KidSift privacy notice

Updated 18 October 2026. Contact: support@gstechworks.com.

Photos and face recognition stay on your device

KidSift processes selected photos, person names, face reference images, face embeddings, recognition results and review history locally. These are not sent to the KidSift licensing service or used for advertising or model training. KidSift does not provide cloud synchronization of person profiles or history.

On iOS, references, embeddings, imported photos and the private database are protected on the device and excluded from device/cloud backups. A Share extension copies only the images you explicitly share into a private inbox. Photos stored in Apple Photos or exported to Photos may separately synchronize through iCloud or another photo-backup service according to your settings.

Accounts and payments

Google or Apple sign-in is handled through Firebase Authentication. Firebase processes your provider identity and, when provided, your email/name. The licensing service uses your Firebase account identifier, provider identifier, an installation identifier/public key, store transaction identifiers, product, environment, subscription status and expiry to authorize saving, prevent replay and restore purchases. It never receives payment-card details. Accounts are linked only through an explicit authenticated linking flow.

Google and Apple operate their own sign-in and billing services under their privacy notices. Android purchases are per-phone; Apple purchases cover the purchasing KidSift account's Apple devices. The stores are separate.

Permissions and diagnostics

You choose which photo source KidSift may read. You can change or revoke access in device settings. Photo permissions do not upload your library to KidSift. Service security logs record error categories/status, and infrastructure may process request/network metadata; the application does not log photos, embeddings, person names, source filenames or authentication tokens. There is no advertising SDK or cross-app tracking.

Google's ML Kit SDK processes technical metrics such as device/app details, an SDK installation identifier, processing speed, image format/size and feature/error events for diagnostics and usage measurement. Face recognition still runs locally. Google Sign-In may process an account identifier and network address for authentication and fraud prevention, including an approximate location inferred from that address. Firebase Authentication also processes operational diagnostics. These SDK practices are described by ML Kit, Google Sign-In and Firebase.

Support and access administration

If you submit a support ticket, the service stores its text, your account identifier, platform, app version and conversation status. Please do not submit photos of people, face references, passwords or purchase tokens. Replies are shown inside KidSift. Administrative access decisions and internal support notes are restricted to the owner. Complimentary access and suspension are recorded separately for Android and iOS; changing app access does not cancel store billing.

Resolved ticket content is scheduled for removal after 90 days. Account deletion immediately redacts ticket content and disables complimentary access. Database expiry is asynchronous; administrative audit records remain for one year.

Retention and deletion

Local recognition data stays until you remove it or remove the application. On iOS, in-app account deletion also removes private KidSift data from that device. Android account deletion retains local profiles/history as its confirmation explains; removing the application removes those local files. Public copies you saved to Photos remain under your control.

Account deletion removes Firebase sign-in and revokes registered access. Minimal purchase, account-binding and deletion records are retained to process ongoing store events, prevent reuse of a purchase on another account and meet applicable accounting obligations. Support requests may require identity verification. Operational replay records expire after ten minutes, rate counters after one day, unassigned-purchase review pointers after 30 days, notification/recovery records after 90 days and administrative audit entries after one year. Database expiry removal is asynchronous. Necessary billing bindings do not automatically expire while their replay-protection or billing purpose remains.

For deletion steps and information retained, see Delete your KidSift account. You can use enrollment, scanning and previews without signing in. KidSift is a parental tool intended for adults; do not create accounts for children.