Privacy Policy

StarKid Journey. Last updated 1 October 2026.

1. Who we are

The controller of your data is StarKid, mindfulness for kids d.o.o. (StarKid d.o.o.), Osojna pot 8, 6310 Izola, Slovenia, registration number 9616438000. Email insight@starkiduniverse.com.

We have not appointed a data protection officer, because the law does not require one for a company of our size and activity. Privacy questions are answered directly by our founder.

2. What we collect, why, and our legal reason

• Your account. Email, name, city, time zone, app language, and your sound and notification choices. We need them to sign you in and run your membership. Legal reason: our contract with you (GDPR article 6(1)(b)).
• Your family. Your family's team name and, if you add them, the names and birthdays of your partner and children, your children's first names and ages, and why you came. They make the Journey personal to your family. Legal reason: our contract with you. Everything except the team name is optional.
• Neurotypical or neurodiverse. Only if you choose to answer. It shapes what your library shows you, and it is never shown back to you as a label. Legal reason: your explicit consent (GDPR article 9(2)(a)), which you can withdraw at any time by asking us to remove it.
• Your family's progress. The exercises, videos and meditations you complete, how much of a video you watched, your stars, the months you have walked through, and your answers to our short surveys. They let the app remember where you are and show your family's growth. Legal reason: our contract with you.
• Payments. Your plan, the amounts, the dates, your country, Stripe's references for your payments, and any refund or withdrawal request. We need them to take payments, give refunds and keep the accounts the law requires. Legal reasons: our contract with you, and our legal obligations (GDPR article 6(1)(c)).
• How you found us. When you sign up: the page you came from, the campaign tags in the link, your country, browser, language, time zone and IP address. They tell us which invitations bring families in, and help us stop abuse. Legal reason: our legitimate interest in growing and protecting the Journey (GDPR article 6(1)(f)).
• App analytics. The pages you open in the app, and recordings of how the app is used, with every text field masked and the Q&A room never recorded, linked only to a user number, never to your name or email. They show us what confuses people, so we can fix it. Legal reason: our legitimate interest in a working app.
• Error reports. What broke, and for which account. Legal reason: our legitimate interest in a working app.
• Messages and applications you send us. To answer you. Legal reason: our contract with you, or our legitimate interest in answering.

To have an account, we need your email and a team name. Everything else is your choice, and leaving it out only makes the Journey less personal. Journaling stays on paper on purpose: nothing you write in your journal ever reaches us.

3. The live Q&A sessions and their recordings

• What is recorded. The whole session on Google Meet, including the voice, image, name shown in Meet and chat messages of anyone who chooses to turn on their camera or microphone or write in the chat. Cameras and microphones are off unless you turn them on, and you can join with your first name only.
• Why, and our legal reason. The live session and its replay are part of the membership you bought, so members who could not come can still watch it. Legal reason: our contract with you (GDPR article 6(1)(b)). Taking part actively is always your choice. If you choose to speak about your health or your family's, you do so by your own choice, and you can ask us at any time to remove it.
• Who sees it. Paying members only, as the replay inside the app. The video is stored on StarKid's Google Drive and played through Google's video player, and its link is shared only inside the app.
• How long. In the app until the next session's replay replaces it, which is about one month. After that, the recording is kept in our private archive on Google Drive, which only StarKid can open, for as long as the Journey runs, and it is never shown to members again.
• Never for marketing. We never post a recording, or any part of one that shows or names a member, on social media, on our website or anywhere public. We never use a member's voice, image, name or words for marketing, advertising or any commercial purpose.
• You can change your mind. Write to insight@starkiduniverse.com at any time, and we cut, blur or mute your part of the replay and of the archive within 7 days.

4. The anonymous Q&A letters

For each letter we store only its words and the date and time it was sent. No account, no family, no name and no IP address, and the Q&A room is never tracked by our analytics. Yvonne reads every letter, and once a month the letters are copied into our private archive. Because nothing links a letter to a person, we cannot find, show or delete one person's letters. Please do not write anything that would identify you or anyone else.

