Significant changes are communicated through the app or by email before taking effect, with renewed permission where necessary.