Privacy Policy

Effective date: September 15, 2026

Koalie is a mobile application for parents and guardians. We take your family's privacy seriously. This policy explains what data we collect, why, and how it is protected. We do not sell your data. We do not use your data for advertising. Ever.

1. Who We Are

Koalie is developed and operated by ArosPath, LLC (contact: hello@koalie.app). When this policy refers to "Koalie," "we," "us," or "our," it means us.

2. Who Uses Koalie

Koalie accounts are created by and for parents and guardians (adults). Children do not have Koalie accounts and do not directly interact with our service. We do not knowingly collect personal information directly from children under 13. All data about a child is entered and controlled by the parent or guardian who created the account. This approach is consistent with the Children's Online Privacy Protection Act (COPPA).

3. What We Collect

We collect the following information:

Account information: Your name and email address, provided when you create an account.
Child profile data: Information you enter about your children — first name, grade level, school, date of birth, teacher name, allergies, medications, medical conditions, doctor information, emergency contacts, and media release preferences. You can request deletion of this data at any time by contacting us, as described on our account deletion page.
Reading and academic data: Books logged, AR goals and points, STAR scores (if entered or imported), reading plans, homework assignments, and grades — all entered by you or received from your child's school with your authorization.
School communications: Messages, announcements, forms, and newsletters sent to you by your child's school through Koalie's connected school platform (Basin).
Messages to and from school staff through the ParentBox feature. These messages are retained as permanent school records for FERPA compliance and dispute resolution. Neither party can delete them.
Payment records: When you pay a program or activity fee, we store the transaction record (amount, status, fee). We never see or store your card or bank account number; that's handled directly by our payment processor, Stripe.
Calendars you connect: If you choose to bring calendars from your phone into Koalie, we store the events from the calendars you pick, so they appear next to school events. You choose this per calendar, and nothing is connected unless you turn it on. For any calendar you set to Busy only, we store the dates and times and nothing else — the event names and places never leave your phone. We keep a rolling window of about four months ahead and one month back, not your full history, and you can disconnect a calendar at any time, which deletes everything imported from it.
Device information: Push notification tokens (to send you alerts). Device type and operating system (for app compatibility). We do not collect advertising identifiers.
Usage data: General app usage patterns (screens visited, features used) to improve the product. This data is not linked to your identity or shared with third parties.

4. How We Use Your Data

To provide the Koalie service — syncing your family's data across devices, powering the AI assistant, sending push notifications.
To enable school communication features — delivering school announcements, newsletters, forms, and ParentBox messages.
To power AI features — information is sent to OpenAI's API so Koalie can answer your questions and help with your family's day: your child's profile and reading data (for book recommendations, reading plans, and Ms. Owl's answers), what your child's school has sent through Koalie (so Ms. Owl can answer a question like when spring break starts), and Chit-Chat messages, to spot dates and plans you might want on your calendar and to write the one-line summaries Koalie shows you, along with newsletters. Messages about grades, health, money, and anything urgent are shown in the school's own words and are not summarized. OpenAI does not train on this data (we use their API with data privacy protections in place).
To keep Chit-Chat safe: every Chit-Chat message and photo is checked automatically, using OpenAI's moderation service, when it is posted. A message that clearly breaks the rules (for example sexual content, or a threat) is removed, and the person who sent it is told. A message that might break them stays in the conversation and is looked at by a person at Koalie. Your school is never shown a message because the automatic check caught it.
Book ratings, in aggregate: when your family finishes and rates a book, that rating helps power recommendations for other families too — but only as part of a pooled total ("many families loved this book") once at least 10 different families have rated the same title. No individual rating, and no list of who rated what, is ever visible to anyone — not your school, not another family, not us in any dashboard. A book's pooled count only appears at all once enough families have rated it, specifically so a small or unusual result can never be traced back to one child or household.
To send you the morning briefing and other push notifications you have enabled.
To improve Koalie — we analyze anonymized, aggregated usage patterns to make the app better.

5. Who We Share Data With

We share your data only with the services that make Koalie work:

Supabase (database and authentication) — your data is stored on Supabase servers hosted on AWS. Supabase is SOC 2 compliant.
OpenAI (AI features and Chit-Chat safety) — your child's profile and reading data, what your school has sent through Koalie, and Chit-Chat messages, photos, and newsletters are sent to OpenAI's API to power Ms. Owl, to spot dates and plans in Chit-Chat, to write the short summaries Koalie shows you, and to check Chit-Chat for content that breaks the rules. OpenAI processes this for Koalie; it is not shared with your school. We use API data protections; OpenAI does not use this data to train models.
Expo (push notifications) — device push tokens are used to deliver notifications through Expo's push service.
Stripe (payment processing) — when you pay a program or activity fee, payment is processed by Stripe. We never see or store your card or bank account number; Stripe's own privacy policy governs the payment details it collects directly.
Your child's school — when you use school communication features, relevant data (your name, messages, form responses) is shared with the school administrators and teachers you are communicating with.
Never your child's school, for Chit-Chat. Chit-Chat is between parents, like any group chat on your phone. We do not share Chit-Chat messages with your school or any school, including a chat named for a class or team, and including a message someone reported. A report comes to Koalie, not to a school. People at Koalie may read a message that was reported or caught by the automatic check, only to decide whether it breaks the rules.

We do not share your data with advertisers, data brokers, or any third party for commercial purposes. We do not sell your data.

The only time we would hand over Chit-Chat messages, to a school or anyone else, is if the law requires it, for example a court order or subpoena, and then only what that order requires.

6. FERPA

Koalie handles educational records as directed by parents. We do not independently disclose educational records to third parties. School communications and records shared through Koalie remain subject to FERPA protections. ParentBox messages are maintained as permanent school records consistent with FERPA record-retention requirements.

7. Data Security

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access is protected by row-level security — each user can only access their own family's data. We use secure, industry-standard authentication. We do not store passwords in plain text.

8. Data Retention and Deletion

You can delete your account and all associated data at any time by contacting us at hello@koalie.app. We will delete your account data within 30 days of your request. Exception: ParentBox messages are retained as school records per FERPA requirements — we will work with the school to facilitate access to those records as required by law.

9. Your Rights

Access: You can request a copy of the data we hold about you and your children.
Correction: You can correct inaccurate data directly in the app at any time.
Deletion: You can request deletion of your account and data as described above.
California residents: You have additional rights under CCPA/CPRA, including the right to know what personal information we collect, the right to delete it, and the right to opt out of its sale (we don't sell it). Contact us to exercise these rights.

10. Children's Privacy (COPPA)

Koalie is designed for parents and guardians, not children. Children under 13 do not create accounts or directly submit data to Koalie. All child data in Koalie is entered and managed by the parent or guardian account holder. If you believe a child under 13 has submitted data to us directly without parental authorization, please contact us at hello@koalie.app and we will promptly delete it.

11. Changes to This Policy

We may update this policy as Koalie grows. We will notify you of material changes through the app or by email at least 14 days before they take effect. Continued use of Koalie after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

Questions, requests, or concerns about this privacy policy: hello@koalie.app