Privacy Policy

Autipal is designed for autistic children (roughly ages 2–12) and is intended to be set up and managed by a parent or legal guardian aged 18 or older. Accounts are created and controlled by the parent/guardian, who provides consent on the child's behalf. Children do not create accounts and we do not knowingly let children provide personal data to us directly.

We collect only what we need to run the Service:

• Account data — the parent's name, email address, and a securely hashed password (or sign-in provider identifier).
• Child profile — the child's first name (or nickname), date of birth or age, and optional preferences (skin tone, character, board settings) used to personalise the app.
• Content you create — custom communication (AAC) tiles and boards, photos you choose to turn into tiles, social stories, visual schedules, journal entries, goals, and M-CHAT-R screening answers and results.
• Usage & progress — activity in games and lessons, rewards, and app diagnostics, used to show progress and improve the Service.
• Device & technical data — app version, device type, coarse region/locale, and log data needed for security and reliability.
• Support & billing — messages you send us, and subscription status (payments are processed by Apple or Stripe — we do not receive your full card number).

We use personal data to:

• provide, personalise, and maintain the Service for your child;
• generate content you request (e.g. AI pictures, stories, voice);
• show progress and, where you enable it, share it with a clinic you connect;
• process subscriptions and provide customer support;
• keep the Service secure, prevent abuse, and meet legal obligations.

We do not sell personal data, and we do not use your or your child's content to train third-party AI models.

Protecting children's data is central to Autipal. We collect children's data only with the consent and under the control of the parent/guardian, only for the child-support features of the Service, and never to build advertising profiles or to show behavioural ads to children. Before any AI processing, we strip identifying details such as names and faces where feasible. A parent can review, export, or delete their child's data at any time (see “Your rights”). If you believe a child has provided us data without a guardian's involvement, contact us and we will delete it.

Some features use artificial intelligence to generate pictures, stories, text answers, or a spoken voice. To provide these we send the minimum necessary content to trusted AI processors acting on our instructions:

• OpenAI — text generation and image generation for tiles, boards, stories, and Academy answers.
• Fish.audio and ElevenLabs — text-to-speech (the spoken voices used in the app).

We minimise and, where feasible, de-identify content before sending it, and we do not permit these providers to use your content to train their models.

We use a small set of vendors to operate the Service, each bound to protect your data and use it only to provide services to us:

• MongoDB Atlas — database hosting.
• Apple and Stripe — subscription payments.
• PostHog — privacy-preserving product analytics (no session recording; text masked).
• Cloud hosting and content-delivery providers for the website and app backend.
• The AI processors listed in Section 5.

Our website uses strictly-necessary cookies for sign-in, security, region, and language. We also use privacy-preserving analytics (PostHog) to understand product usage in aggregate; it is configured to mask text and avoid session recording. Where required by law, we ask for your consent before non-essential analytics run, and you can decline. The app itself does not use advertising trackers.

We keep personal data for as long as your account is active and as needed to provide the Service. When you delete your account, we delete your and your child's personal data from our active systems promptly, except where we must retain limited records to meet legal, tax, or security obligations. Backups are purged on a rolling schedule.

Depending on where you live (including under GDPR and the CCPA), you may have the right to access, correct, export (data portability), delete, or object to certain processing of your personal data, and to withdraw consent. You can:

• Export your data — Settings → “Export my data” in the app downloads everything we hold as a JSON file.
• Delete your account — Settings → “Delete account” permanently removes your and your child's data.
• Contact us at hello@autipal.com to exercise any right. We will not discriminate against you for doing so.

We use industry-standard measures — encryption in transit, hashed passwords, access controls, and data minimisation — to protect personal data. No method of transmission or storage is perfectly secure, but we work to protect your information and to notify you and regulators of a breach where required by law.

We operate globally and may process and store data in the United States and other countries. Where required, we use appropriate safeguards for cross-border transfers of personal data.

We may update this policy from time to time. We will post the new version here and update the effective date, and for material changes we will provide additional notice where appropriate.

Smahi Inc. (Autipal), California, USA. Questions or requests about your privacy: hello@autipal.com.