Privacy Policy

WonderWatch is a learning platform for children aged 6 to 12. Accounts are created and owned by parents. We collect only the personal data reasonably necessary to provide WonderWatch. We do not sell or share children’s data with advertisers. We do not show third-party advertising inside WonderWatch.

If you only read one section, this is it.

WonderWatch is operated by KonnectingDots Pvt. Ltd. (“WonderWatch”, “we”, “us”). You can reach our team at hello@wonderwatch.ai.

For the purposes of the DPDP Act, WonderWatch acts as a Data Fiduciary. For the purposes of COPPA, WonderWatch is the operator of a website and online service directed in part to children.

From parents when you create an account: name, email address, password (stored hashed), country, and (optionally) phone number.

From child profiles created by a parent: a name or nickname, age, and selected interests. We ask for your child’s age in years and months at setup, and store an approximate birth month and year worked out from it so their age stays right as time passes — we never ask for or store their exact date of birth. We do not require a child’s email, photograph, school, or precise location.

Questions asked to Nuno: when your child uses Wonders (ask Nuno anything), we store the question they typed and Nuno’s response, so we can generate your evening recap and so you can see what they were curious about.

Usage data: missions started and completed, badges earned, time spent in a mission, device type, approximate location (country/region) inferred from IP, and basic diagnostic logs needed to keep the service running.

We do not knowingly collect sensitive personal data (such as health information, biometric data, religious or political beliefs, or information about sexual orientation) from anyone. Children cannot create accounts or independently provide personal information to WonderWatch. All child information is collected only through parent-controlled accounts.

• To deliver the service — personalise missions, save progress, generate the daily parent summary.
• To keep the service safe — detect abuse, prevent unauthorised access, debug crashes.
• To communicate with parents — confirmations, support replies, evening updates, important service notices.
• To improve the product — aggregate, de-identified analytics that help us understand which content works and which does not. We do not use children’s personal data for advertising of any kind.

Children cannot sign up on their own. A parent or legal guardian creates the account, accepts these terms, and creates each child profile. By creating a child profile, you confirm that you are the parent or legal guardian and that you consent, on the child’s behalf, to the limited data processing described in this policy.

Where we are today, stated plainly. At sign-up, we ask you to confirm that you are the child’s parent or legal guardian and to consent to this Privacy Policy and our Terms. We are continuing to strengthen our parental verification process as our platform evolves and will update this policy when additional verification methods are introduced.

Parents can review, edit, or delete their child’s profile and data at any time from For Parents. You can also email us at hello@wonderwatch.ai with a deletion request — we will action it within 7 working days, and personal data is fully removed within 30 days (see section 7).

Consent from a parent or legal guardian is required before we create any child profile. At present, this consent is captured through an explicit confirmation at sign-up, where the parent affirms they are the child’s parent or legal guardian and are at least 18 years old, together with itemised agreement to this Privacy Policy. This is not yet an identity-verified confirmation. In line with the Digital Personal Data Protection Rules, 2025, we will introduce an identity-verified consent mechanism, such as DigiLocker-based verification, ahead of the Act’s verifiable-consent requirement taking effect on 13 May 2027, and will update this Privacy Policy accordingly at that time.

We share personal data only with the limited set of service providers we need to run WonderWatch:

• Hosting and database providers (Supabase, AWS) — to store account and progress data.
• Transactional email provider — to send sign-up confirmations and the evening parent summary.
• Payment provider (Razorpay) — only if you choose a paid plan. Checkout happens on their systems, so we never see or store your card or UPI details. They tell us your subscription status and the card network, last four digits and expiry, which we keep so we can warn you before a card expires and send you receipts.
• AI provider(s) — for Nuno’s narration, and for answering questions your child asks in Wonders that we have not already written an answer for. For those questions we send the question text and your child’s age, worked out from the age you gave us at setup. We never send your child’s name or anything else that could identify them. These requests are handled under the provider’s standard API terms and retention policy.
• Analytics provider — on our marketing website only, never inside the child-facing app, and configured for child-directed use with advertising identifiers and personalised advertising disabled. It helps us understand site usage in aggregate.

We require each provider to act only on our instructions and to use your data solely to provide the service to us.

We do not sell personal data, share it with advertising networks, or use it to build advertising profiles of children or parents.

All data is encrypted in transit using TLS and at rest using the standard encryption provided by our cloud database. Passwords are stored using a strong one-way hash (bcrypt). Access to production systems is restricted to a small set of named team members and requires two-factor authentication. We log administrative actions for audit purposes.

No system is perfectly secure. If we become aware of a security incident affecting your data we will notify affected users without undue delay, and in line with COPPA / DPDP Act timelines.

We keep account and child-profile data for as long as the account is active. When you delete your account, we permanently remove personal data within 30 days, retaining only the minimum records required for tax, audit, or fraud-prevention purposes.

Under the DPDP Act and COPPA, you have rights over your data. You can:

• Access the personal data we hold about you and your child.
• Correct inaccurate data.
• Delete an account or a child profile at any time.
• Withdraw consent for any optional data processing, and unsubscribe from marketing emails (transactional service emails will continue).
• Lodge a complaint with the Data Protection Board of India (or your local data-protection authority).

To exercise any of these rights, email hello@wonderwatch.ai. We aim to respond within 7 working days.

We use a small number of strictly necessary cookies to keep you signed in and to keep the service secure. On our marketing website we also use optional analytics, which load only if you accept them in the cookie banner — decline and nothing optional loads. We do not use third-party advertising cookies, and we do not use advertising or tracking pixels inside the child-facing app.

Missions and the video library embed videos from YouTube using YouTube’s privacy-enhanced mode, which prevents YouTube from setting cookies until the video itself starts playing. Because videos start automatically when your child opens one, this happens as soon as the player loads. At that point YouTube may set cookies and receive technical data such as IP address, device type and referring page, governed by Google’s privacy policy rather than ours. Video thumbnail images are also served from a Google-operated domain, which receives your child’s IP address as part of delivering those images. Our fonts are served from our own servers, so they involve no third party. We do not control YouTube’s processing and we receive none of that data.

Our infrastructure and service providers are located primarily in India. Some processing may be carried out in the United States by service providers we use (for example, AI or communications tooling). We do not currently operate infrastructure in the European Economic Area. Where personal data is transferred outside your country of residence, we rely on contractual safeguards equivalent to those required by your local law.

If we make a material change to this policy — especially anything affecting children’s data — we will email parents at the address on file and post a notice in For Parents before the change takes effect.

If anything in this policy is unclear, or you would like to exercise a right, email us at hello@wonderwatch.ai. Our team reads every message and we aim to reply within two business days.