Privacy Policy — OneXCube

OneXCube (“we,” “us”) builds a learning product for children, families, schools, and academies. This page explains what data we collect, how we use it, and the rights you and your child have over it. Plain English first; the legal anchors are flagged inline.

1. What we collect

From parents

Name, email, password (hashed).
Billing details processed by Stripe or Paystack — we never see your card number, only a tokenized customer reference.
The IP address used at signup, kept as evidence of parental consent.

From children (via the parent's account)

First name, optional last name, age band (5–7, 8–10, or 11–13).
A child email and password we generate on the parent's behalf — children do not pick these.
Reading activity: which stories they opened, how long they spent, words read, quiz answers and scores.
Optional voice recordings of reading practice and optional photos of completed handwritten worksheets, both uploaded explicitly by the child or parent.

2. How we use it

Personalize reading level, vocabulary, and story recommendations for each child.
Show parents and teachers progress dashboards.
Score quizzes and (where enabled) provide AI feedback on reading fluency and handwritten worksheets.
Deliver scheduled emails (newspaper edition, academy lesson nudge, family-trial reminders) to the parent address only.

3. Third-party processors that touch the data

We use a small set of vendors to make the product work. Each has a data processing agreement on file with us, and we send them only the minimum needed.

Stripe and Paystack — payment processing.
OpenAI and Google Gemini — AI assistance for story drafting, quiz scoring, reading fluency, and handwritten worksheet review. We never send child names or contact details, only the work product (text or image).
Amazon S3-compatible storage for uploads and exports.

4. How long we keep it — Retention windows

We delete data on a schedule unless a legal hold or active subscription says otherwise. Defaults today:

Voice recordings: 90 days from upload.
Worksheet submissions: 365 days from submission.
Reading sessions / quiz attempts: 730 days (two academic years).
Newspaper delivery history: 365 days.
Child profiles: 365 days after the family's paid subscription ends.

Schools and academies can shorten these windows for their own tenants on request. The policies above are enforced nightly by an automated purge job.

5. Children's privacy — COPPA

OneXCube complies with the U.S. Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§6501–6506; 16 CFR Part 312). We do not knowingly create a child account without verifiable parental consent.

For families on a paid plan, a credit/debit card on file is our verifiable consent method, accepted under 16 CFR §312.5(b)(2).
Until that card is captured, the parent cannot add a child — the system blocks child creation and links the parent to billing setup.
We collect from children only the categories listed in section 1; we do not require children to disclose more than is reasonably necessary to participate.
We do not display behavioral advertising to children. The product carries no third-party advertising at all.

6. Your rights as a parent

You can, at any time:

Review the data we hold on your child by requesting an export — we deliver it as a JSON file with signed links to any media.
Delete a child's account and all linked reading data from your family dashboard. The “Remove” button on /family/children deletes the child, their profile, and reading history immediately.
Refuse further collection by deleting the child account; once removed we stop collecting.

To request a data export, refuse continued use, or raise a concern, email privacy@onexcube.com with your account email in the subject. We respond within 30 days.

7. Security

We store data in tenant-isolated databases. Sensitive media (voice recordings, handwritten uploads) lives on a private object store and is served only via short-lived signed URLs; every staff access to a child-owned asset is audit-logged. We do not sell child or parent data and we never will.

8. Changes

If we materially change this policy, we will notify the parent email on file at least 14 days before the change takes effect. The current version is the one on this page.

9. Contact

OneXCube · privacy@onexcube.com