Privacy policy

Effective date: 14 August 2026

This policy applies to the Bavora AI website and mobile application. Bavora AI is operated by Cureris. Parent and guardian accounts are for adults aged 18 or over; children do not create independent accounts.

Information we collect

• Parent or guardian account information: name, email address, relationship to the learner, optional country, time zone, account identifier, authentication information and consent records.
• Learner profile information: nickname, age, grade or school year, optional pronouns, avatar, interests, subject preferences, learning goals and session limits.
• Learning content and activity: generated lessons, tutor conversations, quiz answers, hints used, response timing, difficulty feedback, confidence ratings, lesson completion, points, streaks and achievements.
• Derived learning information: mastery records, reading and mathematics levels, explanation preferences, areas needing support and observations about methods that help the learner.
• Technical and security information: service providers may process IP address, device or browser type, timestamps, request records and authentication or security logs when necessary to operate and protect the service.

We ask families not to enter a child's surname, address, school name, phone number, precise location, health information, passwords, social handles or identification numbers. Bavora's tutor is instructed not to request this information.

Information we do not intentionally collect

Bavora AI does not request precise location, contacts, photographs, camera or microphone recordings, payment-card information or persistent advertising identifiers. The current release contains no advertising, cross-app tracking or paid subscription flow.

How we use information

• Create and secure the adult account and learner profiles.
• Generate lessons and respond to learner questions.
• Adapt difficulty, pace and explanation style to the learner.
• Save progress and present reports, mastery records and achievements to the parent.
• Apply parent-selected subjects, limits, accessibility settings and reminders.
• Prevent abuse, protect accounts, diagnose service failures and enforce safety rules.

Parent consent and children's privacy

An adult confirms that they are the learner's parent or legal guardian and gives explicit consent for learning-data storage and personalisation before learning begins. Parents can review, export, reset or delete learner information at any time. Bavora does not knowingly permit children to create their own accounts.

AI processing and service providers

To generate a lesson or tutor reply, Bavora sends the relevant learner nickname, age, grade, interests, learning preferences, current lesson and recent lesson conversation to a server-side AI service. Parent contact information, passwords and authentication tokens are not included in AI prompts.

We use service providers only to operate Bavora AI:

• Supabase provides account authentication, database storage and access controls.
• Lovable provides web infrastructure and the server-side AI gateway.
• Google Gemini processes lesson context and recent conversation content to generate AI learning responses routed through the Lovable gateway.

These providers process information on our behalf under their service terms. We may also disclose information when required by law or when reasonably necessary to protect a child, a user or the security of the service. We do not sell personal information, share it for behavioural advertising or allow third parties to use child learning data for their own marketing.

Notifications and device storage

Learning reminders are optional. Reminder preferences are stored on the device and the reminder is scheduled locally by the operating system. The current release does not store an Expo push token on Bavora's servers.

Retention

Parent account and learner information is retained while the relevant account or learner profile exists. Deleting a learner removes that learner's profile, interests, lessons, interactions, quizzes, mastery records, recommendations, achievements, derived learning profile and associated consent records from active systems. Deleting the parent account removes the account and every associated learner record.

Limited information may remain temporarily in protected backups, authentication or security logs according to service-provider retention cycles, or where retention is required to meet legal, fraud-prevention or security obligations. Such information is not used to personalise lessons or for advertising.

Parent choices and deletion

• Download a copy of a learner's stored learning data from the Privacy Centre.
• Reset the learner's derived personalisation profile.
• Correct profile details through the parent account.
• Delete an individual learner and all associated learning records.
• Delete the parent account and every associated learner record.

Account deletion is available in the mobile Parent area and the web Privacy Centre. If you cannot sign in, follow the instructions on the public account deletion page or contact us so we can verify and process the request.

Security

Data is encrypted in transit. Database row-level access rules restrict a parent account to its own learners, and privileged operations and confidential service credentials remain server-side. The mobile and web clients contain only publishable client configuration, not administrative database credentials.

International processing

Our providers may process information in countries other than the user's country. We use reputable providers and apply contractual and technical safeguards appropriate to the service and information involved.

Changes to this policy

We will update this page and its effective date when our practices materially change. If a change requires new parental consent, we will request it before applying the new practice to a learner.

Contact

For privacy questions, access, correction or deletion requests, email infor@cureris.me. You can also use the account deletion page for deletion instructions.