Privacy Policy

Kwomi is built by parents, for parents. This policy describes what information Kwomi collects, where it is stored, how long it is kept, and how you remove it.

• –Your artwork and your children's profiles are stored on Kwomi's own servers, in the United States, and are visible only to you and to the people you share an album with.
• –You sign in with Apple or with Google. We never see or store a password.
• –Kwomi is free, with unlimited storage today. We plan to introduce a modest fee for accounts that store more than a set amount; we will tell you before that happens and never charge you without your agreement.
• –We do not sell your personal information, do not run advertising, and include no third-party analytics or advertising SDKs in the app.
• –We do not use your artwork or your children's information to train machine learning models.
• –Before any photo is stored, we strip its embedded metadata — including GPS coordinates, which would otherwise record where the photo was taken.
• –You can delete any artwork, any child, or your whole account from inside the app. A deleted account is kept, archived, for five years so you can change your mind; we email you before it is permanently deleted.

You can try Kwomi without an account, but nothing you capture is saved until you sign in — an account is required to keep artwork. You can create one with Sign in with Apple or Sign in with Google. Both are handled by the provider you choose; Kwomi never receives, sees or stores a password.

When you sign in, the provider gives us a permanent identifier for your account and, usually, your name and email address. We store:

• –Your name, as the provider supplied it or as you later edit it
• –Your email address
• –Which provider you signed in with, and that provider's identifier for you — so we can recognise you next time
• –Whether your account is being used as a parent account, a teacher account, or both
• –When your account was created, and your app preferences

We also keep a record of your active sign-in sessions — a hashed token, when it was created, when it was last used, and when it expires or was revoked — so that signing out everywhere actually ends access everywhere.

You can revoke Kwomi's access to Sign in with Apple at any time in Settings → [Your Name] → Sign in & Security → Sign in with Apple, and to Sign in with Google at myaccount.google.com. Revoking access stops future sign-ins; it does not delete your Kwomi data. To do that, delete your account as described below.

Some things never leave your iPhone:

• –A bounded cache of recent artwork, so your library still opens when you are offline. Remote images are cached in memory only and are never written to disk.
• –The check that decides whether a photo looks like artwork rather than a snapshot of a person. This classifier also runs on your device.
• –A rolling log of app events used for troubleshooting — see Analytics below.
• –Face ID, Touch ID or your passcode, used as a parent gate in front of sensitive actions. The biometric check is performed by iOS; Kwomi receives only a yes or no and never any biometric data.

Kwomi is designed for parents, guardians and teachers — not for children to use on their own. Every account belongs to an adult, and information about a child is entered by that adult.

We do not knowingly collect personal information directly from a child, we do not show children advertising, and we do not build profiles of children. A child cannot sign in to Kwomi, and nothing in the app invites a child to provide information about themselves.

We use a child's information only to provide Kwomi to the adults who look after that child — to file, show and share their artwork. We do not use it for advertising or any other commercial purpose, and we do not disclose it except as described in this policy.

If you believe we have received information about a child without the right permission, email support@kwomi.com and we will delete it promptly.

A teacher can create a classroom, build a roster of students, upload each student's artwork, and share an album with that student's family. A roster can be typed in or imported from a CSV file. For each student a teacher stores the child's name and a parent or guardian email address used to send the invite. We ask teachers to enter a first name only, or a first name and last initial, and never a surname. Teachers cannot upload a photo of a child's face to a student's profile.

A teacher's responsibility. If you use Kwomi for a class, you are responsible for having the permission you need — from your school and from each family — before you enter a family's contact details or upload a child's artwork. Kwomi cannot verify that permission on your behalf.

What a teacher can and cannot see. A teacher can see only their own roster and the artwork uploaded for it. Another teacher's roster is not reachable, and a parent cannot see another family's child. When a parent claims their child through an invite, the child becomes theirs: the parent gains access to that child's artwork, and the record of who uploaded each piece is left unchanged.

Removing a student. Taking a student off a roster archives them rather than deleting them — the artwork, the invite and the family's album are all preserved, so a family that has already claimed the child loses nothing, and the teacher can restore the student. Outright deletion is refused for any student a parent has claimed or who has artwork, and is available only for a row created in error.

