Privacy Policy & COPPA Direct Notice

1. Scope, Jurisdiction & Regulatory Framework

This Privacy Policy applies to the Enkrova child app (com.fledge.child), the Enkrova Parent app (com.fledge.app), and associated cloud services operated by Wolf Cub Ventures ("Enkrova", "we", "us", or "our").

Geographic Scope: Enkrova is currently offered and distributed exclusively to families residing in the United States. All processing is governed by United States federal law and applicable US state privacy statutes.

Age-Specific Legal Frameworks:

• Children Under 13: Supervised in strict accordance with the FTC Children's Online Privacy Protection Act Rule (16 CFR Part 312). Enkrova requires prior Verifiable Parental Consent (VPC) before any child device is activated.
• Teens Aged 13 to 17: Supervised under parental legal authority and guardianship over a minor dependent, in compliance with applicable US state consumer and teen privacy statutes (including the California Age-Appropriate Design Code Act, Texas SCOPE Act, and Washington My Health My Data Act where applicable).

2. Our Glass Box Guarantee (Anti-Stalkerware Transparency)

Enkrova rejects covert monitoring. Our architecture enforces strict transparency:

• Persistent Status Indicator: Whenever supervision is active, Enkrova maintains a prominent, non-dismissible notification in your child's Android status bar (ChildComplianceNotification).
• Shared Rules: Children can view their daily screen limits, bedtime schedules, and Daily Balance score directly in their app.
• No Hidden Operation: Enkrova declares isMonitoringTool="child_monitoring" pursuant to Google Play's Families & Child Monitoring Policy. Enkrova cannot be disguised as a calculator, utility, or system component.

3. Information We Collect and How We Use It

We collect only the data necessary to provide agreed parental supervision and digital wellbeing features:

4. Multi-Layered Sanctuary Architecture (Absolute Privacy Zones)

Enkrova incorporates multi-layered technical boundaries to ensure sensitive personal, medical, and financial activities are never monitored:

• Core Pre-Configured Sensitive App Exclusions: Banking, cryptocurrency, digital wallet, and credential manager applications are excluded at the operating system layer. When any of these apps enter the foreground, Accessibility scanning and screen capture are immediately terminated.
• Input & System Privacy Exclusions: Virtual software keyboards (e.g., Gboard, Samsung Keyboard), lock screens, and Android System Settings are excluded from text capture. Passwords, PINs, and keystrokes are never scraped.
• Teen Privacy Sanctuaries: Teens can activate or request temporary Privacy Sanctuaries directly in their app (e.g., for private journaling, study retreats, or personal writing), during which all screen inspection and AI analysis is halted.
• Parental Category & App Allowlist: Parents can designate educational, religious, or healthcare apps on the custom allowlist, exempting them from monitoring.

5. Sensitive Mental Health & Physical Safety Data Handling

To protect children in crisis, Enkrova's safety vision scans for acute hazards including self-harm ideation, suicide keywords, and predatory contact. We recognize that this telemetry touches on mental-health-adjacent sensitive data.

6. Third-Party Sub-Processors & AI Data Processing

To detect emerging online threats beyond static keyword lists, Enkrova utilizes the Google Gemini API (model: gemini-3.8-flash) as an enterprise AI sub-processor:

• Commercial API Terms: We utilize Google's paid commercial API tier. Under Google's Developer Terms for paid services, Google does not use customer prompts or generated content to train or improve Google models.
• Zero Human Review & Ephemeral Analysis: Content sent for safety classification is processed in volatile memory and is not subjected to human review.
• Cloud Infrastructure: Core database and cloud storage services are hosted via Supabase on AWS cloud infrastructure, utilizing AES-256 encryption at rest and TLS 1.3 in transit.

7. Advertising & Commercial Data Sale

Enkrova operates on a direct parent subscription model. We do NOT sell, rent, monetize, or trade children's or parents' personal information. Enkrova contains ZERO third-party advertising SDKs, zero behavioral advertising trackers, and zero marketing analytics trackers.

8. Data Retention, Backup Aging & Purge Schedule

In accordance with FTC COPPA Rule (16 CFR § 312.10) and data minimization principles, Enkrova enforces the following automated retention schedule:

• Routine Safe Screenshots: Purged automatically within 24 hours.
• Raw Accessibility Scraped Text: Permanently deleted from the database within 48 hours. On safety alerts, the triggering raw text snippet is set to NULL after 48 hours.
• Alert Visual Evidence: High-risk alert screenshots are retained for up to 7 days to allow parent review, then permanently deleted.
• Aggregated Screen Time Metrics: Daily Balance scores and app category minutes are retained for up to 30 days to generate parent trend graphs.
• Disaster Recovery Backups: System snapshot backups age out on a rolling 30-day rotation cycle. If a disaster recovery restore occurs, an automated reconciliation scrub re-applies all deletions requested since the snapshot date.

9. Verifiable Parental Consent (VPC) & Parental Rights

Before pairing any child device, Enkrova obtains Verifiable Parental Consent (VPC) from the parent or legal guardian via our electronic consent flow in the Enkrova Parent app. The parent provides their full legal name, relationship, and an affirmative electronic signature attesting to their authority over the child.

Your Statutory Rights as a Parent:

• Review & Inspection: You may review all active screen time telemetry and alerts recorded for your children directly via the Enkrova Parent app.
• Right to Permanent Deletion: You may permanently delete your parent account, all linked child profiles, and all historical data at any time via our self-service web portal at enkrova.wolfcubventures.com/delete-account or inside the Enkrova Parent app under Settings > Account Security > Delete Account & Data.
• Statutory Proof-of-Consent Exception: When you delete your account, all operational personal information (passwords, child logs, screenshots, alerts) is deleted promptly from active servers. As an explicit, disclosed exception permitted under the FTC COPPA Rule, the timestamped record of Verifiable Parental Consent (parent name, relationship, timestamp, policy version, and deletion date) is retained in an isolated compliance log for 5 years strictly to demonstrate legal compliance to regulatory authorities, after which it is permanently purged.
• Revocation of Consent: You may revoke consent at any time, which halts all data collection and initiates device unpairing.

10. Information Security Summary

Enkrova maintains administrative, technical, and physical safeguards designed to protect family data, including:

• Transit Encryption: All client-server communications are encrypted using modern Transport Layer Security (TLS 1.3 / TLS 1.2).
• Rest Encryption: Database records and visual evidence are encrypted at rest using AES-256.
• Password Protection: Parent account passwords are protected using the memory-hard Argon2id cryptographic hashing algorithm with unique salts.
• Breach Notification: In the event of a confirmed security incident affecting personal information, Enkrova will notify affected parents in accordance with applicable state and federal laws without unreasonable delay.

11. Contact Us & Privacy Inquiries

If you have any questions or wish to exercise your privacy rights, contact our Privacy Governance team:

Email: admin@wolfcubventures.com
Mailing Address: Sandy, UT