5. Children

Children never have their own account, and we never contact them or collect anything from them directly. Everything about a child is added by their parent, who can change or remove it at any time. We never use children's data for marketing, advertising or profiling.

6. Who we share it with

We never sell your data, never share it for advertising, and show no ads. These services help us run the Journey and process data only on our instructions:

• Lovable (Lovable Labs, Sweden and USA): the app, its database and sign-in, built on Supabase.
• Cloudflare (USA): delivers the website and the app securely and quickly.
• Stripe (Stripe Payments Europe, Ireland): payments. Stripe is also responsible in its own right for its fraud prevention and legal duties.
• PostHog (servers in Frankfurt, Germany): app analytics.
• Google (Google Ireland and Google LLC): Meet for the live sessions, Drive for the replays, and Calendar.
• Brevo (Paris, France): emails to members.
• Our print partner: only your name and postal address, to send a poster or journal.
• Our accountant: payment records, for the accounts.

We also disclose data when the law requires us to.

7. Data outside Europe

Some of these services are based in the United States, or may reach data from there. Whenever your data leaves the European Economic Area, it is protected by the EU-US Data Privacy Framework, under which Stripe, Google, Cloudflare and PostHog are certified, or by the European Commission's standard contractual clauses.

8. How long we keep it

• Your account, family and progress: for as long as your account exists. The app never deletes anything on its own, not when you pause, lapse or end your membership, so you can always come back to your family's Journey. When you ask us to delete it, we delete it within 30 days.
• Invoices and payment records: 10 years after the end of the year they belong to, as Slovenian tax law requires (ZDDV-1), even after you ask us to delete your account.
• Sign-up details and error reports: for as long as your account exists, and deleted with it.
• Recordings of how the app is used: 30 days.
• Live session recordings: as set out in section 3.
• Q&A letters: kept without any name, in the app and in our archive.

9. Keeping it safe

Every connection to the Journey is encrypted, your account is protected by your sign-in, only the people who need your data can reach it, and your card details stay with Stripe. The anonymity of the Q&A letters is built into the app itself. If a breach ever puts you at risk, we tell you and the supervisory authority, as the law requires.

10. Your rights

You have the right to:

• see the data we hold about you and get a copy of it
• correct it
• have it deleted
• limit what we do with it
• receive it in a file you can take elsewhere
• object to what we do on the basis of our legitimate interests, including analytics
• withdraw a consent at any time, without affecting what happened before

Write to insight@starkiduniverse.com. It is free, and we answer within one month. We may ask you to confirm it is really you.

We make no decisions about you by automated means alone, and we do not profile you.

If you are unhappy with how we handle your data, you can complain to the Slovenian supervisory authority, the Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, Slovenia, gp.ip@ip-rs.si, www.ip-rs.si, or to the authority where you live. In the United Kingdom, that is the Information Commissioner's Office.

11. Cookies and storage in your browser

We use no advertising cookies and no trackers for ads.

• Sign-in: keeps you signed in. Strictly necessary.
• Your settings: small choices such as sound on or off. Necessary for the app to work the way you set it.
• Analytics (PostHog): an identifier stored in your browser, so we can understand how the app is used and fix what confuses people.
• The replay player (Google): when you press play on a replay, Google's player loads, and Google may set its own cookies under Google's privacy policy.

You can clear or block these in your browser settings. If you block the sign-in storage, you cannot stay signed in.

12. If you live in the United States, including California

We do not sell or share personal information, as those words are defined in the California Consumer Privacy Act, and we never have. In the last 12 months we collected the categories described in section 2: identifiers (name, email, IP address), commercial information (your purchases), internet activity (how you use the app), approximate location (city and country), and sensitive information only where you choose to give it (a child's neurotype), used only to provide the Journey. We do not knowingly sell or share the personal information of anyone under 16.

You have the right to know, access, correct and delete your personal information, and we never treat you differently for using these rights. Write to insight@starkiduniverse.com to make a request. We confirm it is you through the email on your account.

13. Everywhere else

Wherever you live, you have the rights described in section 10, and we answer every request in the same way.

14. Changes to this policy

If we change this policy in a way that matters, we tell you in the app and by email before the change applies. The date at the top always shows the current version.