Privacy policy
Last updated: 12 October 2026
Heart Steps is a values-learning app for children aged 3 to 8, made by hivup ("hivup", "we", "us"). We built it for families, so we keep the information it uses to the minimum it needs, we never sell it, and we never show ads. This policy explains, in plain language, what information Heart Steps uses, why, and the choices you have.
The short version
- You can use Heart Steps without an account. Then everything stays on your device.
- Children use a nickname and an age band, not their real full name, birthday or address.
- Pip AI is off by default. Only a parent can switch it on, behind a parent check.
- There are no ads and no third-party analytics or tracking in the app.
- You can delete your account and cloud data at any time, in the app or by emailing us.
1. Information kept on your device
When you use Heart Steps without an account, everything stays on the device: each child’s nickname, age band, avatar design, stars and progress, the feelings and real-life wins recorded in the family journal, the worlds a parent builds, and your settings (such as screen-time limits). We do not receive any of it. Uninstalling the app removes it.
2. Optional parent account
A parent can create an account to keep children’s profiles in sync across devices. If you do, we store:
- your email address and the name you give us;
- your password, stored only as a secure one-way hash (we cannot see it);
- each child profile you add (nickname, age band, avatar design and progress) and any family worlds you build.
We use this only to sign you in and keep your profiles in sync. A parent must confirm they are the parent or legal guardian when creating an account.
3. Pip AI (optional, parent-controlled)
Pip AI makes Pip more conversational: it can reply in your child’s own words, create new real-life adventures, write stories, answer curious questions, suggest new topics, design Pip’s room, and help build family worlds. It is off until a parent turns it on in Settings, behind the parent check.
When Pip AI is on and your child uses an AI feature, the app sends our server:
- the child’s nickname and age band, favourite topics, and a short description of their avatar (for example, "a smiling bunny");
- what the child types or says in that feature, and the recent turns of that conversation.
Our server removes contact details it detects (email addresses, web links and phone numbers) and then asks Claude, an AI model by Anthropic, to write Pip’s reply. Anthropic processes this information to produce the reply under its commercial terms: it does not use it to train its models, and may keep it for a short period for safety and abuse monitoring before deleting it. Our server does not keep AI conversations after replying. Pip is guided to use simple, kind language, stay age-appropriate, and never ask for personal details.
Photos for avatars (optional)
With Pip AI on, a parent can choose a photo so Pip can suggest cartoon avatar settings (hair, colours, glasses). This needs the parent check and a clear consent step. The photo is sent once to our server and to Anthropic to produce those settings, and is not stored by us. Pip never tries to identify anyone in a photo.
Reporting AI content
Anyone can tap the report flag on an AI answer. We then receive the reported text, the feature it came from and the reason chosen, so our team can review it and improve Pip. Reports are not linked to your account or device (the reported text itself may include your child’s nickname if Pip used it).
Grown-up alerts
If a child writes something that suggests they may be hurt, scared or unsafe, Pip gently encourages them to talk to a trusted grown-up, and an alert is saved in the Parent Zone on your device so you can follow up.
4. Voice, narration and payments
- Speaking to Pip uses your device’s built-in speech recognition (provided by Google on Android or Apple on iOS). Heart Steps receives only the resulting text.
- Pip’s voice is produced by your device’s text-to-speech. No audio is sent to us.
- Subscriptions are handled by the app store (Google Play or the App Store). We never see your payment card details.
5. Information we do not collect
- No advertising identifiers, no ads, and no third-party analytics or tracking tools.
- No precise location, contacts, or access to your files beyond a photo a parent chooses.
- No selling or renting of personal information, ever.
6. Who we share information with
| Who | What | Why |
|---|---|---|
| Anthropic (Claude) | The AI-feature information in section 3, only when Pip AI is on | To write Pip’s replies |
| Our hosting provider | Parent account data and short-lived server traffic | To run our servers securely |
| Google Play / Apple | Purchase information they handle themselves | To process subscriptions |
| Authorities | Only what the law requires | If we are legally required, or to protect a child’s safety |
7. How long we keep information
- On-device data: until you delete it or uninstall the app.
- Parent account and synced profiles: until you delete the account.
- AI conversations and avatar photos: not stored by our server after the reply is sent.
- Reports of AI content: kept only as long as we need them to review and act on them.
- Our servers briefly use your IP address in memory to prevent abuse (rate limiting); we do not store it with your data.
8. Security
All traffic between the app and our server is encrypted (HTTPS). Passwords are stored as one-way hashes, and our AI keys stay on our server, never in the app. No system is perfectly secure, but we work hard to protect your information and will tell you if something goes wrong that affects you, as the law requires.
9. Children’s privacy
Heart Steps is designed for children, with parents in control. We ask only for a nickname and an age band, keep AI features off until a parent turns them on, and do not let children share personal information publicly. We designed Heart Steps with children’s privacy laws in mind, including India’s Digital Personal Data Protection Act, the US Children’s Online Privacy Protection Act (COPPA) and the UK and EU GDPR. A parent can review, correct or delete their child’s information at any time.
10. Your choices and rights
- Turn Pip AI off at any time in Settings. The app keeps working offline.
- Edit or delete a child’s profile in the app (Parent Zone → Kids, avatars & family account).
- Delete your account and all cloud data in the app (Parent Zone → Kids, avatars & family account → "Delete account & cloud data") or by following these steps.
- Ask us for a copy of your data, to correct it, or to delete it by emailing support@hivup.pro. We reply within 30 days.
11. Changes to this policy
If we change this policy, we will update the date at the top, and for important changes we will let parents know in the app before the change applies.
12. Contact us
Questions or concerns about privacy, including grievances under India’s data protection law, can be sent to support@hivup.pro. hivup, India.