WhyBee answers questions from children aged 3–11. A child's data belongs to their parent, and we collect only what the app cannot work without.
Last updated 2026-10-13
Who processes the data
The WhyBee app is built and operated by the WhyBee team. We decide what data the app processes and we answer requests about it.
For questions about your data, access to it or its deletion, write to support@whybee.app. We reply in English, Ukrainian or Russian.
In short
We do not sell data — and never share it with ad networks. There are no ads and no advertising tracking in the app.
No third-party analytics — the app ships without analytics or attribution SDKs.
Audio stays on the device — your child's speech is recognised offline, on the device itself; the recording is never uploaded.
The AI receives no personal data — the child's name, birth year, the parent's e-mail and internal identifiers never enter a model request.
The parent stays in control — you can export the family archive, delete a child profile or the whole account, and withdraw consent.
What data we process
Questions may touch sensitive topics (health, family, feelings). We process such texts solely to answer and to keep the child safe — including showing supportive text — and we neither build profiles on them nor use them for anything else.
Parent account — e-mail address and interface language. The password is stored and verified by our authentication provider — we never see or store it.
Child profile — a name (any name works — a nickname is fine) and a birth year. The year selects one of three age bands the answer is written for. Plus the chosen narration voice.
Questions and answers — the text of your child's question, the generated answer and the safety-check result (including the category a question or answer was blocked under). The question text is written by the child, who can technically include personal details in it — such text is processed like any other question and goes to generation and moderation, and we cannot automatically scrub it; please explain to your child that questions need no personal details.
Interest topics and counters — question topics ("dinosaurs", "space"), the number of questions asked, knowledge cards and gift ideas — what the parent digest is built from.
Notifications — the device push token and platform if you allowed notifications, and the e-mail address for letters.
Subscription — the whole purchase event as the RevenueCat subscription service sends it (purchaser identifier, event type, product, environment and the event's other fields), plus the access status derived from it. Payment details are handled by Apple — we never receive them.
Technical data — request idempotency keys and rate-limit counters. The parent-zone PIN is stored on the device and never sent to the server. We do not store IP addresses in our database, and the one-time code from a sign-in redirect is stripped from the request before anything is logged.
Microphone and voice
A child can ask by voice. Speech recognition runs on the device itself: the audio never reaches our servers and is not stored anywhere — only the recognised question text is sent.
Answers are read aloud by a neural model that runs on the device itself: the answer text is never sent out for narration. The speech-recognition and narration model files are downloaded once; the app fetches the large recognition model on its own only over Wi-Fi (over mobile data only if you tap "Download now") — a download of publicly available files that carries no details about the child and no questions or answers. The "family voice" feature (narration in a relative's voice cloned from a recorded sample) is not enabled in the app; if it ships, it will require separate consent from the voice owner, revocable at any time.
Why we process it
Data is processed for the purposes listed below. Legal bases (where GDPR applies to you): performance of the contract with the parent — to run the app and the subscription; the parent's consent — to process the child's data; our legitimate interest — for service security and abuse prevention; compliance with legal obligations — to answer lawful requests from competent authorities and to protect our rights.
Answer the child — phrase the answer at the level of their age band.
Check safety — a filter before generation, an independent review of the finished answer, and an audit record. An answer that has not passed the check is never shown.
Inform the parent — the interest digest, the privacy report, a block log without texts, and a notification in worrying cases.
Run the subscription — determine whether the family has paid access.
Protect the service — rate limiting and abuse prevention.
What goes to the AI
Answers for your child are generated by Anthropic's Claude model, not by a human, and AI can be wrong. The model receives only what it needs to answer and to check the answer, and Anthropic does not use this data to train its models.
What is sent — the question text and the earlier questions and answers of the same conversation, so the answer stays coherent; the age band (one of three values), so the answer fits the child's age; interest topics (such as "dinosaurs" or "space") and descriptions of topics the parent asked to avoid; service markers for the safety check, such as the chosen answer mode.
Every answer is checked — the question is checked before the model starts answering, and every finished answer is checked again, by a separate independent request, before your child sees it. An answer that fails the check is never shown.
Parent digest and gift ideas — the weekly parent letter and the gift-ideas list are composed by the model from interest topics; for these it receives only the letter's language, the topics and the number of questions that week — no question texts and no name.
Never sent — the child's name, birth year, the parent's e-mail, account identifiers and other internal identifiers from our database, voice and audio recordings. If your child includes a name in a question, it is sent along with the question — please explain to your child that questions need no personal details.
Retention at Anthropic — requests and responses are deleted within 30 days; the data for the weekly letter is deleted as soon as we receive the result, and in any case within 29 days. One exception outside our control: a request that Anthropic's automated safety systems flag as unsafe may be kept by them for up to 2 years, and those systems' scores for up to 7 years.
Children's data protection
The service is designed with children's data protection requirements in mind — COPPA (US) and the GDPR as it applies to children's data (EU and UK). We collect the minimum about a child: a name and birth year for the profile, and question texts are kept for a limited time; a child's name, birth year and identifiers are never sent to the AI.
The child-facing interface explains, at the child's level, how to use AI safely: that WhyBee is an AI helper, not a person, that it can be wrong, and that anything confusing or worrying is for a grown-up.
Who we share data with
We use service providers that process data on our behalf. We do not sell data and never share it with ad networks or data brokers.