A shared album lets a teacher or parent give a family access to a child's artwork without that family needing a Kwomi account. The link carries no password. Instead, whoever opens it enters their email address, we email them a six-digit code, and they enter the code and confirm that they are 18 or older to see the album. Every album works this way; holding the link alone is never enough.

• –Someone who opens an album can view and download the artwork in it, including the full-resolution original.
• –A code is valid for 72 hours, allows five attempts, and is stored only as a hash — we cannot read it back. Once the email that delivers it is sent, we delete its content; our email delivery provider keeps its own copy for 30 days.
• –No more than five codes are issued per hour for the same album and address.
• –The email we send names the album, the child and the teacher who shared it, so the recipient knows what they are being given access to.
• –Access to a shared album cannot be revoked from the app. To revoke it, email support@kwomi.com: we reply within 7 business days, and resolution can take up to 30 days. Once an album is revoked, access ends for everyone holding the link.
• –An album can have at most five members, and a parent can forward it to at most five addresses. We record each address forwarded to.

An album for a single child is restricted to addresses that have already been vouched for — a member of the album, or the parent address on the roster. A classroom-level album is a link album and can be opened by anyone the link is forwarded to, once they complete the email code step. Share one only with people you would be comfortable passing it on.

Artwork is uploaded from the app straight into our cloud storage, into a holding area that nothing can read from. Before a photo becomes part of your library, our service inspects it:

• –The file type is determined from the bytes themselves rather than trusting what the app declared.
• –The image is rebuilt from the parts that belong in it, so anything appended to the end of the file is discarded and a malformed file is rejected.
• –Embedded metadata — EXIF, XMP and comments — is removed. That includes the GPS coordinates a camera records, which in a classroom would be the location of the school.
• –The dimensions are checked, so a small file that would expand into an enormous image is refused.

Only then is the image moved into your library. A file that fails any of these checks never gets there.

When the app serves you an image it does so through a short-lived signed link. Those links are not stored on your device and are not written into our logs.

No third-party analytics or advertising. Kwomi contains no analytics SDK, no advertising SDK and no tracking pixels. We do not build behavioural profiles, and we do not sell or share your information for advertising.

On-device event log. The app keeps a rolling log of its own last 500 events — things like “artwork saved”, “album shared” or “roster imported”, with counts. It contains no names, email addresses or identifiers, it stays on your device, and you can view it in the app's diagnostics screen.

One event reaches us. When the app's on-device filter rejects a photo as not being artwork, it reports that to our service: the fact of the rejection, the reason, and the account it happened on. The rejected image is never uploaded. We keep these reports for 90 days so we can tell a filter that needs tuning from an account being misused, and a reviewer may record a note or an action against one.

Server logs. Our service records a sampled fraction of requests, along with operational counters and errors, to keep the service running and to spot abuse. Rate limits on sign-in and on requesting an album access code are applied per IP address; the IP address is used for that check and is not stored in our database. Upload limits are applied per account.

Crash and performance data. The app uses Apple's MetricKit to collect crash reports and performance metrics on the device. Any diagnostic data you send to Apple is governed by Apple's own privacy policy.

We keep the list of companies that touch your data as short as the product allows. None of them is permitted to use your information for their own purposes.

• –A cloud hosting provider — hosts the Kwomi service, its database and your artwork files, in the United States.
• –Apple — Sign in with Apple, the App Store, and device diagnostics. Governed by Apple's Privacy Policy.
• –Google — Sign in with Google, for accounts that use it. Governed by Google's Privacy Policy.
• –An email delivery provider — delivers the invite and album access code emails we send on your behalf. It receives the recipient address and the contents of that email. Our email delivery provider keeps a copy of each email for 30 days under its standard retention.
• –Print production partners (when print ordering launches) — where you order a physical product, the partner that makes and ships it. Which one depends on the product and your delivery region, and the set changes as we add products and regions. A partner receives only the artwork being printed, your delivery name and address, and what you ordered.
• –A payment processor (when print ordering launches) — takes payment for a print order. Your card details go to it directly and are never seen or stored by Kwomi.