We may disclose data where the law or a binding decision of a competent authority requires it, and to the extent necessary to protect the rights and safety of children, other users and the service. We disclose the minimum required and, where lawful and possible, we will notify you.
In a reorganisation or a transfer of the service, data may be passed to a successor on terms no weaker than this policy; we will announce such a transfer.
Anthropic PBC — answer generation and the independent safety review.
Amazon Web Services (Amazon SES) — delivery of parent e-mails, including authentication mail — the address-confirmation and access-recovery codes; mail is processed in the eu-north-1 region (Stockholm).
Apple (Apple Push Notification service, APNs) — delivery of push notifications to the parent's device: Apple receives the push token, the text of the notification itself and routing keys so the notification opens the right screen (for an alert — the child profile's internal number, with no name or age). A notification is stored by Apple only until it reaches the device; the APNs terms are part of the Apple Developer Program License Agreement. Android (FCM) is not wired.
Supabase — parent authentication: sign-in and access recovery; the authentication letters are delivered by our mail vendor.
RevenueCat — subscription status tracking.
Apple — payment and subscription management in the App Store.
Railway — hosting of the backend and the application database.
Porkbun — mail intake for the domain's addresses: a letter to support — and a reply to the weekly letter — is forwarded to our mailbox; the vendor sees your return address and the text of the letter.
Google (Gmail) — the support mailbox: it keeps the correspondence with you until we delete it.
Children's data and parental consent
Only an adult creates and confirms the account. A child has no separate account, no login and no messaging with other people: the child-facing part of the app lives inside the parent's account, and all of the child's data belongs to the parent.
Consent to processing a child's data is given by the parent — in the app, after signing in to their account and before the child can ask a first question. The consent screen explains up front what we process and that answers are generated by Anthropic's Claude model; consent counts only once the parent confirms it, and it can be declined. Until consent is given, no child profile is created and no questions go to the AI.
Consent can be withdrawn at any time by writing to support@whybee.app: once withdrawn, the child features are blocked again. The whole account, with all of the family's data, can be deleted in the parent zone at any time, with or without consent.
We do not build advertising profiles of children, show no ads, and use no endless feeds or streaks to drive engagement.
How long we keep data
Question and answer texts — 90 days, after which a daily automated sweep anonymises them. Topics and counters remain as an aggregate — an event without text already is the aggregate.
Delivered notifications — 30 days after delivery, then the row is deleted.
Profile and settings — for as long as the account exists. Deleting a child profile cascades to everything attached to it; deleting the account removes the whole family and the record at the authentication provider.
At Anthropic — requests to the model and its responses are deleted within 30 days, and the data for the weekly letter as soon as the result is received, within 29 days at most. One exception outside our control: content flagged by Anthropic's automated trust and safety systems (a blocked unsafe question, for example) may be retained by them for up to 2 years, and classification scores for up to 7 years.
Bounced addresses at SES — an address that bounced or produced a spam complaint enters the SES suppression list, which has no expiry. When an account is deleted we separately ask SES to remove the address and retry the request if it fails.
Support correspondence — stays in the mailbox until we delete it; after deletion the provider erases it — about 2 months for full erasure from active systems and up to 6 months in encrypted backups.
Knowledge cards — live with the child's profile and are not covered by the text-anonymisation window: a card never quotes the question verbatim — moderation enforces that requirement.
Backups — residual copies of deleted data may persist for a limited time in infrastructure backups and are removed as those backups rotate; data disappears from the live systems immediately.
Parent rights
Export, the report, corrections and deletion are available in the app; consent is withdrawn through support. If something does not work, write to support@whybee.app.
Access and export — the full family archive is exported from the parent zone (at most once an hour).
Privacy report — the parent zone shows active consents, retention windows, the cutoff from which texts are anonymised, the subprocessor list and a block summary without texts.
Correction — the name, birth year and settings are edited in the app.
Deletion — a child profile or the whole account is deleted from the parent zone.
Withdrawing consent — at any time, by writing to support@whybee.app.
Complaint — if you are in the EU, the EEA or the UK, you may lodge a complaint with your local data protection authority.
The public gift-ideas link
A parent can create a public link to their child's gift-ideas list. The link serves a frozen snapshot: topics and ideas only — no child name and no other family data. The link is revoked in the app, stops opening once revoked, and only one link per child can be active.
Nothing else about your family is publicly reachable: every other screen requires the parent to sign in.
How we protect data
Encrypted transport — all app traffic uses HTTPS; e-mail is sent over a secure connection only — if the recipient's server does not support it, the letter is not sent at all.
Separated environments — test environments hold no real family data and run on separate databases.
Minimal logs — server logs contain no question or answer texts — a build check enforces that. IP addresses are not stored in the database and never used for profiling; the technical access log may contain the network address of the connection.
Access — production data is accessible to a minimal circle of developers, on a need-to-know basis.
International transfers
Our providers are companies in the EU and the US, so data may be processed outside your country. Parent e-mail is processed in the EU (eu-north-1, Stockholm). Product data transfers rely on our agreements with those providers, which include standard contractual clauses for data protection; support correspondence travels as ordinary e-mail.
Changes to this policy
We update this page together with the product; the revision date is in the header. We will announce material changes in the app or by e-mail to the account address.
Contact us
Write to support@whybee.app if you want to know what data we hold about your family, correct or delete it, withdraw consent, or report a privacy problem.