We may also disclose information where the law requires it, or to protect the safety of a child or the integrity of the service. We will tell you when we are able to.

Kwomi's service, its database and your artwork files are hosted in Google Cloud in the United States. Kwomi is offered in the United States and is intended for people there. If you use it while travelling, your information is still stored in the United States.

Backups are retained on a rolling basis for operational recovery and age out of their own accord, so data you delete may persist in a backup for a short period after it is gone from the service.

• –Everything travels over encrypted connections, and is encrypted at rest by our hosting provider.
• –Every request that names a piece of artwork, a child, a classroom or an album is checked against who is asking — not merely that someone is signed in. An identifier belonging to another account is refused, and is refused in a way that does not reveal whether it exists.
• –The app is never given a general credential for our storage. It is given permission to write one named file, which stops working as soon as that upload is finished.
• –Your sign-in token is sent only to Kwomi's own service, never to the storage links your artwork is served from.
• –Signing out of all devices revokes every session on the account at once.
• –Each release is scanned for known vulnerabilities, leaked secrets and code-level security faults before it ships.

No service can promise perfect security. If we discover a breach affecting your information, we will notify you and the relevant authorities as required by law.

Kwomi is free. There is no subscription on sale, no feature is withheld behind a purchase, and storage is currently unlimited.

Future storage fee. We plan to introduce a modest fee for accounts that store more than a set amount of artwork. Before we do, we will announce the limit and the price in the app and by email. You will not be charged unless you choose to pay, and we will tell you then what payment information is collected and who processes it.

Print orders (coming soon). When print ordering launches, payment will be taken by a third-party payment processor and Kwomi will never receive your card details.

• –Delete a single piece of artwork, or a child, from inside the app at any time. Deleting artwork removes the stored images as well as the record.
• –Delete your whole account in the app under Settings → Delete Account. The account is archived straight away: you are signed out everywhere and its shared albums and invites stop working. We email the address on the account to confirm, with the date it will be deleted. We keep the archived account for five years in case you change your mind: sign in again at any point before then and it is restored exactly as it was. We email you again a month before the date. After that, the account and everything belonging to it — artwork, files, children, classrooms, albums and invites — are permanently deleted.
• –Accounts that go unused. If an account has not been used for 90 days, we archive it and email the address on the account. It is then kept for five years, with a final warning email a month before it is permanently deleted in the same way. Signing in at any point during that time restores it.
• –Recovering an archived account. While an account is archived, signing in restores it. In some cases we may be able to help you recover artwork from an archived account — email support@kwomi.com. Once an account is permanently deleted, its artwork cannot be recovered.
• –Deleting the app removes the local copy from your phone, but not your account. Delete the account first if that is what you want.
• –Where a teacher uploaded artwork for a child you have claimed, deleting your account removes your access and your copy; the teacher's own record of their classroom remains theirs to delete.

Depending on where you live, you may ask us to:

• –Tell you what information we hold about you
• –Give you a copy of it, in a form you can take to another service
• –Correct it where it is wrong
• –Delete it
• –Restrict or object to how we use it
• –Withdraw a consent you previously gave

Email support@kwomi.com from the address on your account and we will respond within 30 days. We will never charge you for a request, and we will never treat you differently for making one. We do not sell personal information and we do not share it for cross-context behavioural advertising.

If your child's artwork is in Kwomi because of their school and you want it removed, you can write to us directly — but telling the teacher or the school is usually faster, because they own the classroom record.

If we update this policy we will post the revised version on this page with a new date. For changes that materially affect how your information is handled, we will give additional notice — in the app, or by email to the address on your account. Continuing to use Kwomi after an update takes effect means you accept the revised policy.

Kwomi is a product of True Top LLC, a California limited liability company based in San Francisco, California — the legal entity that owns and operates it.

Questions about this policy, or about anything Kwomi holds for you: support@kwomi.com. We aim to answer privacy enquiries within 7 business days.